Privacy

Account and email data

Registration stores your game account name, a salted password hash, verified email address and verification time. Existing game progress stays with your game account.

Security codes expire after 10 minutes, can only be used once and are limited to five failed attempts. Only keyed hashes of codes and flow bindings are stored. Passwords and codes are not included in application logs.

Mail delivery and security

Verification emails are sent through Spacemail by Spaceship from [email protected]. Spacemail processes the recipient address and the security email for delivery. Cloudflare proxies website traffic and processes connection metadata for delivery and security.

Essential secure cookies keep your account session and verification flow working. Website sessions expire after one hour. Abuse limits use keyed hashes derived from account names, email addresses or connection addresses. Expired verification and rate-limit records are removed on subsequent requests.

Web access logs are size-limited and retained for up to 72 hours. No advertising analytics have been added. You can contact staff through private support on the forum.

Community and CAPTCHA

Forum profiles are linked internally to the game account ID. The display name you choose is public; the login name is not published on forum profiles or posts. Public posts, profile pictures, bios, follows and reactions are visible to visitors. Private tickets are visible only to their author and staff. Direct messages are visible to their participants. Website presence and the public last-visit display can be hidden in profile settings. Warning history is visible only to the affected member and forum staff. Profile visitor sharing is optional and off by default; opted-in visits are shown only to the profile owner, kept for up to 30 days and removed when sharing is disabled. Cover images are cropped and image metadata is removed.

Cloudflare Turnstile processes browser and connection information to verify visitors on account forms. Captcha tokens are verified on the server and are not stored in plain text. Uploaded profile pictures are resized in the browser and revalidated on the server; nonessential image metadata is removed.

Security notice

Never share a security code with another person. If an email was not requested by you, ignore it. Receiving a code alone does not change an account or password.