Privacy policy

Revision of September 21, 2026

We collect the minimum — only what the game cannot work without. Below: what exactly, why, how long it is kept and how to delete it.

1. What data we collect

Nickname, email, password (stored as a scrypt hash — we never see the password itself and cannot restore it), login times, technical server records (IP address and user-agent in the logs) and game progress: heroes, inventory, warehouse, battles, crafts, lots, forum messages and support requests (subject and conversation). If you supported the project with a donation — a record in the donation journal: amount, currency, time, the donation comment and the email or nickname the payer provided (see the “Donations and the Tribute service” section). If authenticator login is enabled — the TOTP secret and backup code hashes.

2. Why

Sign-in and account recovery without email delivery, protection against multiple accounts, farming and password guessing, the game mechanics themselves (the world lives and works for you: heroes work, residents trade), answering your support requests and aggregate world statistics on the landing page: numbers without names.

3. What we do NOT collect

Payment data — we never receive or store card or wallet numbers: the payment is accepted by the Tribute service and the payment providers on its side (see the “Donations and the Tribute service” section). We also do not collect social network data, ad trackers and cookies, or geolocation. There are no email mailings: SMTP is not connected, the game sends no letters on registration or password recovery — that is why access is restored with an authenticator code.

4. How long we keep it

As long as the project and your account exist. Passwords and authenticator backup codes are kept as hashes only and cannot be restored; sessions are tokens that are revoked by a password change and by the sign-out-everywhere button. Technical server logs are rotated and kept for a limited time.

5. Who we share it with

Nobody. The data stays on the project server; we do not sell it or hand it to ad networks, profiling analytics or any third party. The only exception is a lawful request from an authorised authority. We do not send your data to the payment service: the donation happens on your side, and what the service itself collects is described in its own rules.

6. Your rights

In your account settings you can change the password (all other sessions are revoked), enable or disable code-based sign-in, reissue backup codes and see which revision of the rules you accepted. If you want your account and data deleted, write to Support (the button in the world) from that same account: we will remove heroes, inventory, stash, market lots and support requests, and anonymise forum posts.

7. Age and policy changes

The game is not intended for children under 13: if you are younger, you may play only with your parents' consent. The policy may be updated: the revision date is shown at the top, and a new revision will ask for your consent on the next sign-in.

8. Donations and the Tribute service

Payments are handled by the Tribute service and the payment providers on its side: we neither receive nor store your card or wallet details. Tribute sends us a payment notification: the amount and currency, the time, the donation comment, plus the payer's email or username if provided, and the payer identifier in the service. We keep this data in the donation journal in order to grant the blessing days, to review a request and to avoid crediting them twice, and we delete it together with the player's account. The donation comment is visible to everyone — never put anything there except your email or in-game username.