Privacy policy

This text hasn't been reviewed by a lawyer yet. It describes what Shardbound really does with your data and will be checked before paid early access opens.

This policy covers the Shardbound website, the launcher, the game and its servers. We keep as little as we can: no advertising, no analytics, no tracking, and nothing is sold or shared for marketing.

Who is responsible

Marcel Drinkuth
Gänsebrink 12
32369 Rahden
Deutschland

E-Mail: info@ninth-lantern.com

Visiting the website

When you open a page, our server receives your IP address, the page you asked for, the time and your browser's user agent. It uses them to send you the page and to protect sign-in against password guessing: failed attempts from one address are counted for a few minutes. Our servers' logs record events such as sign-ins by username (never passwords), not your IP address, and are rotated after a short time. Legal basis: our legitimate interest in running a secure website, Art. 6 (1) (f) GDPR.

The fonts and images are served from this site itself; your browser makes no requests to Google or other third parties.

Cookies and local storage

When you sign in, we set one cookie, sb_session: a random token that keeps you signed in for up to 8 hours. It is strictly necessary for the account page and needs no consent. Your browser also stores a flag, sb_has_session, so the page knows to check whether you're still signed in. There are no other cookies.

Your Shardbound ID

For an account we store your username, your email address and a hash of your password (Argon2id; we never store the password itself), when the account was made, and, if you sign in through Steam or Epic, that service's account ID. We use them to run your account, let you sign in, and help you recover it. Legal basis: the contract with you, Art. 6 (1) (b) GDPR.

Playing the game

The game servers store your characters and everything that belongs to them: level, position, items, gold, quests, guild, friends, mail and auction listings, and a log of item changes. To keep the game fair we also keep records of rule enforcement (bans and their reasons, and what our staff did and why). Chat goes through our servers to the players it is meant for. The world server writes chat messages with the character's name to its log, which we use to deal with reports of abuse; the log is rotated after a short time and not kept as an archive. When you redeem a game key, failed attempts are recorded with your account and IP address for an hour, to stop guessing. Legal basis: the contract with you (Art. 6 (1) (b)) and our legitimate interest in a fair, secure game (Art. 6 (1) (f) GDPR).

Early access payments

Subscriptions are sold by Polar Software Inc. (polar.sh), our merchant of record. When you subscribe, you give your payment details to Polar, not to us; Polar processes them under its own privacy policy as the seller. Polar tells us your subscription's state (which plan, whether it's active, when it renews or ends) and an ID for it, and we store that with your account to unlock early access. We pass Polar your account ID and email address to start the checkout. Polar is based in the United States; its privacy policy explains how it protects your data there. Legal basis: the contract with you, Art. 6 (1) (b) GDPR.

If you are a Founder, your username may appear in the game's credits and on the early access page. You can ask us to leave it out.

The launcher

The launcher signs in with your Shardbound ID and downloads the game from our download server, which sees your IP address and which files you download, and checks with the account service that your account may download a test version. It doesn't send us anything about your computer beyond that.

Where the data lives

Our servers are rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Falkenstein, Germany. We don't send your data anywhere else, apart from Polar as described above.

How long we keep it

Account and game data: as long as your account exists. When you ask us to delete your account, we delete it and your characters within 30 days, except what the law requires us to keep (for example, records of payments, which Polar keeps as the seller). Enforcement records are kept as long as the ban lasts, and at most two years after it ends.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Art. 15–21 GDPR). Write to us at the address above. You can also complain to a data protection supervisory authority, in particular in the EU country where you live.

Children

Shardbound is not meant for children under 16. If you are younger, please ask a parent or guardian before you create an account.