Privacy Policy

Who is responsible

ENVARA is an independent online game project and the controller of the personal data described here. Contact for anything about your data, including deletion requests: game@envara.eu.

What we collect

• Your account: email address, a password stored only as a bcrypt hash (we never see or store the password itself), a nickname taken from your email, and the dates the account was created and changed.
• Your game: characters, their progress, items, gold, islands, friends lists, party invitations and similar game state.
• Chat: messages are delivered live to the players who should see them. We do not keep a chat history.
• Bug reports and support requests you send from the game: what you write, plus technical details that help us fix the problem (browser, platform, screen size, game area, game version, diagnostic data) and the IP address the report came from.
• Purchases, where crystal purchases are offered: payments are handled by Stripe. We store the order, the amount, its status and Stripe's reference numbers, and we pass your email to Stripe for the receipt. We never receive your card details.
• Site statistics (our own, no third-party analytics): which pages are viewed, the domain of the site that sent you here, campaign tags in the link if there are any, a device, browser and operating-system category, and a random browser identifier kept in your browser. Your IP address is used only to compute a short anonymous code that changes every day; the IP address itself is not stored. These statistics are not linked to your account.
• Server logs: technical logs, which can include IP addresses, used to keep the service running and secure.

Cookies and browser storage

We use one cookie: auth, which keeps you logged in (a login lasts up to 7 days). It is strictly necessary for the game to work. We also keep a few values in your browser's local storage:

• AUTH and envara.returningPlayer: your display name for the start page, and a note that this browser has logged in before.
• Game settings such as key bindings, interface and graphics options.
• envara_vid: the random statistics identifier, kept for at most 13 months; envara_seen: a flag that this browser has visited before; envara_attr: the campaign tags of the link you arrived through, kept for 90 days.

There are no advertising or third-party tracking cookies. You can delete all of this at any time by clearing the site data in your browser; you will be logged out.

Why we use it

• To run your account and the game you asked to play (performance of a contract).
• To keep the game secure, stop cheating and abuse, fix bugs and understand how the site is used in aggregate (our legitimate interests).
• To keep payment records where the law requires it (legal obligation).

We do not sell your data and we do not use it for advertising profiles. We send you email only when you ask for it, for example a password reset.

How long we keep it

• Account and game data: until you delete the account. A deleted character is removed immediately.
• Site statistics: individual events for 90 days, browser-identifier records for up to 13 months; after that only totals without any identifier remain.
• Bug reports: while we work on them; handled reports are deleted periodically.
• Password reset links: they expire after 30 minutes.
• Payment records: as long as tax and accounting law requires.

Who processes it for us

• Contabo GmbH (Germany) hosts the servers and the database.
• An email delivery provider sends password reset emails.
• Stripe processes payments when you buy crystals. Stripe may process data outside the EU under its own safeguards.

Your rights

You can ask for a copy of your data, its correction or deletion, restriction of processing, a portable copy, and you can object to processing based on our legitimate interests. To delete your account, write to game@envara.eu from the email address of the account. You can also complain to a data protection authority, for example the one in the EU country where you live.

Age

ENVARA is meant for players aged 16 and over. If you believe a younger child has created an account, contact us and we will delete it.

Changes

If this policy changes, the new version is published on this page with a new date. Significant changes are also announced on the start page.