This policy explains what personal information Lyrania collects when you play, why we collect it, who it is shared with, how long we keep it, and the choices you have. "We" and "us" means the Lyrania team who run the game. You can contact us about any of this at [email protected].
What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Username, email address, password (stored only as a one-way hash), gender, optional birthday (day and month only), optional security question and answer (answer stored hashed) | To create and secure your account, let you log in and recover access, and contact you about your account | Contract (providing the game to you) |
| Your game data: characters, items, currencies, guild membership, rankings, settings and activity | To run the game | Contract |
| Messages: public chat, guild and private chat, whispers, in-game mail, and records of trades and market/auction activity | To deliver messages, resolve disputes and scams, and enforce our Terms of Service | Contract and legitimate interests (keeping the game safe and fair) |
| IP addresses, including the addresses you log in from and your IP at registration | Security, preventing abuse, and detecting multi-accounting and ban evasion | Legitimate interests |
| Device information collected by your browser when you play: operating system/platform, time zone, number of CPU cores, device memory, graphics card vendor and model, and a hash (a derived identifier) built from these | To recognise devices so we can detect multi-accounting, account sharing, ban evasion and automated play. We do not use it for advertising or sell it | Legitimate interests |
| Purchase records (what you bought, when, and the PayPal transaction reference and payer email PayPal gives us) | To deliver purchases, handle refunds and chargebacks, and keep financial records. We never see or store your card number | Contract and legal obligation (accounting records) |
| Votes you cast on voting sites, and support tickets or emails you send us | To give vote rewards and to answer you | Contract and legitimate interests |
| Bot-check data: when you register or log in, Cloudflare Turnstile checks your browser to tell humans from bots | Preventing automated sign-ups and attacks | Legitimate interests |
We do not knowingly collect any "special category" data (such as health or political opinions). Please do not share it in chat.
If our bot check blocks a sign-up attempt, we keep the email address and username you typed, along with your IP address, for up to 30 days so we can help you try again if the check was wrong. We never keep the password you typed.
Cookies and similar technologies
We use a session cookie that keeps you logged in and protects against cross-site request forgery. It is strictly necessary for the game to work, so it does not need your consent. Your browser's local storage also holds interface preferences (for example, which tab you last had open). We do not use advertising or analytics cookies. The device information described above is collected from your browser when you play and is covered by our legitimate interests in keeping the game fair; it is not used to track you across other websites.
Who we share it with
We do not sell your personal information. We share it only with service providers who help us run the game, who may only use it for that purpose:
- Cloudflare (hosting protection, content delivery and the Turnstile bot check) sees visitors' IP addresses and browser information.
- PayPal processes payments and shares transaction details with us.
- Google Fonts and public code libraries (jsDelivr, cdnjs, BootstrapCDN) load fonts and icons in your browser, which means those providers receive your IP address when a page loads.
- Voting sites you choose to vote on receive what you submit to them; they are separate controllers with their own policies.
Some of these providers are based in or process data in the United States. Where that happens it is covered by appropriate safeguards such as the UK/EU data transfer frameworks or standard contractual clauses. We may also disclose information where the law requires it, for example to respond to a valid request from the police or a court.
Public information
Your username, rank, guild, statistics, and anything you post in public chat channels are visible to other players and may be seen by anyone who can access the game. Think before you share personal details there; information you share in public channels is offered at your own risk.
How long we keep it
- Public main chat is deleted automatically after 2 weeks. Private messages, mail and trade records are kept while your account exists, so that disputes and abuse can be investigated.
- Detailed device observations are deleted automatically after 90 days, and device records after 365 days without being seen.
- Login addresses (IP history) are deleted automatically after 12 months. Other account logs are kept while your account exists.
- Purchase records are kept for as long as the law requires for accounting purposes (currently up to 6 years), even if you delete your account.
- If we ban an account, we keep its login addresses and device records while the ban applies, so that staff can enforce it. Deleting a banned account does not lift the ban. Before anything is erased we store one-way, keyed hashes of that account's email address, login addresses, browser and devices (a hash is a scrambled fingerprint that cannot be turned back into the original, and is useless without a secret key only we hold). We use them for one purpose: so the ban still applies if the same person tries to register again. The originals are erased.
- When your account is deleted we remove or anonymise your personal information as described below.
Your rights
Under UK and EU data protection law (the UK GDPR and EU GDPR) you have the right to:
- Access a copy of the personal information we hold about you, and portability of the information you gave us in a usable format;
- Rectification of anything inaccurate (most of it you can change yourself in Settings);
- Erasure of your account and personal information;
- Restriction of, or objection to, processing based on our legitimate interests (for example the device recognition described above). If you object we will stop unless we have compelling reasons relating to security or fair play;
- Withdraw consent at any time, where we rely on consent.
If you are logged in you can do the main ones yourself in the game under Settings, Security, My Data: download a copy of your data, or delete your account. For anything else, email [email protected] from the address registered to your account and we will respond within one month. We may need to verify who you are first.
What happens when you delete your account
On the My Data page you enter your password and ask to delete the account. Nothing changes for 14 days, so you can change your mind and cancel; after that it is deleted automatically. You cannot delete an account while it still leads a guild or has open auctions or market listings, because deleting would strand them; you are told what to sort out first.
When it runs, your username is replaced, and your email address, password hash, security answer, birthday, staff notes and IP history are erased, along with your device and browser records, your mail, your own chat lines, your ignore list, your name history and any email we sent to your address. Your account can never be logged into again. We keep what we are legally required or genuinely need to keep: purchase and financial records, records of staff actions, and support tickets (anonymised along with your name). Items and statistics that belong to the shared game world, for example guild history and rankings, remain under the anonymised name so other players' games are not affected. Deleted accounts cannot be recovered after the grace period.
The one exception is a banned account, as described above: only keyed hashes of its identifiers are kept, so the ban cannot be escaped by deleting the account.
Security
We protect your information with measures including hashed passwords, encrypted connections (HTTPS), restricted staff access and logging of staff actions. No system is completely secure, so please choose a strong, unique password and never share it. If a breach affecting you were to occur we would notify you and the regulator where the law requires.
Children
Lyrania is not intended for children under 13, and where the law sets a higher age for consent to online services in your country (up to 16), you need a parent or guardian's permission. If you believe a child has registered without permission, contact us and we will delete the account.
Complaints
If you are unhappy with how we handle your information, please contact us first so we can put it right. You also have the right to complain to your data protection regulator. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU, your local supervisory authority.
Changes to this policy
We may update this policy as the game changes. The date at the top shows when it last changed. If we make a significant change we will announce it in-game.