This policy explains what personal information Lyrania collects when you play, why we collect it, who it is shared with, how long we keep it, and the choices you have. "We" and "us" means the Lyrania team who run the game. You can contact us about any of this at [email protected].
What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Username, email address, password (stored only as a one-way hash), gender, optional birthday (day and month only), optional security question and answer (answer stored hashed) | To create and secure your account, let you log in and recover access, and contact you about your account | Contract (providing the game to you) |
| Your game data: characters, items, currencies, guild membership, rankings, settings and activity | To run the game | Contract |
| Messages: public chat, guild and private chat, whispers, in-game mail, and records of trades and market/auction activity | To deliver messages, resolve disputes and scams, and enforce our Terms of Service | Contract and legitimate interests (keeping the game safe and fair) |
| IP addresses, including the addresses you log in from and your IP at registration | Security, preventing abuse, and detecting multi-accounting and ban evasion | Legitimate interests |
| Device information collected by your browser when you play: operating system/platform, time zone, number of CPU cores, device memory, graphics card vendor and model, and a hash (a derived identifier) built from these | To recognise devices so we can detect multi-accounting, account sharing, ban evasion and automated play. We do not use it for advertising or sell it | Legitimate interests |
| Purchase records (what you bought, when, and the PayPal transaction reference and payer email PayPal gives us, or the order and purchase reference Google Play gives us for purchases made in the Android app) | To deliver purchases, handle refunds and chargebacks, and keep financial records. We never see or store your card number | Contract and legal obligation (accounting records) |
| Votes you cast on voting sites, and support tickets or emails you send us | To give vote rewards and to answer you | Contract and legitimate interests |
| Bot-check data: when you register or log in, Cloudflare Turnstile checks your browser to tell humans from bots | Preventing automated sign-ups and attacks | Legitimate interests |
| Advertising measurement from Meta (Facebook and Instagram), on the sign-up page only: Meta cookies (_fbp and _fbc), your IP address, browser and device details, the page address you viewed (which can include the advert labels above) and, when you create an account, the fact that you registered. Never your name, email address or password | To measure whether our Facebook and Instagram adverts lead to sign-ups, and to help Meta show them to people likely to be interested | Your consent, if you are in the UK, the European Economic Area or Switzerland (we ask first). Legitimate interests elsewhere |
We do not knowingly collect any "special category" data (such as health or political opinions). Please do not share it in chat.
If our bot check blocks a sign-up attempt, we keep the email address and username you typed, along with your IP address, for up to 30 days so we can help you try again if the check was wrong. We never keep the password you typed.
If you arrive from one of our adverts, the web address may carry labels saying which advert it was (utm_source, utm_medium and utm_campaign). They are read from the page you land on and used only for that visit: nothing is stored in your browser. If you then register, we save those labels (for example "facebook") against your new account so we can see which adverts bring in players, on the basis of our legitimate interests in measuring our advertising. Apart from the advertising measurement described under "Cookies and similar technologies" below (where the page address, including these labels, goes to Meta), they are not sent to advertising networks or used to track you, they are kept while your account exists, they are included in your data download, and they are erased when you delete your account.
Cookies and similar technologies
We use a session cookie that keeps you logged in and protects against cross-site request forgery. It is strictly necessary for the game to work, so it does not need your consent. Your browser's local storage also holds interface preferences (for example, which tab you last had open) and your choice about advertising cookies (below). We do not use analytics cookies, and the only advertising technology we use is the Meta pixel described below. The device information described above is collected from your browser when you play and is covered by our legitimate interests in keeping the game fair; it is not used to track you across other websites.
Advertising measurement (the Meta pixel). The sign-up page includes the Meta pixel. It lets Meta tell us whether people who clicked our Facebook or Instagram adverts went on to create an account, and helps Meta show our adverts to people likely to be interested. It sets the cookies _fbp and (if you arrived from a Meta advert) _fbc, and sends Meta your IP address, browser and device details, the address of the page you viewed and, when you create an account, the fact that you registered. It never sends your username, email address or password. It runs only on the sign-up page, never inside the game or the Android app.
If you are in the UK, the European Economic Area or Switzerland (or we cannot tell where you are) we show a banner and load the pixel only if you click Accept. Your choice is kept in your browser's local storage, and you can change it at any time with the "Cookie choices" link at the bottom of the sign-up page; choosing Reject afterwards stops the pixel and removes its cookies. Elsewhere the pixel loads without a banner, on the basis of our legitimate interests in measuring our advertising. We work out which group you are in from the country that Cloudflare detects from your IP address. Meta is a separate controller for its own use of this data, under Meta's privacy policy; you can also manage what Meta does with advert data in your Facebook or Instagram ad settings.
Who we share it with
We do not sell your personal information. We share it only with service providers who help us run the game, who may only use it for that purpose:
- Cloudflare (hosting protection, content delivery and the Turnstile bot check) sees visitors' IP addresses and browser information.
- PayPal processes payments made on the website and shares transaction details with us.
- Google Play processes payments made in the Android app (Google Play Billing). Google handles your payment details under its own privacy policy; we receive only an order reference, the product bought and its status (for example if a payment is refunded).
- Google Fonts and public code libraries (jsDelivr, cdnjs, BootstrapCDN) load fonts and icons in your browser, which means those providers receive your IP address when a page loads.
- Meta Platforms (Facebook and Instagram) receives the advertising measurement data described under "Cookies and similar technologies", but only if you accept it where we ask, or if you are in a country where we do not.
- Voting sites you choose to vote on receive what you submit to them; they are separate controllers with their own policies.
Some of these providers are based in or process data in the United States. Where that happens it is covered by appropriate safeguards such as the UK/EU data transfer frameworks or standard contractual clauses. We may also disclose information where the law requires it, for example to respond to a valid request from the police or a court.
Public information
Your username, rank, guild, statistics, and anything you post in public chat channels are visible to other players and may be seen by anyone who can access the game. Think before you share personal details there; information you share in public channels is offered at your own risk.
How long we keep it
- Public main chat is deleted automatically after 2 weeks. Private messages, mail and trade records are kept while your account exists, so that disputes and abuse can be investigated.
- Detailed device observations are deleted automatically after 90 days, and device records after 365 days without being seen.
- Login addresses (IP history) are deleted automatically after 12 months. Other account logs are kept while your account exists.
- Purchase records are kept for as long as the law requires for accounting purposes (currently up to 6 years), even if you delete your account.
- If we ban an account, we keep its login addresses and device records while the ban applies, so that staff can enforce it. Deleting a banned account does not lift the ban. Before anything is erased we store one-way, keyed hashes of that account's email address, login addresses, browser and devices (a hash is a scrambled fingerprint that cannot be turned back into the original, and is useless without a secret key only we hold). We use them for one purpose: so the ban still applies if the same person tries to register again. The originals are erased.
- When your account is deleted we remove or anonymise your personal information as described below.
Your rights
Under UK and EU data protection law (the UK GDPR and EU GDPR) you have the right to:
- Access a copy of the personal information we hold about you, and portability of the information you gave us in a usable format;
- Rectification of anything inaccurate (most of it you can change yourself in Settings);
- Erasure of your account and personal information;
- Restriction of, or objection to, processing based on our legitimate interests (for example the device recognition described above). If you object we will stop unless we have compelling reasons relating to security or fair play;
- Withdraw consent at any time, where we rely on consent.
If you are logged in you can do the main ones yourself in the game under Settings, Security, My Data: download a copy of your data, or delete your account. If you cannot log in, you can ask for your account to be deleted at lyrania.co.uk/app/delete-account. For anything else, email [email protected] from the address registered to your account and we will respond within one month. We may need to verify who you are first.
What happens when you delete your account
On the My Data page you enter your password and ask to delete the account. Nothing changes for 14 days, so you can change your mind and cancel; after that it is deleted automatically. You cannot delete an account while it still leads a guild or has open auctions or market listings, because deleting would strand them; you are told what to sort out first.
When it runs, your username is replaced, and your email address, password hash, security answer, birthday, staff notes and IP history are erased, along with your device and browser records, your mail, your own chat lines, your ignore list, your name history and any email we sent to your address. Your account can never be logged into again. We keep what we are legally required or genuinely need to keep: purchase and financial records, records of staff actions, and support tickets (anonymised along with your name). Items and statistics that belong to the shared game world, for example guild history and rankings, remain under the anonymised name so other players' games are not affected. Deleted accounts cannot be recovered after the grace period.
The one exception is a banned account, as described above: only keyed hashes of its identifiers are kept, so the ban cannot be escaped by deleting the account.
Security
We protect your information with measures including hashed passwords, encrypted connections (HTTPS), restricted staff access and logging of staff actions. No system is completely secure, so please choose a strong, unique password and never share it. If a breach affecting you were to occur we would notify you and the regulator where the law requires.
Children
Lyrania is not intended for children under 13, and where the law sets a higher age for consent to online services in your country (up to 16), you need a parent or guardian's permission. If you believe a child has registered without permission, contact us and we will delete the account.
Complaints
If you are unhappy with how we handle your information, please contact us first so we can put it right. You also have the right to complain to your data protection regulator. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU, your local supervisory authority.
Changes to this policy
We may update this policy as the game changes. The date at the top shows when it last changed. If we make a significant change we will announce it in-game.