Account data: username, email address, password (stored as a scrypt hash — we can never read it). Game data: everything your character does. Technical data: IP address and a device cookie, used for rate limiting and duplicate-account detection (see the Dupe Policy), and page-view counts (pruned after 90 days).

Run the game. That's it — we don't sell your data, we don't run ad trackers, and email is used only for verification codes, password resets, and rare account notices.

Three, all first-party: your session, a device identifier (dupe detection), and a short-lived message cookie. No third-party or advertising cookies.

You can change your email's role by deleting your account — contact support and we'll remove your account and personal data, minus what we must keep for anti-abuse records. Chat messages may remain, anonymized.