Privacy Policy

Who we are

Malverion is run by a small independent team (“we”). For anything about your data, write to us on our Discord.

What we collect

• Account: your account name, your password stored only as a one-way hash (argon2id), when the account was created and when you last signed in.
• Game: your characters and everything about them (level, items, quests, guild, arena results), your options, and your ignore and mute lists.
• Activity: trades, auction house sales, gold and item movements and game sessions. We use them to keep the economy fair and catch cheating.
• Sign-ins: a log of each attempt (account name, game client, result), kept for 90 days.
• IP address: the game server stores it only as a keyed hash, which cannot be turned back into the address without our secret key. The hash is erased after 90 days, unless a ban that depends on it is still in force.
• Reports: the text you write, the type of report, your client version, map and character, your account if you were signed in, and the screenshot if you attach one.
• Visits and security: for every request to the website and the game and every connection to the game server, the time, the address requested, the page you came from (only its address), your IP address and its public network name, your browser's identifier and language, and the approximate location that Cloudflare works out from the connection (city and country); for sign-ins, also the account name. We use it to see where visits come from and to detect abuse and attacks (floods, password guessing, scans). Only the team sees it, in a private map of visits.
• Server logs: technical records that include chat messages with the name of the character who sent them. They are deleted after 30 days.
• Purchases (if you buy Seals): the order (pack, Seals, amount, currency, date and status) and the identifiers Stripe gives us for that payment, linked to your account. We see the email and country you give Stripe in its dashboard and use them only to handle that purchase.

We do not ask for your email, your real name, your address or your date of birth, and we never see or store your card details.

Why we use it

To run the game you sign up for: your account, your characters and playing with others. To keep it safe and fair: stopping cheating, scams, abuse and attacks, and handling bans and appeals. To fix bugs and improve the game, with your reports and overall figures such as how many people are online or visit the website, and from where. We do not use your data for advertising, we do not build marketing profiles and we never sell it.

If the EU or UK data protection law (GDPR) applies to you: we use your data to provide the game you asked for, and for our legitimate interest in keeping it safe and fair.

If you buy Seals, we use the purchase data to deliver them, handle refunds and chargebacks, and meet our tax and accounting obligations (legal basis: the contract and our legal obligations).

Cookies and storage on your device

The website uses no cookies and no third-party analytics or advertising tools. The game uses one cookie that keeps you signed in: it lasts 24 hours, renews itself while you play and expires after 7 days at most. Cloudflare, which protects our servers, may set its own security cookies.

The browser version keeps the game files and your settings in your browser's storage so that it loads faster. If you tick «Remember my account», the game remembers your account name on your device. Your password is never saved on your device.

Who handles it

• Our team, through its administration tools.
• OVHcloud, which hosts our server, and Cloudflare, which carries the traffic to it. Our web server keeps access logs, with IP addresses, for 14 days.
• OpenAI (ChatGPT), which analyses aggregated visit figures to give us advice; it never receives IP addresses or account names.
• Discord and Steam, if you use them, under their own privacy policies. We never receive your Discord or Steam password.
• Stripe, which processes Seal payments on its own page: it receives your card details, your email and your country, and we never see your card. Stripe may process this data outside the European Economic Area, for example in the United States, with the safeguards the GDPR requires (standard contractual clauses and the EU-U.S. Data Privacy Framework). Its policy: stripe.com/privacy.

We only share data with anyone else if the law requires it.

How long we keep it

• Account, characters and game activity: while the account exists.
• Sign-in log and IP hashes: 90 days, longer only while a ban depends on them.
• Screenshots attached to reports: 30 days. The text of reports is kept to follow up on bugs.
• Web server access logs: 14 days.
• Visit records for the map: 14 days.
• Server logs, including chat: 30 days.
• Backup copies of the database are kept on our server to recover from failures.
• Seal orders: while the account exists and, after that, for as long as tax and accounting law requires.

Your rights

You can ask us for a copy of your data, to correct it, or to delete your account and its data. Write to us on Discord; as we do not have your email, we will ask you to prove that the account is yours, for example from inside the game. Some data may be kept longer while a ban depends on it or when the law requires it. If the GDPR applies to you, you can also complain to your data protection authority.

Children

Malverion is not for children under 13 (see the Terms of Use). If we learn that an account belongs to a child under that age, we will delete it.

Security

Passwords are stored as argon2id hashes, the website and the sign-in go over HTTPS, and IP addresses are stored as keyed hashes. No system is perfectly secure: use a password you do not use anywhere else.

Changes

We may update this policy. The date at the top shows the last change, and important changes are announced on Discord.

Contact

Write to us on our Discord. This policy is translated into several languages; if a translation differs, the English version applies.