DRAFT for review: not legal advice. Fill in every highlighted placeholder and have it checked before the game goes public.

Privacy Policy

Effective [DATE] · Back to the game · Terms of Service

Who we are

The Ninth Gate is run by [OPERATOR NAME / COMPANY], [POSTAL ADDRESS] (“we”). Contact us about this policy or your data at [CONTACT EMAIL]. [If you have one: name and contact of your EU/UK representative or data protection officer.]

What we collect

• Account. Your username and a hash of your password (Argon2id; we never store the password itself). Guest accounts have no username or password; they are tied to a token kept in your browser.
• Characters and play. Character names, appearance choice, level, experience, items, skills, progress, the zone you were last in, and when they were last saved.
• Sessions. For each signed-in device: a hash of its session token, when it was created and last used, the IP address of its last use, and a short device label taken from your browser's user agent (for example “Firefox on Linux”), so you can see and sign out your devices.
• Security and moderation. IP addresses are used, in memory, to limit sign-up and login attempts and to lock out password guessing; this resets when the server restarts. If we ban an address, it is stored with the ban. Moderators may reset passwords and ban accounts.
• Account and game log. A log of events tied to your account and character numbers, used to investigate cheating, bugs, account takeovers and abuse: account sign-ups, logins and failed logins, password changes, sessions signed out, account deletion (these record the username and IP address at that moment), and characters created or deleted, zone changes, level-ups, and items and currency awarded or dropped.
• Technical logs. The server logs connections and errors for operating the service.

We do not use cookies, analytics, advertising or tracking. Your browser stores your session token and your settings in its local storage; they are needed for the game to work and stay on your device. The game, its fonts and its assets are served by our own server: playing sends no data to third parties, except to our hosting provider [HOSTING PROVIDER, COUNTRY], which runs the server for us.

Why, and on what basis

• To provide the game and keep your progress (performance of our agreement with you, the Terms of Service).
• To keep the game secure and fair: rate limits, lockouts, bans, investigating cheating and abuse (our legitimate interest in a safe service).
• To meet legal obligations where they apply.

We do not sell your data or use it for advertising.

How long we keep it

• Account, characters and sessions: while your account exists. Unused sessions expire after [SESSION LIFETIME, e.g. 30 days] of inactivity.
• When you delete a character or your account, it is removed from the game at once. A copy of deleted characters is kept for [e.g. 30 days] so that mistakes can be undone, then erased.
• Game log and technical logs: [e.g. 90 days].
• Address bans: until lifted or expired.

Your rights

You can delete your characters and your whole account yourself in the game (character select → Account → Delete account). Depending on where you live (for example under the EU/UK GDPR or California law) you may also have the right to access, correct or export your data, object to or restrict its use, and complain to your data protection authority. Write to [CONTACT EMAIL]; we answer within one month.

Security

Passwords are stored only as Argon2id hashes and session tokens only as SHA-256 hashes. [Once the server runs behind HTTPS:] The game is served over encrypted connections (HTTPS). No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Children

The Ninth Gate is not directed at children. You must be at least [13, or 16 in the EEA/UK where local law requires] to play. If you believe a child has given us data, contact us and we will delete it.

Where data is stored

Our server is in [COUNTRY / REGION]. [If you or your host transfer EU/UK data outside it: say which safeguards apply, e.g. Standard Contractual Clauses.]

Changes

We will post changes here and update the date above; significant changes will be announced in the game.