This describes what ProjectA3 stores about you and why. The short version: what is needed to run an account and a game server, kept no longer than it is useful, and never sold to anyone.

ProjectA3 is a private server run by a small group of players in their own time. Where this page says we, that is who is meant, and [email protected] is how to reach us about anything on it.

What is stored

• Your account. Username and a hashed password. The password is stored hashed, so it cannot be read back — not by us either.
• Your e-mail address. Used to activate the account, to reset a forgotten password, and to reach you about the account. Nothing else.
• Addresses you connect from. Recorded with sign-ins and with changes made from the site, to investigate compromised accounts and abuse.
• What you do on the site. Changes to your account, currency movements, items delivered and anything credited to you are written to an activity log, which you can read yourself in your account panel.
• Your two-factor secret, if your account has two-factor authentication on. It is stored so that the codes your app generates can be checked.
• What your characters do in game. The game server keeps its own logs, which is what the leaderboards are built from.
• A Discord identifier, if you choose to link a Discord account.

We do not ask for your real name, your address, your date of birth or your payment details, and there is no advertising or analytics tracking anywhere on this site.

Why it is stored

Because we cannot give you the account you asked for without it, and because keeping the server secure, keeping cheating and abuse out of it, and answering you when something goes wrong all require a record of what happened. That is the whole of the purpose. Nothing here is used to build a profile of you, and nothing is used for advertising.

Cookies

One cookie keeps you signed in and one protects the site's forms from being submitted from somewhere else. Both are necessary for the site to work; there are no advertising or tracking cookies. Clearing them signs you out.

Who else sees it

Only the staff, and only where they need to. Beyond that, a few services handle something on our behalf:

• Whichever mail provider is configured receives your e-mail address, so that activation and password-reset messages can be sent.
• The sign-up form may use a third-party bot check, which sees your address and browser in order to decide whether you are a person.
• Our hosting provider holds the machines this all runs on.
• If you link a Discord account, we store the identifier that link produces.

Nothing is sold, rented, or shared for advertising. We may hand something over where the law genuinely requires it, or where it is needed to investigate a serious threat to the server or to someone using it.

Where it is held

On servers rented from a hosting provider, which may be in a different country from yours, as may the mail and bot-check services above. Using the service means accepting that your information is handled there.

How long it is kept

Account data is kept while the account exists. Sign-in records, activity entries and game logs are kept as long as they are useful for investigating abuse and for the leaderboards, and are cleared when they are not.

What you can ask for

You can change your e-mail address and your password from your account panel, and read your own activity log there. You can also ask us to give you a copy of what we hold about you, to correct it, or to delete your account, and — depending on where you live — you may have further rights over it. Write to [email protected] from the address the account is registered with and we will deal with it within a reasonable time.

Deleting an account removes it and its characters. Log entries that record what an account did may be kept where they are still needed to investigate abuse or to keep the server's own records straight.

If you think we have handled your information badly, tell us first — and if that does not settle it, you may be able to complain to the data-protection authority where you live.

Children

This is an adult game. It is not intended for anyone under 18, accounts may not be held by them, and we do not knowingly store anything about them. If you believe someone under 18 has registered here, tell us and we will close the account and delete what is stored with it.

Security

Passwords are hashed and forms are protected against submission from other sites. Where two-factor authentication is offered in your account panel, turning it on is the single most useful thing you can do to protect your account. We take reasonable care, but no service can promise it will never be breached, and this one is run by volunteers on rented hardware. If a breach happens and it affects you, we will tell you as soon as we reasonably can.

Changes to this page

This policy may change as the site does. Material changes will be announced on the news page, and the current version is always the one on this page.

Questions about any of this can be raised at [email protected] or on Discord.