Privacy

• Your account – your e-mail address, your password as a salted scrypt hash (never the password itself) and whether the e-mail is confirmed. To sign you in and to send the account e-mails below.
• Sign-in with Google – if you choose it, Google tells us your Google account id and its e-mail address, nothing else (no name, photo or contacts). We use them only to sign you in.
• Sign-in with Discord – if you choose it, Discord shows us your Discord user id, user name and avatar and the account's e-mail address with whether Discord verified it. We keep only the user id and the e-mail, to sign you in; the name and avatar are not stored. We ask for nothing else (no servers, friends or messages), and the access token Discord gives us is revoked as soon as the sign-in is done.
• Your game – characters and their progress, items and gold, quests, friends and guild, in-game mail, trades, Market listings and sales, daily tasks and the login streak, reports and the settings you save, because that is the game. Messages in the world and zone chat channels are stored so players can read back; whispers, party chat and Group Finder posts are not stored. Your guild sees when each of your characters in it was last online.
• Starshards – if you are given or find some of this game currency, your balance, a ledger of every change (a find, a game master's grant or what you spent them on) and the looks you bought with them (skins, nameplates, titles) are kept with your account, and deleted with it. Looks earned at a festival are kept the same way.
• Notifications – if you switch them on in a browser (Settings → Account), we keep the address and keys that browser's push service gives for it, the topics you chose, the browser's user-agent text (the browser, its version and the system it runs on, as the browser reports them), when you switched them on and how many deliveries failed. We use them only to tell you what you chose – a raid boss back, a world event soon, a Market sale, a letter – while you are not playing. Switching them off in the game or in the browser deletes it, as do logging out in that browser and deleting the account.
• Auto Hunt – if you use it, a record of each hunt: the character, the region, the level at the start and the end, when it started, how long it ran, the kills, experience, gold and items it gathered and why it stopped, kept for 30 days to balance the game. While a hunt runs the game server counts how many heroes from the same network address hunt at once (in memory only, not stored).
• Security – your sign-in sessions (a random token, kept as a hash), recent failed sign-ins per e-mail and network address (in memory only), and server logs with the network address and the page requested, kept up to a month, to stop abuse and find faults.
• Crash reports – when the game crashes, the error message, the page and the browser family; no account and no address.

• rpgstar_session keeps you signed in (7 days). rpgstar_device remembers that this browser signed in before, so a stranger's wrong passwords do not lock you out (180 days). rpgstar_google and rpgstar_google_link exist only during a Google sign-in, rpgstar_discord and rpgstar_discord_link only during a Discord sign-in (10 and 15 minutes).
• Your game settings are also kept in the browser's local storage, so the game opens the way you left it.
• The browser also keeps the e-mail you last signed in with and the name, class, level and server of the hero you last played, so the start screen can fill in the e-mail and offer "Continue as …". They stay in this browser and are never sent anywhere; clearing the site's data removes them.
• A visit counter from xlog.lt keeps a random visitor id in the browser and sends xlog.lt the page address, the referring page, the screen size, the language and similar browser details, to count visits.
• There is no advertising and no advertising cookie.

We do not sell or share your data. Google or Discord handles the sign-in if you choose Continue with Google or Discord (their own privacy policies cover those accounts), your browser's push service (Google, Mozilla, Apple or Microsoft) delivers the notifications you switched on - their text and nothing else about you, xlog.lt counts visits, and our hosting provider runs the server. Account e-mails – confirmation links, password links, deletion notices – come from no-reply@sagavale.com; there are no newsletters.

Delete your account in the game: Account → Delete account. The account, all of its characters and their stored chat lines are removed after 7 days; log in before then to keep it. Records of trades, Market sales and item movements are kept for 90 days, and player reports for 180 days after a game master handled them, to check for cheating and abuse - they stay for that time after an account is deleted too. So do, for 180 days, the records of what the game's staff did (with the e-mail address of an account a game master acted on) and the boss log (the heroes who fought each boss, with their level, class, guild and damage). Expired sign-in sessions and e-mail links are deleted a day after they expire, except the newest session of each account: its hashed token and its times stay until the account is deleted, so the game's staff can see when the account last signed in. Sign-in with Google or Discord can be disconnected in the same window while the account keeps another way to sign in – a password or the other one. For a copy of your data or a correction, ask on our Discord server.