Privacy Policy

This policy explains what personal data AdventureWorld (https://adventureworld.online) processes, why, on what legal basis, and what rights you have. We follow the principle of data minimization: we collect only what the game needs to run.

1. Controller

The controller responsible for data processing (Art. 4(7) GDPR) is:

Emilian-Vasile Cristea
Hauptstrasse 112
97909 Stadtprozelten
Germany
E-Mail: cristeaemilianvasile@gmail.com

2. What we process

• Account data: your email address and a salted, one-way password hash (never your plain password), used to create and secure your account.
• World saves and play data: your saved worlds, play time, and game progress, stored so you can continue your game across devices.
• Anonymous client IDs: a random identifier generated on your device so the anonymous free tier works without registration.
• Local storage: session tokens, save data, and settings are stored in your browser's localStorage. This is technically necessary to run the game and keep you logged in. We use no advertising cookies or similar technologies.
• First-party gameplay statistics (our own, no third parties): to understand whether the game works and is worth improving, the game itself reports a small set of events to our own server: a once-per-day visit ping (a hash of your anonymous client ID salted with the current date, so it counts your device once per day and cannot be linked across days; plus the hostname — never the path — of the page that referred you, and a campaign tag such as utm_source if one was in the address you opened), session start, whole minutes of visible play, and technical error reports (error message and page path only). We do not store your IP address in these statistics, we do not fingerprint your device, we use no cookies for this, and nothing is shared with or sold to anyone.
• Feedback you choose to send: if you use the in-game feedback box, we store the text you write together with technical context (world name and seed, in-game day, position, play time, client version) and your anonymous ID or account ID, so we can reproduce bugs and answer you. Sending feedback is entirely voluntary; your save file and your email address are never attached automatically.

3. Processors

• Stripe (Stripe Payments Europe, Ltd.): payments. Stripe acts as merchant of record for purchases — your payment data (card details, billing data) is processed directly by Stripe; we never see or store your card data. See stripe.com/privacy.
• Cloudflare (Cloudflare, Inc.): hosting and content delivery. Cloudflare processes technical connection data (e.g. IP address, request metadata) in server logs as necessary to deliver and secure the service. See cloudflare.com/privacypolicy.

4. Purposes and legal bases

• Art. 6(1)(b) GDPR — performance of a contract: providing the game and your account, storing your world saves, processing purchases and delivering the digital content you bought.
• Art. 6(1)(c) GDPR — legal obligation: retaining transaction and invoice records where German commercial and tax law requires it.
• Art. 6(1)(f) GDPR — legitimate interest: keeping the service secure and available (e.g. abuse prevention, security-relevant server logs), and understanding in aggregate how the game is found and played (the first-party statistics described above) so we can fix what breaks and improve what matters. Our interest is limited to what is strictly necessary, and you may object at any time (Art. 21 — see section 6).

5. Retention

We keep your personal data until you delete your account or ask us to erase it. Where legal retention duties apply (e.g. German tax and commercial record-keeping for purchase transactions), the affected records are kept for the statutory period and then deleted. First-party statistics tied to your anonymous ID (activity days, feedback entries) are erased when that identity or your account is deleted; the day-salted visit hashes cannot be tied back to you in the first place.

6. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectify inaccurate data (Art. 16),
• erasure of your data (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21), and
• withdraw any consent you have given, at any time, with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a supervisory authority. For us this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — www.lda.bayern.de.

7. International transfers

Our processors Stripe and Cloudflare may process data outside the EU/EEA. Such transfers are covered by adequacy safeguards under Chapter V GDPR (e.g. the EU–US Data Privacy Framework and/or Standard Contractual Clauses).

8. Minors

AdventureWorld is not directed at children under 16. Account creation requires an age declaration; accounts for players under 16 require the consent of a parent or legal guardian. If you believe a child has created an account without such consent, contact us and we will delete it.

9. Privacy requests and deletion

For any privacy request — access, export, correction, or deletion of your data — email cristeaemilianvasile@gmail.com or support@adventureworld.online. To delete your account and all associated data, email us from the address registered with your account; we will confirm the deletion once it is complete.