Privacy Policy
What we collect, why we collect it, how long we keep it, and how to get it removed
This is the single privacy policy for every Arkanodia service. The store-specific notes for Google Play and Steam (sections 12 and 13) are part of this document, so one link to this page is enough for both stores.
1. Who is responsible for your data
Arkanodia is an independent online game run by a single operator.
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Arkanodia operator (sole trader)
Poland
Poland
E-mail: support@arkanodia.com
You can also reach the staff on the official Discord server (discord.gg/arkanodia), but requests concerning your personal data are handled by e-mail so that we can verify who is asking.
2. What this policy covers
| Service | What it is |
|---|---|
Website arkanodia.com | registration, account panel, leaderboards, news, item shop, Discord linking, client download |
| Game client | the Arkanodia application for Windows (downloaded from the website or installed through Steam) and for Android (com.mmo.arkanodia, from Google Play or an APK we publish) |
| Game servers | the authentication server and the game world servers the client connects to |
| Discord | the official Arkanodia Discord server and the Arkanodia bot that runs on it |
Arkanodia is in alpha. Features change often; this policy is updated whenever the data we process changes (section 15).
3. Data we process and why
3.1 Creating and using an account
To play you need an Arkanodia account, created on the website.
| Data | Details |
|---|---|
| Account name (login) | 4-24 characters, chosen by you. Used to sign in. Never shown to other players. |
| Display name | 4-24 letters, chosen by you. This is also your character's name and is visible to every other player, on the leaderboards and in Discord Rich Presence. |
| E-mail address | Used to confirm registration, to deliver one-time login codes (two-factor authentication), password resets, e-mail changes and ArkCoin transfer confirmations. We never send marketing e-mail. |
| Password | Stored only as an Argon2id hash. We cannot read your password. |
| Account creation date, last login time | Kept for support and moderation. |
| One-time codes | Short-lived codes e-mailed to you. A code expires after a short time and after a few wrong attempts. |
| Website login attempts | Account name as typed, the outcome, the IP address and time. Kept for 90 days to detect brute-force attacks and account takeover. |
| Code issue log | Your e-mail address and IP address are kept for 24 hours whenever a code is sent, to limit how many codes can be requested. |
If you try to register with an e-mail address that already has an account, we e-mail the owner of that address instead of telling the person registering.
An unconfirmed registration is deleted automatically after 30 minutes and nothing is kept.
3.2 Playing the game
When the game client signs in and joins a world server we process:
| Data | Details |
|---|---|
| IP address | Needed to deliver game traffic to you. Also recorded with each login and connection, and used to enforce bans. |
| Device identifier | An identifier derived from your device's hardware (Windows) or assigned to the app by the operating system (Android). It is sent when you sign in and recorded next to the IP address. It is used only to enforce bans and to detect ban evasion and multi-account abuse. It is not used for advertising or analytics. |
| Platform and client version | "windows" or "android" and the protocol version, used for compatibility. |
| Login and connection records | Time, IP address, device identifier and the account or character that connected, including failed login attempts. |
| Characters and progress | Character name, class, level, experience, skills, position, play time, gold, inventory, depot, mailbox items, PvP skull state. |
| Gameplay logs | Experience gained and lost, item creation, movement, sale, drop and destruction, player-versus-player kills (killer, victim, time), item-shop deliveries, and every command used by game masters. |
| Chat | Chat messages (local, global, whispers) are relayed to the recipients and are not stored on our servers. For whispers we keep only who wrote to whom and when, without the text, so that harassment reports can be checked. |
3.3 ArkCoins, purchases, the item shop and name changes
ArkCoins are the in-game currency. They can be bought for real money only inside the Android app through Google Play and inside the Steam version through the Steam Wallet; the website sells nothing for real money and never asks for payment details. Staff can also grant ArkCoins (events, compensation). ArkCoins have no cash value and cannot be exchanged back into money.
| Data | Details |
|---|---|
| Wallet and ledger | Your balance and every change to it (amount, reason, time, and for a grant the staff member who made it). |
| Purchases through Google Play | When you buy an ArkCoin pack in the Android app, Google LLC takes the payment as the seller of record and we receive from Google: the order number, the product bought, the purchase state, whether it was a test purchase, and the time. We send Google a hashed form of your account number so that the purchase can be matched to your Arkanodia account and to nobody else's. We never receive your payment method, card number or billing address. |
| Purchases through Steam | When you buy an ArkCoin pack in the Steam version, Valve Corporation takes the payment through the Steam Wallet and we receive from Valve: the transaction number, your Steam ID, the currency, the amount, your country as Steam knows it, and the state of the transaction. We never receive your payment method. |
| Purchase records on our side | Account, store, product, number of ArkCoins, state, order or transaction number, time, and the IP address and device identifier of the client that made the purchase. |
| Transfers | Sender, recipient, amount, time and the sender's IP address. |
| Shop purchases | Account, offer, item, server, price in ArkCoins, time and your IP address. The purchased item is queued to the game server and delivered to your in-game mailbox. |
| Display-name changes | Old name, new name, price, time and your IP address. |
Refunds and chargebacks are handled by Google or Valve under their rules; when a purchase is refunded or reversed, the ArkCoins it bought are removed from the account, and the account can go into a negative balance if they were already spent. The IP address and device identifier are recorded on these actions to investigate fraud, account theft and rule violations involving ArkCoins.
3.4 Leaderboards and community statistics
The game servers send character rankings to the website regularly. The public leaderboard shows: character name, class, realm, level, experience, skill levels, play time, PvP kills, unjustified kills and skull. Staff characters are excluded. Your account name, e-mail address and Discord details are never shown on the leaderboard.
The website also shows aggregate counts only (number of accounts, new accounts this week, Discord-linked accounts, active bans) and whether each server is online.
3.5 Discord
Discord is a separate service run by Discord Inc. (USA). Each of the following features is optional and is only used when you start it.
Linking your account on the website. The website asks Discord for your Discord ID, username, avatar and, if Discord has verified it, your e-mail address (OAuth scopes identify email). We store your Discord ID, username, avatar hash, the link date and the OAuth tokens Discord issued. The Discord e-mail is only used to pre-fill the registration form. Once linked, you can sign in on the website and in the game with Discord. Unlinking requires a second confirmation through Discord, or a request to staff.
Login with Discord in the game client. The client uses the Discord Social SDK to sign you in to Discord (OAuth with PKCE). The resulting token is sent to our authentication server, which asks Discord which Discord account it belongs to and signs you into the Arkanodia account linked to it. The token is kept on your device (section 6) and is never written to our logs.
Rich Presence. If the Discord application is running on your device, the client tells it that you are "Playing Arkanodia", together with your character name and level and the server you are on. Discord shows this on your Discord profile according to your Discord privacy settings. You can turn activity sharing off in Discord's settings.
The Arkanodia Discord bot. On our Discord server the bot:
- gives the "verified" role to members whose Discord account is linked to an Arkanodia account, and removes it on unlink;
- posts to a staff-only log channel when a member joins (Discord tag, ID, avatar, account creation date), when staff take a moderation action (target, moderator, reason), and when an account is linked or unlinked (Discord tag and Arkanodia account number);
- runs the support ticket system (a private channel per ticket; no transcript is kept, and the channel is deleted when the ticket is deleted);
- lets staff look up the Arkanodia account linked to a member and a member's roles, join date and moderation status. These replies are visible only to the staff member.
The bot does not read, store or analyse your Discord messages, except that staff can forward one specific message to the announcements channel. The bot keeps a small local record of active moderation measures and open tickets, and a technical log of its own actions.
3.6 Moderation, bans and staff access
Staff enforce the server rules (/rules). To do so they may:
- ban an account, an IP address or a device identifier, with a reason and an expiry date. The ban reason is shown to you when you try to log in. Lifting a ban removes the ban record, but the staff audit log keeps the action;
- kick a player from the game with a reason;
- inspect a player's inventory, depot and position in the game;
- in the website admin panel, see your account name, display name, e-mail address, creation date, last login, Discord link, ArkCoin history, name history, your login attempts with IP addresses, and the connection logs with IP addresses and device identifiers.
Every action a staff member takes in the admin panel is recorded in an audit log together with the staff member's IP address and the details of the change (for example an old and new e-mail address or a banned IP). Every game-master command is recorded in the game logs.
Staff never see your password, and the OAuth tokens are not shown in the admin panel.
3.7 Technical logs of the website and servers
- The web server keeps an access log with the IP address, time, requested page, HTTP status, referring page and browser user agent of every request, including client downloads. It is used to detect attacks and errors. Addresses that generate abuse are blocked temporarily.
- The authentication and game servers write daily text logs that contain connection events (IP address, account or character name), rate-limit events, game events (deaths, PvP kills, respawns, class choice) and errors. The files are rotated and deleted after 30 days.
- The PHP error log can contain an e-mail address when sending an e-mail fails.
3.8 Support and contact
If you write to us by e-mail or on Discord, we process what you send us to answer you.
4. Data we do not collect
- No real name, date of birth, phone number, postal address or payment details. Google and Valve handle payments; we only ask you to confirm that you are at least 16 (section 11).
- No location data. The website sends
Permissions-Policy: geolocation=(). - No analytics, advertising or tracking SDKs in the website, the game client or the Android app.
- No crash reporting or telemetry from the game client. The "telemetry" toggle in the client only shows the FPS and ping counter on screen; it sends nothing.
- No advertising identifier, IMEI, contacts, camera, microphone or storage access on Android.
- No chat message content stored on our servers.
- No marketing e-mail.
5. Cookies and similar technologies
The website sets one cookie, ARKSESSID, which keeps you signed in. It contains a random session identifier and no personal data. It lasts 12 hours, or 30 days if you tick "remember me"; a session also ends after 7 days of inactivity. The cookie is HttpOnly, SameSite=Lax and Secure.
There are no analytics, advertising or third-party tracking cookies, so no cookie banner is needed. You can block the cookie in your browser, but then you cannot sign in.
The game client uses no cookies.
6. Data stored on your device
The game client keeps a few files in its data directory (%APPDATA%\arkanodia on Windows, the app's private storage on Android, which is excluded from Android backups):
- your client settings (fullscreen, vsync, hotbar), which contain no personal data;
- a Discord sign-in token, only if you used Login with Discord; signing out of Discord in the client removes it;
- a technical log that includes your account number and character name.
The client never stores your Arkanodia password. Uninstalling the app removes all of these files on Android; on Windows delete the folder above.
7. Who receives your data
We do not sell personal data and we do not share it with advertisers.
| Recipient | What and why |
|---|---|
| Other players | Character name, class, level, position, skull, and whatever you type in chat. Leaderboard data (section 3.4). |
| Arkanodia staff (game masters and administrators) | As described in section 3.6, only for moderation and support. |
| Hosting provider (vps4you.hu, data centre in Hungary (European Union)) | Our servers are rented virtual machines. The provider stores the data on our behalf and does not access it. |
| Discord Inc., USA | Only when you use Discord features (section 3.5). |
| Google LLC, USA | The website loads the Inter and Space Grotesk fonts from Google Fonts, which sends your IP address and browser details to Google when a page loads. If you install the game from Google Play, Google processes your Play account, downloads and crash statistics under its own policy, and takes the payment for ArkCoin packs bought in the app (sections 3.3 and 12). We verify each purchase with Google's servers, which receive the purchase token and a hashed account number. |
| Valve Corporation, USA | Only if you obtain the game through Steam (section 13): Valve verifies your Steam sign-in ticket for us, takes the payment for ArkCoin packs bought in the Steam version, and processes your Steam account under its own policy. |
| E-mail delivery | E-mails are sent from our own mail server. The receiving mail provider (yours) sees the content. |
| Authorities | Only if the law requires it. |
International transfers. Discord, Google and Valve are established in the United States. Transfers to them rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses, as described in each recipient's privacy policy. Everything else stays on our servers in the European Union.
8. How long we keep data
| Data | Retention |
|---|---|
| Unconfirmed registration | 30 minutes |
| One-time e-mail codes | until used or expired, at most 30 minutes |
| Code issue log (e-mail + IP) | 24 hours |
| Website session | until you sign out; at most 30 days, or 7 days without activity |
| Website login attempts (IP) | 90 days |
| Account, characters, items, progress, wallet | as long as your account exists |
| Game connection and login records (IP, device identifier) | 12 months |
| Gameplay logs (experience, items, kills, GM commands, server events) | 12 months; game-master command logs 3 years |
| PvP kill records used for skulls | 7 days for skull calculation; the aggregated kill counts stay with the character |
| Bans | until the ban expires or is lifted. A ban record kept after the account is deleted is removed together with the account stub (section 9). |
| Staff audit log | 3 years |
| ArkCoin ledger, transfers, shop purchases, name history | as long as the account exists, then 12 months with the IP address removed |
| Real-money purchase records (order number, product, amount, time) | 5 years after the end of the tax year in which the purchase was made, as Polish accounting and tax law requires |
| Discord link and OAuth tokens | until you unlink; the link/unlink queue entries for 30 days |
| Discord bot staff log channel and ticket records | as long as our Discord server exists; ticket channels are deleted when staff delete the ticket |
| Web server access logs | 30 days |
| Support e-mails | 12 months after the request is closed |
| Data on your device (section 6) | until you delete it or uninstall the game |
When a retention period ends, the data is deleted or anonymised so it can no longer be linked to you.
9. Account deletion
You can delete your account yourself at any time: sign in on the website, open My Account > Delete Account (https://arkanodia.com/account/delete), enter your password and the code we e-mail you. The page https://arkanodia.com/delete-account explains the procedure and is linked from the game's login screen. If you can no longer sign in, e-mail us (section 10) and we will delete the account after verifying that it is yours.
Deleting the account removes, within minutes: your account name, display name, e-mail address, password hash, browser sessions and pending codes, the Discord link and its tokens, the ArkCoin wallet, and on every game server your characters with their items, equipment, depot, gold, skills, progress and mailbox. Nobody can sign in to the account afterwards and it cannot be restored. ArkCoins are not refunded.
We keep, in pseudonymised form (account number only, no e-mail, no IP address):
- the ArkCoin ledger, transfers, shop purchases and name history for 12 months, so that abuse of the in-game economy can still be investigated;
- real-money purchase records for the period required by tax law (section 8);
- the staff audit log, so that staff actions remain accountable;
- ban records for as long as the ban is in force, so that a banned player cannot simply re-register;
- connection and login records until their own retention period ends (section 8).
The account row itself survives only as a numbered stub carrying the deletion date, and is removed after 12 months. Your character name becomes free for other players once the character is deleted.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate data (you can change your e-mail address, password and display name yourself in the account panel);
- erasure of your data (section 9);
- restriction of processing while a dispute is resolved;
- data portability of the data you gave us, in a machine-readable format;
- object to processing based on our legitimate interests, including the device identifier, logging and leaderboards; we will stop unless we have compelling grounds, such as an active ban;
- withdraw consent at any time where processing is based on consent (we currently rely on consent for nothing; all processing is contract or legitimate interest);
- lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl). You may also complain to the authority of your own EU country.
To exercise a right, e-mail us from the address registered on your account, or from another address with your account name; we may ask you to confirm the request through a code sent to your registered address. We answer within one month; for complex requests we may extend this by two further months and will tell you why.
Exercising your rights is free of charge.
11. Children
Arkanodia is not directed at children. You must be at least 16 years old to create an account: the registration form requires you to confirm this, and we record when you did. We do not knowingly process the data of anyone younger; if you believe a child under 16 has an account, contact us and we will delete it.
12. Android app and Google Play
This section applies to the Android client (com.mmo.arkanodia), whether installed from Google Play or from an APK we publish.
- Permissions:
INTERNETandACCESS_NETWORK_STATEonly. The app does not request storage, location, camera, microphone, Bluetooth or notification permissions. - Identifiers: the app reads the Android ID, an identifier assigned to the app by the operating system, and sends it to our servers as the device identifier described in section 3.2, for ban enforcement and abuse prevention only. It does not read the advertising ID, IMEI or any other device identifier.
- Third-party SDKs: the Discord Social SDK (section 3.5) and the Google Play Billing Library, which handles ArkCoin purchases (section 3.3). No Google Play Services beyond billing, no Firebase, ads or analytics libraries are included.
- Data from Google Play: when you install from Google Play, Google processes your Google account, purchase history, device information and optional crash and performance statistics according to the Google Play Terms of Service and Google's privacy policy. We see only the aggregated statistics Google shows developers in the Play Console and the purchase data listed in section 3.3; we do not receive your Google account details.
- Backups: the app opts out of Android backup, so the files in section 6 are not copied to your Google account.
- Account deletion: delete the account yourself at
https://arkanodia.com/account/delete(explained athttps://arkanodia.com/delete-account, linked from the app's login screen), or ask us as described in section 10. - Encryption: your sign-in data, the device identifier and all game traffic are encrypted between the app and our servers (section 14).
13. Steam
This section applies to the Steam version of the game.
- Valve as a separate controller. Downloading and launching the game through Steam means Valve Corporation processes your Steam account, purchase and usage data under the Steam Privacy Policy (https://store.steampowered.com/privacy_agreement/). We do not receive your payment details from Valve.
- Steamworks data we use. The Steam version reads your Steam ID and the language of your Steam client, and asks Steam for a sign-in ticket when you buy ArkCoins or sign in with Steam. Our authentication server sends that ticket to Valve to confirm which Steam user it belongs to. We do not read your friends list, achievements or Steam Cloud.
- Sign in with Steam and account linking. Linking happens on the website only, where Steam confirms your Steam ID to us (OpenID). We then store your Steam ID, your Steam persona name and the link date next to your Arkanodia account, so that the Steam version can sign you in without a password and so that ArkCoin purchases through the Steam Wallet reach the right account. You can unlink at any time in the account panel; the stored Steam data is deleted with the link.
- Purchases. ArkCoin packs bought in the Steam version are paid through the Steam Wallet; what we receive is listed in section 3.3.
- Steam Overlay and Steam Input run inside the Steam client and are governed by Valve's policy.
- Everything else in this policy (device identifier, logs, chat, Discord, retention, rights) applies to the Steam version in the same way as to the website download.
14. Security
- Passwords are hashed with Argon2id and never stored or logged in plain text.
- The website is served over HTTPS only.
- Everything the game client sends to our servers, from the sign-in to the in-game traffic, is encrypted in transit with modern authenticated encryption and per-session keys.
- Staff access is limited by role; every admin action is audited.
- Sign-in attempts are rate-limited.
No system is perfectly secure. If we learn of a breach that is likely to put your rights at risk, we will inform you and the supervisory authority as the GDPR requires.
15. Changes to this policy
We update this policy when our services or the law change. The effective date and version at the top tell you which version you are reading. Significant changes are announced in the news section of the website and, where the change affects how you can use the service, by e-mail to your registered address. Continued use of the service after a change means the new version applies.
16. Contact
For anything about this policy or your data:
- E-mail: support@arkanodia.com
- Discord:
discord.gg/arkanodia(for general questions; data requests by e-mail only)