Privacy notice

Embershire keeps as little as it needs to run the game. This page says exactly what, why, for how long, and how to have it deleted. It was last updated on 12 October 2026.

Who runs this

Embershire is run by an individual, its owner. To ask about your data, write to [email protected].

What we keep

• Your account: the sign-in name and display name you choose, and a salted, one-way hash of your password (we never store the password itself, and nobody can read it back). Please don’t use your real name as a character name.
• Your progress: your character’s skills, items, quests, settings in the game, friends and ignore lists, and when you last logged in.
• A recovery email address, only if you add one on the account page. Because email reset isn’t running yet, adding one currently does nothing; see “Forgotten passwords” below.
• Two-factor details, only if you turn it on: the authenticator secret and your backup codes.
• Moderation records: when staff mute, remove or ban an account, the reason and who did it; reports you send (your report and the recent chat you attached); a log of trades between players; and flags raised by the game’s anti-cheating checks.
• Chat: public chat is not stored. Private messages are held for a few seconds so they can reach the other player, then deleted, unless you attach chat to a report.
• Your IP address: the server uses it in memory to limit repeated logins and new accounts, and writes it to the server log when a new account is created (to investigate abuse). It is not stored in your account.

What we don’t do

• No advertising, no analytics or tracking scripts, and no selling or sharing your data.
• No cookies. The game keeps a few settings in your browser’s storage (such as sound, the checklist panel and a short-lived session so a dropped connection can reconnect). They stay on your device; clearing site data removes them.

Why, and for how long

• We keep your account and progress to let you play, for as long as the account exists. Accounts are not deleted for inactivity today; if that changes we’ll say so here.
• Server log lines (including the IP address logged at sign-up) are kept for up to 30 days.
• A copy of the whole database is saved every night for recovery after a failure, and each copy is deleted after 14 days. A deleted account can therefore remain in those backups for up to 14 days, and is then gone.

Who else handles it

• Cloudflare serves this website, protects it, and (when sign-up checks are turned on) runs the “are you a bot” check. It stores the nightly backups in its R2 storage (North America region).
• Oracle Cloud runs the game server, in London.
• Nobody else gets your data, unless the law requires us to hand it over.

Forgotten passwords

Password reset by email is not running yet. If you lose your password, email [email protected] with your character name and what you can tell us about the account; we will help if we can verify it is yours, and we may not be able to. Set up two-factor sign-in and keep your backup codes somewhere safe.

Your rights

You can ask us what we hold about you, to correct it, or to delete your account and everything attached to it. Write to [email protected] from the recovery email on the account, or tell us your character name and answer a question only you could. We aim to answer within 30 days. If you think we have handled your data badly, you can also complain to your data protection authority (in the UK, the Information Commissioner’s Office).

Age

Embershire is for people aged 13 or over, or the age of digital consent where you live if that is higher. Don’t create an account if you’re younger, and parents who find one can ask us to delete it.

Changes

If this notice changes in a way that matters, the change is listed under What’s new and the date above is updated.