Privacy Policy

What we keep

Your account: your email address (if you sign in with Google, see Google user data below). Passwords are handled by our login provider (Supabase) and stored only in hashed form; we never see them.

Your game: your character (name, faction, level, stats, gold, energy, Fury, health, the title you show), items, hunts and the monsters you have killed, weekly goals, achievements, fights with other players and your rating, guild membership and donations, your purchases in the game, your Spire floor, whose link you joined through and the players who joined through yours (your recruits: their names and levels), your friends and friend requests, the friends you called to a fight or who called you (with the foe and the gold it paid them), your spars with friends (the record between you, and each spar), and the rites you cast or received (who, which, when; who struck someone under your ward) with your class and when you last changed it. Hunts won and rivals beaten also add to your faction's weekly score, which counts no names.

Safety: reports you make or that concern you (with a copy of what was reported), the players you block, and any mute or suspension of your account with its reason.

Your messages: letters you write and receive, messages to your guild, and your battle reports.

Payments: whether you have Premium, until when, and the payment provider's reference numbers; with Patreon, which Patreon account you linked and your membership of our page. Card and bank details go straight to the payment provider (Patreon, Apple or Google); we never see or store them.

Technical: our server records each request (the address requested, the result and how long it took) to keep the game running, but not your IP address. Our login provider and our hosting provider keep connection records that include IP addresses, for security and for a limited time. Your browser stores your login session and a few preferences (such as hints you hid) on your device; these are needed for the game to work, so no consent banner is needed.

Analytics: we count visits with our own analytics (Umami, run on our own server, never shared): which pages are opened, which kinds of game action are taken (such as starting a hunt), the site that sent you, your browser, device type and country. It uses no cookies, stores no IP address and does not identify you.

We do not use advertising or tracking cookies, and we do not sell your data.

Google user data (signing in with Google)

What we access: if you sign in with Google, Google sends us your basic profile: your email address, your name, your profile picture and your Google account id. We ask for nothing more: no access to your contacts, Gmail, Drive, calendar or any other Google data.

How we use it: the only thing we use is your email address, to create your Nightsworn account and sign you in (and, if we must, to write to you about your account). The account id lets our login provider recognise you the next time you sign in. We do not keep your Google name or picture: they are deleted the moment Google sends them, so all we keep from Google is your email address and your account id. Other players never see any of it: they see only your character name.

How we share it: we do not sell, rent or give your Google data to anyone. It is stored only by our login provider, Supabase, which processes it on our behalf and for no other purpose.

How we protect it: it travels only over encrypted connections (HTTPS), it is stored in Supabase's database, which is encrypted at rest, and only the people who run Nightsworn can reach that database (and our providers, only to keep their services running).

How long we keep it: until you delete your account (Profile → Delete account), which deletes it at once. You can also remove Nightsworn's access to your Google account at any time at myaccount.google.com/permissions, and you can ask us to delete your data by writing to contact@nightsworn.com.

What we never do with it: we do not use Google user data for advertising (targeted or otherwise), sell it to data brokers or anyone else, use it to train artificial intelligence or machine learning models, use it to decide creditworthiness or for lending, or let any person read it except to keep your account working, for security, or where the law requires it.

Nightsworn's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

Everything between your browser and Nightsworn, and between our server and our database, is encrypted (HTTPS/TLS). The database is encrypted at rest by our provider (Supabase). Passwords are stored only as hashes by our login provider, and we never see them. Only the people who run Nightsworn have access to the database and the server.

Why

To run the game you signed up for (performing our contract with you): your account, your character, messages and purchases.

To keep the game safe and fair (our legitimate interest, and our duties under the EU Digital Services Act): request records, reports, blocks, and looking into abuse or cheating.

To understand how the game is found and played, and make it better (our legitimate interest): the anonymous analytics above.

To meet legal duties, such as keeping payment records for tax.

Who else sees it

Other players see your character name, level, faction and guild, and whatever you write to them. A letter you send stays with its recipient, even if you delete your account (it then shows as from a deleted player).

Service providers process data for us: Supabase (database and login, in Frankfurt, Germany), our hosting provider (Netcup, in Nuremberg, Germany), Patreon (Premium memberships), Apple and Google (in-app purchases, and Google sign-in if you use it). Some of them may process data outside the EU; where they do, they use the European Commission's standard contractual clauses.

How long

Your account and game data: until you delete your account.

Letters: 7 days (30 with Premium). Guild messages: 7 days. Battle reports: your latest 10, plus any you keep with Premium.

Fights with other players: 7 days. Reports: until decided, then 180 days (so decisions can be reviewed). Blocks: until you remove them. Friendships: until either of you ends them; a declined friend request 7 days, a cancelled one a day. A call to a fight: until it is answered (24 hours at most) or fought (7 days at most once accepted), then 2 days once fought and a day once declined or cancelled. Spars: each one 30 days; the record between two friends until either character is deleted. Rites: 7 days after they end. A mute or suspension: until it ends, then 180 days.

Request records: a few weeks. Payment records: as long as tax law requires (kept by the payment providers).

Your rights

You can get a copy of your data (Profile → Download my data, including reports you made or that concern you, and your blocks), correct it (change your email, or rename your character), and delete your account and data (Profile → Delete account). Reports about you keep a copy of what was reported, without you, until they expire.

You can also object to or ask us to restrict processing, and complain to your data protection authority.

For anything else, write to contact@nightsworn.com.

Children and changes

Nightsworn is not meant for anyone under 16.

If we change this policy we will update this page and, for important changes, tell players in the game.

Contact: Adrian Radu, Romania, contact@nightsworn.com.