Privacy Notice
This notice says what (“we”) stores about you when you use this service, why, for how long, and what you can ask us to do. We are the “controller” of the personal information described here (the one who decides why and how it is used); our contact details are in section 14. We designed the service to hold as little personal information as possible. The service is for people aged or older.
1. What we store
Game account data
- your account number and persona name(s);
- the game’s password, in the encoded form the original client uses (it is short and weak by design, so do not reuse a real password);
- what you create in the game: mail, bulletin posts, character saves and the in-game bankroll.
Sign-in
When you sign in with a provider we ask for the openid scope only. We store:
- a keyed one-way hash of the provider and your account identifier at that provider (we cannot turn it back into your identifier in everyday operation);
- the date you confirmed your age and the version of the terms you accepted;
- if you link more than one provider (below), one such hash for each, a number that ties them together, and the date each one was linked.
We do not request or store your email address, your name or your profile. If a provider sends profile data anyway, it is thrown away without being stored. One honest caveat: some plain-OAuth providers return a username in the same response; we do not keep it.
A hash with a secret key is still pseudonymous data, not anonymous: whoever holds the key and your provider identifier could recompute it. It is not stored in a form that names you.
For security and legal reasons, the raw sign-in identifier is also kept, but only in a sealed (encrypted) form that the server itself cannot read; see section 3.
Linking sign-in methods
You can link several providers (for example Microsoft and GitHub) so that each one reaches the same game accounts: Game, Sign-in methods. You link them yourself, by signing in with one and then with the other, one right after the other. We never match providers by email address: no email address is requested, read, stored or hashed. The page lists your methods by the provider’s name and the date each was linked, and never shows who you are at the provider. You can remove a method at any time as long as another one is left; a removed method no longer reaches your accounts, and its stored hash is erased on the schedule in section 7.
A session token
A short-lived random token tells the server that your browser is signed in. It expires.
2. What we do not do
No cookies. No advertising. No cross-site tracking. We do not sell your personal information, and we do not share it except as described under “Who handles data for us” and “Disclosure” below. We do collect a small amount of anonymous diagnostics (section 4), which you can turn off.
3. Network information and the sealed record
Your IP address is necessarily used to deliver the connection to you. The server does not write IP addresses or message contents to readable logs in its public mode.
For security, abuse prevention and legal obligations, the server keeps one sealed connection record per connection: the start and end time, your account number, your hashed sign-in identity and your IP address. The record is encrypted with the operator’s public key. The matching private key is held in a separate, locked-down key vault that the server has no access to, so the server cannot read the records, and every decryption is logged. They are kept for days by default and then deleted automatically. The operator can decrypt a record only offline, and only in response to valid legal process, or to investigate serious abuse. The raw sign-in identifier is likewise kept only in sealed form.
The hosting provider (the company whose computers the service runs on) may keep its own network logs under its own policy, which we do not control.
4. Anonymous diagnostics
If the operator has switched it on, the page sends a few anonymous diagnostics to the operator’s Microsoft Azure Application Insights, so that we can find errors and keep the service working. It is our own small piece of code, not a third-party tracking script.
What is sent
- A page view: the page path only (for example “/” or “/legal/privacy.html”), never a query string or the part after a “#”.
- Load timings: how long the page took to load, and how long the game runtime took to download and start.
- Errors: uncaught errors and failed promises in the page: the message and a stack trace cut to about 2 KB. Web addresses in them are reduced to file names, and any server address, account number or path on your install is removed before sending.
- A few events: that the runtime started; whether an online session connected, failed to connect, or ended (with a rough duration such as “5-15s”, never the server address); which display filter you chose; and whether your browser has WebGL 2 and JSPI.
- Your browser and operating system, which Application Insights works out from the usual User-Agent header your browser sends with every request. We add nothing to identify your device.
What is never sent
No account number, persona name, chat, mail or post, no file names from your installation, no server address, no sign-in details, no cookie and no persistent ID. Each page load makes up a random session number that is kept in memory only and is gone when you close or reload the page, so two visits cannot be linked to each other.
Why, and our legal basis
To find and fix errors and to keep the service working. Our legal basis is legitimate interests (Article 6(1)(f) of the GDPR and UK GDPR): the data is small, anonymous in practice and not used for anything else, and you can opt out at any time (below).
Who processes it, and IP addresses
Microsoft Azure Application Insights stores and processes it as our processor, in the Azure region the operator chose (section 13). Your IP address reaches Application Insights because it is part of any connection, but it is not stored: Application Insights uses it to work out a coarse location (country, region and city) and then masks it. We do not combine this data with account data.
How long
The diagnostics are kept for days in the operator’s Azure Log Analytics workspace, and then deleted automatically.
Turning it off
Switch off “Send anonymous diagnostics” in Settings (or the Options menu on the landing scene). The page then sends nothing, and remembers your choice on this device. It also sends nothing, and the switch is off and cannot be turned on, when your browser sends Global Privacy Control or Do Not Track. Diagnostics already sent cannot be tied back to you, because we hold nothing that identifies you in them.
5. Cookies and storage on your device
We set no cookies. The page uses your browser’s own storage for the items below. Each is either strictly necessary to give you what you asked for, or a preference you set yourself. That is why there is no cookie banner: storage of this kind is exempt from consent under Article 5(3) of the ePrivacy Directive. No analytics cookies or advertising identifiers are stored. None of this is sent to anyone but you, except that the sign-in token goes to the server to show that you are signed in. You can clear it all with your browser’s site-data controls, or Forget in Settings for the installation.
| Key | Where | What it holds | Why |
|---|---|---|---|
inn.consent | localStorage | your answer to the age notice: the age, terms version and date | necessary: so you are not asked every visit |
inn.refused | sessionStorage | that you answered “no” to the age notice, until the tab closes | necessary |
inn.session | sessionStorage; localStorage if “Remember on this device” is on | the short-lived sign-in token | necessary: to keep you signed in |
inn.line, inn.signing, inn.linkwhy, inn.redial | sessionStorage | which line you chose, and markers that a sign-in, a link of a sign-in method or a redial is under way | necessary: to finish a sign-in that leaves the page and returns |
inn.nonce | sessionStorage | a random value made for the sign-in under way, deleted when it returns | necessary: so a sign-in someone else started cannot sign you in as them |
inn.saves.<account number> | localStorage | which save files this browser last synced, with their version and a checksum | necessary: for save sync to avoid overwriting newer saves |
inn.remember, inn.com1 | localStorage | your choice to remember the installation, and the server address you used | preference you set |
inn.scale, inn.scanlines, inn.theme, inn.anim, inn.music | localStorage | display filter, scanlines, day or dusk, animation and music on or off | preference you set |
inn.diag | localStorage | your choice on anonymous diagnostics | preference you set |
inn.score | sessionStorage | the points you have collected on the landing scene | preference-like: part of the page’s game, until the tab closes |
database /c | IndexedDB | the installation files you gave the page, only while “Remember on this device” is on | necessary to run the client; stays on your device, never uploaded |
The page does not use the Cache API or service workers. The sign-in providers (section 8) may set their own cookies on their own sites while you sign in; we do not control those. The installation files you give the page stay in your browser’s storage and are not uploaded. If you use save sync, only the listed game save files are uploaded.
6. Why we use it, and our legal basis
- To run the service you asked for (performing the service): accounts, sign-in, mail, posts, saves.
- Legitimate interests in keeping the service secure and working, and preventing abuse: the sealed connection record, the age and terms record, and the anonymous diagnostics (section 4). You can object to these; for the diagnostics, the switch in Settings does it at once.
- Legal obligations, where the law requires us to keep or hand over information (see Disclosure).
We do not rely on consent for any of this, so there is nothing to withdraw. We make no decisions about you by automated means.
7. How long we keep it
When you delete something, it disappears for other players at once, but we keep it for a short grace period before it is erased for good. That lets us act on abuse reports and undo mistakes.
| What | How long |
|---|---|
| Account data (your active account, mail, posts, saves) | Until you ask us to delete it, or the service ends |
| Mail and letters you delete | Erased after 90 days |
| Bulletin posts you delete | Erased after 90 days |
| An account you ask us to delete | Disabled immediately; erased after 30 days. Within those 30 days it can be restored if the request was a mistake or was not yours |
| Complaints and abuse reports | Kept 365 days |
| Sealed connection records and the sealed sign-in identifier | days by default, then purged automatically |
| Expired sign-in sessions | Erased after 30 days |
| A sign-in method you remove, or a sign-in that never opened an account | Erased once no sign-in session of it is left: about 30 days after its last session ended |
| Anonymous diagnostics (section 4) | days, then deleted automatically |
| Readable server logs in public mode | They contain no personal data |
Legal hold. Anything under a legal hold (a preservation request, or an active investigation) is kept until the hold ends. After that the normal clock applies.
Backups. Backups rotate within 30 days, so erased data leaves our backups within about 30 days after it is erased.
Why these numbers. A grace period lets us act on abuse reports. US preservation requests run 90 days. Erasure requests are handled within about a month. Reports are kept for one year. The operator may change these periods; if so, the notice here is updated.
8. Who handles data for us, and disclosure
We use these processors, who handle personal information only on our instructions:
- Microsoft Azure hosts the service, its database and its backups (section 13).
- Microsoft Azure Application Insights receives the anonymous diagnostics (section 4).
- The sign-in provider you choose (for example Microsoft) confirms who you are to us. It is a separate controller for its own accounts; its own notice applies to what it does. We receive only the identifier described in section 1.
We disclose information only when the law requires it: a valid subpoena, court order or warrant; or to report apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC), as US law requires. When that happens, only the named account’s records are opened. We do not sell or share data otherwise.
9. Your choices and rights
You can ask us to give you a copy of your data (access and export), to correct it, or to delete it. Email . We reply within 30 days. We may need to check that you control the account, for example by having you sign in again. Deleting your account disables it at once and erases it after the grace period in section 7; the sealed records are not individually deletable and are purged on their normal schedule (or held longer only under a valid legal hold). An access request also covers items still inside a deletion window.
If you are in the EU or UK (GDPR and UK GDPR), you also have the right to restrict processing, to data portability, and to object to processing based on legitimate interests (see section 6). You have the right to complain to a supervisory authority: the data protection authority where you live, work or believe the problem happened (in the UK, the Information Commissioner’s Office; the EU authorities are listed at edpb.europa.eu). We would be glad to hear from you first, but you do not have to.
If you live in California or another US state with a privacy law, you may have rights to know, delete and correct, and not to be discriminated against for using them. We do not sell or share your personal information (as those laws define “sell” and “share”, including for cross-context behavioural advertising), and we do not use it for advertising. We honour Global Privacy Control. We will honour the rights the law gives you where they apply; this paragraph is a summary, not a promise of more.
10. Children
The service is for people who are or older. We do not knowingly collect information from anyone younger. If we learn that an account belongs to someone under 13, or under , we delete it.
11. Security
We take reasonable measures to protect what we hold: the sealed records, hashed identity, short-lived tokens and as little data as possible. No system is perfectly secure, and we cannot guarantee it.
12. Changes
If we change this notice in a way that matters, the version number goes up and the page asks you to confirm again. The effective date and version are at the top.
13. Where the data is kept, and transfers
Data is stored in: . The Azure regions we use are in the United States. If you connect from the EU or UK, your information is therefore transferred to the United States. Microsoft takes part in the EU-US Data Privacy Framework (and its UK extension), and its contracts with us include the European Commission’s Standard Contractual Clauses (with the UK addendum), which are the safeguards for that transfer. You can ask us for a copy of the clauses.