Averse Lands

Privacy notice

We keep as little about you as the game needs to run safely. This page lists all of it.

What we store

  • Your username, when you created your account and last logged in, and the IP address you signed up from.
  • Your password, only in scrambled form. We store a one-way scrypt hash. Nobody, including us, can read your password back from it.
  • Sign-in sessions: for each device you are logged in on, its IP address, a short browser description (for example "Firefox on Windows"), and when it was last active. You can see these and sign them out on your account page.
  • A security log of sign-ups, logins, failed logins and password changes, with the IP address. We use it to stop password-guessing and bots. If the site comes under a large password-guessing attack, we also record a security alert with the IP address involved.
  • Your characters and their progress, including each character's PvP record.
  • Guilds: each guild's name, its leader and members, its logo (the picture its leader uploads), and the last 2,000 lines of its guild chat, each with the character name of whoever said it and when.
  • If you apply for the beta with Discord: your Discord user ID and display name, when you applied and from which IP address, whether we approved you and which of our team decided, and which game account you made with it. Discord gives us these when you sign in with it; we never see your Discord password, email or messages, and we do not keep the sign-in's access key. We use it once to add you to the Averse Lands Discord server, and our Discord bot then gives you the Beta Tester role and sends you one message when you are approved.
  • If you join the email list on the beta page: your email address, when you added it and from which IP address. We pass the address to Klaviyo, the service that sends our emails, and it is on our list from then on. Every email has an unsubscribe link.

We do not ask for your real name, date of birth or payment details. An account needs no email address: we only have yours if you join the email list, and it is not tied to your account.

Cookies

We set two cookies, both needed for the site to work. One keeps you logged in, for up to 14 days. The other remembers this browser, so a flood of attacks on the server can't lock you out of your own account. Signing in with Discord for the beta adds two short-lived ones: one for ten minutes that checks the sign-in really started here, and one for thirty minutes that remembers which Discord account signed in, so you can make your beta account. The website's pages (not the game itself) use Google Analytics to count visits and see which pages and links bring people here: it loads a script from Google and sets Google's own cookies to tell one visit from another. There are no advertising cookies, and no other third-party scripts, fonts or embeds.

What anyone can see

The rankings at averselands.com/ranks are public: anyone can read them without logging in. On the PvP board, a character with a PvP record (rank points, a PvP kill or a battleground match) can be listed there with its name, the title it wears (if any), its PvP rank and points, its PvP kills and deaths, its main weapon and its level bracket (a range of ten levels, not its exact level). The PvP rankings never show your username, your account, your exact level or where you are in the game. The level ranking on the same page lists a character's position by level, its name, its portrait (which shows its sex), its two best weapon classes and the title it wears (if any). It never shows the level itself, stats, your username, your account or where you are in the game. A deleted character drops off either ranking within a minute.

A guild's name and logo are public: in the game they show over its members' heads, the name above a member's name and the logo beside it, to anyone nearby, and anyone can fetch the logo's picture. Guild chat is seen only by the guild's members.

Why, and who sees it

We use this data only to run your account and the game, and to keep both secure. We never sell it or share it with advertisers. It is stored on our own server in Germany (Hetzner, EU). An email address you give us for the email list is also held by Klaviyo, a company in the United States, so that it can send our emails, and Google receives the website's visit data through Google Analytics.

How long we keep it

Sign-in sessions are deleted after they expire. Account and character data, including the IP address you signed up from, is kept while your account exists. Guild chat lines are deleted after 14 days, and a guild keeps only its last 2,000; a guild that is disbanded takes its members list, its chat and its logo with it, and a logo our staff remove is deleted. Security log entries and security alerts are deleted after 90 days (an alert we are still investigating is kept until we finish). Backups are kept for up to about three weeks, including our hosting provider's disk backups, so deleted data can remain in a backup for that long. An email address stays on the email list until you unsubscribe or ask us to remove it.

Your rights

You can ask to see the data we hold about you, to have it corrected, or to have your account deleted.