Privacy policy

Who controls your information

Rogue MUD is the controller of personal information used to operate the game and website. Privacy requests can be sent to lestat.rogue-rpg@outlook.com.

Information we collect

• Account data: character and account names, email address, a one-way password hash, verification state and account history.
• Game data: characters, progress, inventory, messages sent through public or moderated game channels, sanctions and other activity needed to operate the world.
• Technical data: IP address, browser or client details, request logs, session identifiers and security events.
• Held sessions: on an iPhone or iPad, our server holds your connection to the game while your device is in the background. It keeps your character in the game for up to two hours, with what the game sent in that time and your IP address, in memory only, and forgets them when the session ends.
• Reports: a report you send about another player, with your character's name and where you were, for the staff to act on. The player reported is not told who sent it.
• iPhone notifications: if you use our iPhone app, a device token from Apple and the name of your character, held only while that session is held, so we can tell you about a tell or an attack.
• Optional data: a private character portrait you upload. It is stored outside the public web root and returned only to your authenticated account.

Why we use it

We process account and game data to provide the service and fulfil our contract with you. We use technical logs, moderation records and limited analytics where necessary for our legitimate interests in security, abuse prevention, troubleshooting and improving Rogue. We use consent where the law requires it, and comply with legal obligations concerning fraud and records.

Cookies and local storage

The website uses an essential creweb session cookie to keep you signed in. It is HttpOnly, SameSite=Strict, expires after seven days and is marked Secure over HTTPS. The browser game client stores settings, layouts, profiles and local play data in your browser. Rogue does not use advertising cookies.

Who receives it

We share only what is needed with service providers that host or protect the service and deliver email. These currently include Akamai (Linode) for hosting, Resend for email and Apple for iPhone notifications. Providers may process information outside the UK; where required, recognised safeguards are used. We do not sell personal information.

Retention and security

Account and game records are kept while an account is active and for as long as reasonably needed to operate the persistent world, resolve disputes, prevent abuse and meet legal duties. Short-lived sessions and verification codes expire automatically. Logs and backups are retained on limited operational cycles. We use access controls, hashed passwords, TLS at the public edge and restricted administrative tools, but no online service can promise absolute security.

Deleting your account

You can delete your account yourself on your account page, or in Settings, Safety on an iPhone. Every character on it leaves the game at once and the account is closed. A copy of your characters is kept for 30 days so that a mistake can be undone, and is then erased. Backups of the game age out within a fortnight of that. Records we must keep for legal or abuse reasons, such as a report about your conduct, stay for as long as that need lasts.

Your rights

Depending on where you live, you may ask to access, correct, erase, restrict or export your information, or object to certain uses. You may withdraw consent without affecting earlier lawful processing. Email us from your account address so we can verify the request. UK users may also complain to the Information Commissioner's Office.

Children and changes

Rogue is not directed at children under 13. Anyone under the age required to consent to data processing where they live should use Rogue only with a parent or guardian's permission. We may update this policy as the service changes; material updates will be dated and announced through the site or game.