Privacy Policy
Last updated: August 2025
This Privacy Policy explains what personal data Spirebreaker Saga collects, why we collect it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and applicable Belgian law.
1. Who We Are (Data Controller)
The data controller for Spirebreaker Saga is the game development team operating this service. For any privacy-related enquiry, contact us at alloin@airobin.net. We are based in Belgium.
2. What Data We Collect
Account data (provided by you)
- Username — chosen by you at registration.
- Email address — used for password resets and optional communications.
- Password — stored as a salted SHA-256 hash; we never store your plaintext password.
- Steam ID — if you sign in via Steam, we store your Steam 64-bit ID to link your Steam account to your game account.
Technical data (collected automatically)
- IP address — logged at login and in activity/chat logs for security and anti-cheat purposes.
- Session data — a secure, server-side session identifier stored in a cookie to keep you logged in on this website.
Gameplay data
- Character information — name, class, level, stats, inventory, and play time.
- Activity logs — login/logout events, actions taken in-game, linked to your user ID and IP address.
- Chat logs — in-game chat messages, retained for moderation purposes.
- Purchase history — records of any Steam microtransaction orders (order ID, product, amount, status). Payment processing is handled entirely by Valve; we never receive or store payment card details.
3. Why We Collect It (Legal Bases under GDPR)
| Data | Purpose | Legal Basis |
|---|---|---|
| Username, email, password | Account creation and authentication | Contract (Art. 6(1)(b)) |
| Steam ID | Steam login integration | Contract (Art. 6(1)(b)) |
| IP address | Security, anti-cheat, abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Session cookie | Keep you logged in on this site | Legitimate interest (Art. 6(1)(f)) |
| Gameplay & character data | Game functionality and leaderboards | Contract (Art. 6(1)(b)) |
| Chat logs | Moderation, abuse investigation | Legitimate interest (Art. 6(1)(f)) |
| Purchase history | Transaction records, support | Legal obligation / Contract |
4. How Long We Keep Your Data
- Account data — retained for the life of your account. You may request deletion at any time.
- Activity & chat logs — retained for up to 90 days for moderation, then deleted automatically.
- IP addresses — retained in logs for up to 90 days.
- Purchase records — retained for 7 years to meet accounting and legal obligations.
5. Who We Share Data With
We do not sell your personal data. We share data only with:
- Valve Corporation (Steam) — for authentication and microtransaction processing, subject to Valve's Privacy Policy.
- Hosting provider — our server host stores data as part of normal hosting operations, under a data processing agreement.
- Legal authorities — if required by law, court order, or to protect the safety of users or the public.
No data is transferred outside the European Economic Area unless adequate protections are in place.
6. Cookies
We use a minimal number of cookies — only what is strictly necessary to operate the site. See our Cookie Policy for details.
7. Your GDPR Rights
As a resident of the EU/EEA, you have the following rights:
- Right of access — request a copy of the data we hold about you.
- Right to rectification — ask us to correct inaccurate data.
- Right to erasure ("right to be forgotten") — request deletion of your account and associated personal data. Note: purchase records and data required by law cannot be deleted early.
- Right to restriction — ask us to pause processing of your data in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests.
- Right to lodge a complaint — you may file a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be) or the supervisory authority in your EU member state.
To exercise any right, contact us at alloin@airobin.net. We will respond within 30 days.
8. Security
Passwords are never stored in plaintext — we use salted SHA-256 hashing. Sessions are protected with secure, HTTP-only cookies. We use HTTPS for all data in transit. Despite these measures, no system is perfectly secure; we cannot guarantee absolute security.
9. Children
We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without parental consent, contact us immediately and we will delete it.
10. Changes to This Policy
We may update this policy periodically. The "Last updated" date at the top will change. For material changes, we will notify users via in-game notice or email where practicable. Continued use of the Game or Site after changes constitutes acceptance.