Privacy policy

The short version

• An email address and a hashed password, so you can have an account and get back into it.
• Your characters and what they have done, because that is the game.
• IP addresses in server logs and in a rate limiter, so one person can't lock everyone else out.
• No analytics and no cookies on this website.
• Nothing is sold or shared for advertising. There is no advertising.
• One page deletes all of it, immediately.

Who is responsible

akarra2.com is run by one person. Contact: [email protected], which a human reads.

Your account

• Account name. What you sign in with. Not shown to other players — characters have their own names.
• Email address. Used for password resets, and to stop the same address registering twice. Other players never see it unless you unlock it yourself in game. No newsletter, ever, and it is never passed on for marketing.
• Password. Never stored. What is stored is a one-way hash of it, which nobody can turn back into your password — not us, not anyone.
• Sign-in tokens. Random values that last thirty days, so you are not resending your password constantly. Changing your password deletes all of them.
• Password-reset tokens. Random, good for one hour, deleted the moment they are used.

Your game data

Everything your characters are and have done: names, appearance, level, attributes, skills and gems, inventory, coins, quests, where they are standing, fellowship and guild membership, friend and ignore lists, and any player-killing record. Without it there is no character to log back into.

Chat is delivered live to whoever can hear it. It is not kept in a searchable archive.

Technical data

• Server logs record connections, errors and administrator actions with the source IP address. They are for keeping the server running and looking into abuse. They roll over on their own and are not turned into profiles.
• The rate limiter counts account requests per IP address, in memory, for a minute at a time, so one script can't lock everyone out of signing in. It is never written to disk.
• Hosting logs. This site and the server sit behind Cloudflare, which keeps short-lived request logs under its own policy, as any host does.

Cookies and analytics

This website sets no cookies and runs no analytics. If that ever changes, this page will say so and it will be announced on the news page first.

The game stores a few things in your own browser — key bindings, display settings and your sign-in token. That stays on your device and clearing your browser storage removes it.

Email

Password-reset emails go through a third-party email service, so your address and the reset link pass through it. That is the only email that is ever sent.

Who else sees any of it

The hosting provider, Cloudflare in front of it, and the email service — each handling only what it needs to. Nothing is sold, rented or shared for advertising. A valid legal demand would be complied with only as far as required.

How long it is kept

• Account and characters: until you delete them. Inactive accounts are never purged.
• Sign-in tokens: thirty days, or until you change your password.
• Reset tokens: one hour, or until used.
• Rate-limit entries: a minute, in memory only.
• Server logs: rolled and discarded on the host's schedule.
• Backups: rotated, for disasters only.

Deleting everything

The deletion page. Sign in, confirm, done — no waiting period, no confirmation email, no recovery. It does not reach items you already traded away, chat other people read, or server logs, which age out on their own.

Can't sign in? Reset your password first, or email [email protected] from the address on the account.

Your rights

Wherever you live, you can ask for a copy of your data, ask for it to be corrected, or ask for it to be erased — email the address above. Erasure has a button, which is faster.

Children

Akarra is not aimed at children under 13 and accounts are not knowingly created for them. If you think one has been, email the address above and it will be deleted.

Security, honestly

Passwords are hashed. Traffic is encrypted. Account requests are rate limited. What can't be promised is perfection — this is a fan-run revival of a twenty-year-old game, not a bank. Use a password you don't use anywhere else. If a breach ever affected account data it would be announced on the news page.

Changes

The date at the top moves when this page changes. Anything material is announced on the news page rather than quietly edited in.