Privacy Policy

Last updated: 12 September 2026 · GDPR / ePrivacy information notice

1. Who is responsible

The data controller is the operator of shadowcity.app (“we”, “us”). Contact: [email protected]. See Contact.

This notice explains how we process personal data when you visit the site, create an account, or play Shadow City. It should be read with the Cookie Policy and Terms of Service.

2. What data we process

Depending on how you use the Service, we may process:

• Account data: email address; password stored only as a one-way hash (we cannot read your password); role (player or staff); account status; plan fields (unused until we sell a plan); dates of creation, last login, and last seen.
• Character data: name, class, side (Light/Dark), gender choice, portrait file, beast path, stats, ranks, location, apartment address, inventory, gold (marks), quest progress, magic book, and similar game state.
• Play logs: street and fight actions needed to run the world; travel; coma/ward; bounty and newspaper state.
• Chat: messages you send into street talk or similar channels, with time and character identity. Other players can see public chat.
• Security data: IP address; login attempts (including failed ones); rate-limit counters; IP bans and reasons (for example too many failures, or reserved trap logins such as admin/root); a honeypot field on registration that bots fill in; a short-lived captcha (“Night sigil”) held in the server session; user-event notes (register, login, admin actions).
• Cookies and similar: described in the Cookie Policy. The session cookie is required to stay logged in and to complete registration (CSRF protection and captcha).
• Device and request data that our host and CDN see automatically: IP address, browser type, date and time, pages requested, approximate country from IP.
• Analytics (only if you click Accept all): Google Analytics 4 receives page path and title (public pages and in-game places such as a named street or shop), approximate country, and device/browser. Not sent: email, character name, chat, inventory, or battle URLs.

We do not ask for your legal name, postal address, phone number, payment card, government ID, or special-category data (health, religion, biometrics). Do not put those in chat. If you type them there, other players may see them and we may store the message as part of chat history.

3. Why we process data (purposes) and legal bases (GDPR art. 6)

• To create and run your account and the game (contract, art. 6(1)(b)): email, password hash, character, inventory, session cookie, captcha, CSRF token.
• To keep the Service secure and usable (legitimate interests, art. 6(1)(f)): IP addresses, failed logins, bans, rate limits, trap-login defence, abuse logs. Our interest is protecting players and the servers from attacks and fraud. You may object; we may still process if we have compelling grounds (ongoing abuse).
• To meet legal duties (art. 6(1)(c)): for example storing what we must if a competent authority lawfully requires it, or keeping what we need to establish, exercise, or defend legal claims.
• Consent (art. 6(1)(a)): Google Analytics if you choose “Accept all” on the cookie banner. You can withdraw by clearing the sc_consent_v2 cookie or writing to us. Withdrawal does not affect processing already done. “Necessary only” does not load Analytics. We do not use advertising cookies.

We do not use your data for automated decisions that produce legal or similarly significant effects about you (GDPR art. 22). Combat results and NPC behaviour are game rules, not credit or employment decisions.

4. Where data comes from

From you (forms, chat, play). From your device (cookies, IP, browser). From other players only insofar as they interact with your character in the game (hunts, chat). We do not buy marketing lists.

5. Who we share data with

We do not sell personal data. We share it only as follows:

• Hosting: Hostup (EU / Sweden) stores the application and the database.
• CDN / security: Cloudflare may process IP addresses and request metadata to deliver the site and filter attacks. Cloudflare may use servers outside the EEA. See their notices and our Cookie Policy.
• Fonts: pages load fonts from Google Fonts (Google Ireland / Google LLC). Your browser requests those files; Google may see your IP address. This is a third-party connection, not a cookie we set.
• Analytics: if you accepted all cookies, Google LLC (Google Analytics 4) receives the visit data described above. Google may process it in the United States.
• Other players: character name, class, side, rank, public chat, and whatever the game shows on the street or in a fight. They do not receive your email or IP.
• Staff: Night Office operators can see account and security logs to run the game and handle abuse.
• Authorities: if the law requires us to disclose, or to protect someone’s vital interests.

6. International transfers

Game data is hosted in the EU. Cloudflare, Google Fonts, and (if you consented) Google Analytics may process technical data in the United States or other countries. Where GDPR requires a transfer tool, those providers use Standard Contractual Clauses or an adequacy decision. You can ask us for more detail at the contact address.

7. How long we keep data

• Account and character data: for as long as the account exists, then deleted or anonymised within a reasonable period after you ask us to delete it (target: 30 days), except as below.
• Chat: kept while needed to run the street log (limited window in the game) and in backups for a short time after.
• Security logs (IP, failed logins, bans, trap events): typically up to 12 months, longer if a ban or dispute is still relevant.
• Session cookie: until you close the browser or log out (session cookie).
• Consent cookie (sc_consent_v2): up to 12 months, then the banner may appear again.
• Google Analytics cookies (_ga, _ga_*): up to 2 years, only if you accepted all cookies.
• Backups: rolled on a host schedule; deleted copies age out.

8. Your rights (EEA / UK)

You may request: access; rectification; erasure; restriction; portability (data you provided, in a common machine-readable form); objection to processing based on legitimate interests; withdrawal of consent. Write to [email protected] from the email on the account. We may need to verify it is you. You also have the right to complain to a supervisory authority (in Sweden: IMY).

Some rights are limited: we may keep what we need for security, bans, or legal claims; we cannot restore a hashed password to plain text; we cannot un-send chat other players already saw.

9. Children

The Service is not directed at children under 16. We do not knowingly create accounts for them. If you believe we have data about a child under 16, contact us and we will delete it.

10. Security

We use HTTPS, hashed passwords, CSRF tokens, a registration captcha and honeypot, rate limits, and IP bans for abuse. No method is perfect. You must keep your password secret.

11. Changes

We will update this page when our processing changes. The date at the top is the current version.