The covenant between Mortek and those who dwell within Shadowrealm. This scroll governs how your personal data is gathered, used, and kept, or released from our custody entirely.
What We Collect
In the course of your passage through the realm we collect the following categories of information:
Account data. Your email address, chosen username, and character name. These are provided by you at registration and are necessary to identify your account.
Game data. Your character’s progress, rank, statistics, inventory, gold and banked gold, achievements, titles, arena record, guild membership, in-game mail correspondence, and forum posts. This is the substance of your existence in the realm.
Technical data. Your IP address, browser type, device information, and session authentication tokens. These are collected automatically when you connect and are necessary to deliver the service securely. Specifically, at each login and at registration we record the IP address you connect from, the browser identification string (user agent) your browser sends, and a randomly generated identifier that your browser stores locally so we can tell repeat visits from the same browser profile apart. That identifier is random, contains nothing about you or your device, is stored on our side only as an irreversible hash, and you can erase it at any time by clearing your browser storage for this site. All three are kept separately from your other account data and automatically deleted after 90 days (see Data Retention below).
Payment data. When you purchase gems or other offerings, payment processing is handled entirely by Stripe. We receive only a transaction reference and the package purchased. We never receive, process, or store your card number, CVV, or full billing address.
Support communications. Messages you send through the support contact form, including the content and any attachments, so that the keepers may respond to your petition.
Why We Use It
Under the General Data Protection Regulation we are required to identify a lawful basis for each purpose for which we process your data. The following purposes and their bases govern our use:
Providing the game and your account. We process your account data and game data to fulfil the contract you enter when you register. Without this processing the service cannot exist for you. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Security, fraud prevention, and abuse detection. We analyse technical data and behaviour patterns to detect unauthorised access, scripting, multi-accounting, and other conduct that threatens the integrity of the realm. This includes the login and registration log described above (IP address, browser identification string, and the random browser-profile identifier), which we may cross-reference across accounts to identify exploit abuse, automated play, and multiple (alt) accounts. These signals are used to decide what a human should review; they never automatically restrict or close an account on their own. Legal basis: legitimate interests (Art. 6(1)(f) GDPR), we have assessed that these interests are not overridden by your rights given the limited and proportionate nature of the processing.
Publishing a record of permanent bans. Where an account is permanently banned for cheating, we publish that fact inside the game on a page visible to logged-in players. The record shows only the character name, the date of the ban, and a broad category such as automation or abuse. It does not show your username, your email address, your IP address, or the internal notes recorded against the ban. Temporary bans are never published. We do this to deter cheating and so that the community can see the rules being enforced. Legal basis: legitimate interests (Art. 6(1)(f) GDPR), we have assessed that our interest in a fair and visibly governed realm is not overridden by your rights, given that only a pseudonymous in-game name is shown and only where a permanent sanction has been imposed. If you believe your ban was issued in error you may contact us, and we will remove the entry along with the ban if the sanction is overturned.
Transactional communications. We send account verification emails, password reset messages, and payment receipts. These are not marketing; they are necessary to operate your account. Legal basis: performance of a contract.
Retention of payment records. We retain records of purchases as required by Dutch and European tax law. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
Responding to support requests. We use the content of your support messages solely to investigate and respond to your petition. Legal basis: legitimate interests.
Third Parties
We engage a small number of trusted third parties to operate the realm. Each receives only the data necessary for their specific role:
Stripe, payment processing. Stripe receives your payment details directly and processes them under their own privacy policy and PCI DSS compliance programme. We receive only a transaction reference and status. Stripe’s privacy policy is available at stripe.com/privacy.
Railway, hosting and infrastructure. Our application and database run on Railway’s platform. Railway processes data on our behalf as a data processor. Your data does not leave their infrastructure except as described in this policy.
Scaleway (Transactional Email), email delivery. When we send you an account verification link, a password reset, or a payment receipt, Scaleway transmits that message on our behalf. They act as a data processor and do not use your email address for any other purpose.
Sentry, error and performance monitoring. When the application encounters an unexpected error, Sentry receives diagnostic data about that event, which can include your IP address, the page URL, browser and device information, and details of the error itself. This is used solely to detect and fix bugs. Sentry acts as a data processor; their privacy policy is available at sentry.io/privacy.
Third-party game toplists, vote rewards. If you choose to vote for the realm on an external toplist site (reached via a link from within the game), that site receives your character ID and IP address so it can register your vote and so we can confirm it and grant your reward. Each toplist processes that data under its own privacy policy; we do not control what they do with it beyond the vote itself.
Browser push notification services (for example Google FCM, Mozilla, or Microsoft, depending on your browser), notification delivery. If you opt in to browser notifications, your browser registers a push subscription endpoint with its vendor’s push service, and that vendor receives the endpoint and the encrypted notification payload in order to deliver it to your device. We do not receive anything from them beyond delivery status.
Google (AdSense and Ad Manager), advertising. We show ads through Google, including optional rewarded-video ads you can choose to watch for in-game rewards. Google and its advertising partners use cookies and device identifiers to serve and measure ads; the data they collect is governed by Google’s own privacy policy and its “How Google uses information from sites or apps that use our services” policy at policies.google.com/technologies/partner-sites.
We do not sell your personal data, and we do not share it with data brokers. Aside from the advertising described above, we do not share your data with any party not named here. If we ever engage a new processor we will update this policy before doing so.
Cookies
Shadowrealm sets one essential cookie for authentication. When you log in, a session token is stored in a cookie to keep you identified between page loads. This cookie expires when you log out or after the session window closes.
We also serve ads through Google (see Third Parties above), and Google and its partners use cookies and similar device identifiers to serve, personalise, and measure those ads. If you are in the EU, EEA, UK, or Switzerland, we ask for your consent through a consent management platform before any non-essential advertising cookies are set, and you can change or withdraw that choice at any time. You can also control ad personalisation in your Google Account at adssettings.google.com, and opt out of third-party vendor cookies at aboutads.info. Aside from the authentication cookie and Google’s advertising cookies described here, we use no other tracking or analytics cookies, no fingerprinting, and no social-media tracking pixels.
Separately from cookies, we store one small first-party value in your browser’s local storage (not a cookie, and never sent to any third party): the first referring site or campaign tag that brought you to Shadowrealm, kept so that if you go on to register we know which channel to credit. This is set on your first visit, before any consent choice, because it is not used for advertising or cross-site tracking, it is simply attached to your own registration request if you choose to sign up. It contains no personal identifier beyond a short hostname or tag, and you can clear it at any time by clearing your browser’s site data.
Data Retention
We retain your personal data for as long as your account is active and the realm remains open. The following rules govern how long different categories of data are kept after your account is closed or deleted:
Login and signup technical data. The IP address, browser identification string, and random browser-profile identifier recorded at each login and at registration are kept for 90 days from the date they were logged, then automatically and permanently deleted, regardless of whether your account remains open. This retention window applies independently of the account-deletion rule below.
Account and game data. Upon deletion of your account, your personal data, email address, username, IP logs, and session records, will be removed from our systems within 90 days. Game data tied solely to your identity is removed at the same time. The one exception is an entry on the public record of permanent bans, covered separately below.
Public record of permanent bans. Where a permanent ban has been published as described above, that entry, the character name, the date, and the category, is kept indefinitely and is not removed by the account-deletion rule above. A permanent sanction that could be erased by deleting and re-registering would serve no purpose. If a ban is overturned the entry is removed with it.
Payment records. Transaction records are retained for seven years as required by Dutch tax law (Belastingdienst retention obligations). These records contain only transaction identifiers and amounts, not card details.
Forum posts. Posts you have made in public forum threads may be anonymised, your username replaced with a generic attribution, rather than deleted outright, in order to preserve the coherence of discussions. You may request full deletion of your own posts by contacting us; we will honour such requests where technically feasible and where doing so does not destroy the context of replies made by others.
Support correspondence. Messages sent through the support form are retained for one year after the issue is resolved, then deleted.
Your Rights
Under the GDPR, residents of the European Economic Area hold the following rights with respect to their personal data. We honour these rights for all users regardless of where they are located.
Right of access. You may request a copy of all personal data we hold about you, along with information on how it is used and with whom it is shared.
Right to rectification. If any data we hold is inaccurate or incomplete, you may request that it be corrected.
Right to erasure. You may request that we delete your personal data. This right is not absolute. It does not extend to data we are legally required to retain, nor to an entry on the public record of permanent bans described above, which we keep on compelling legitimate grounds because a sanction that could be erased on request would be no sanction at all. Beyond those exceptions we will erase all we are able to when a valid request is made.
Right to restriction. You may ask us to restrict processing of your data while a dispute is being resolved rather than having it deleted outright.
Right to data portability. You may request your account and game data in a structured, machine-readable format so that you may take it elsewhere.
Right to object. You may object to processing we carry out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling grounds that override your interests.
Right to lodge a complaint. If you believe your rights have been infringed, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the supervisory authority of your country of residence.
To exercise any of these rights, reach us via the support page with the subject line Privacy Request. Include your username and a description of what you are requesting. We will respond within 30 days.
Age Requirement
Shadowrealm: Age of Darkness is intended for persons aged 18 and over. The realm contains themes of combat, death, gambling, and dark fantasy violence that are not appropriate for minors.
We do not knowingly collect personal data from any person under the age of 18. By registering, you declare that you are 18 or older. If we discover or are credibly informed that an account belongs to a person under 18, we will close that account without notice and delete all associated personal data within 30 days. If you believe a minor has registered, please inform us via the support page.
Changes to This Policy
The realm grows and the laws that govern it must grow with it. We may revise this policy when the law requires, when our practices change, or when new risks emerge that demand new protections. The latest version will always be published at this page.
When changes are material, affecting your rights, the data we collect, or the purposes for which we use it, we will announce them in-game before they take effect, so that those who walk the realm are not taken unawares. Continued use of the service after a change takes effect constitutes acceptance of the policy as it then stands. If you do not accept a change, you may close your account before it takes effect and request deletion of your data.