1. Controller and contact
The controller responsible for processing personal data in Aurevorn Idle is Nico Winkler, Emanuelstr. 226, 47178 Duisburg, Germany. You can send privacy enquiries and requests for access, correction or erasure to info@aurevorn.net.
2. Account and game service
Our Keycloak account service handles sign-in, registration, email verification, password resets and second factors. It processes your email address, protected password verifiers, security factors and sign-in events. Verification and recovery links are sent by email. A new game account is created only after email verification and your acceptance of the terms. Email verification establishes access to the mailbox, not age or identity.
When the Google sign-in button is available, you may choose this optional sign-in method. You are redirected to Google, which learns that you are signing in to Aurevorn. Our account service receives your Google account identifier, email address and its verification status. We do not request access to Gmail, contacts or Drive, and do not store Google access tokens. Google's processing is described in its privacy policy at https://policies.google.com/privacy.
A sign-in transaction started in the game expires after ten minutes; expired transactions are cleaned up at startup and every minute. An account already created in Keycloak is not automatically deleted when such a transaction expires. The game account records email verification and the link to the sign-in account. Backups follow their separate retention rules.
The game processes your email address, internal account and sign-in identifiers, and registration and activity timestamps, plus your character name, progress, settings and the gameplay and social features you use. Keycloak verifies passwords; the game database holds no password verifiers. Session renewal tokens are encrypted on the game server and are not exposed to the game in your browser.
We need this data to create your account, sign you in, save your progress and carry out your game actions. The legal basis is performance of the service contract or steps you request before entering into that contract (Article 6(1)(b) GDPR). An account cannot be provided without the necessary account information.
On registration, you declare that you are at least 16 and accept the terms of service including the code of conduct. We record the declaration, language, complete contract text, its checksum, and the declaration and account creation times. We do not ask for a date of birth or a parent’s email address. The declaration is not verified evidence of age. For existing accounts, acceptance is recorded only after explicit confirmation in Settings; earlier declarations are not assumed. These records support performance of the contract and resolution of disputes (Article 6(1)(b) and (f) GDPR).
3. Technical operation and abuse prevention
Accessing the service involves processing your IP address. Operation and troubleshooting may also record timestamps, the requested resource and technical error information. Login sessions use random session identifiers, stored as hashes on the server. Security measures and rate limits help prevent unauthorised access and overload.
For abuse prevention, an IP address is converted into a pseudonymous network identifier and temporarily associated with accounts. The administrator can compare shared identifiers, in-game transfers and review notes. This data is not anonymous. A shared network identifier alone does not automatically result in an account ban.
The basis is our legitimate interest in operating a secure and fair game (Article 6(1)(f) GDPR). Processing directly necessary for your requested session also serves performance of the contract.
4. Visibility, communication and moderation
Your character name and game information are visible to other players where a feature requires it, for example in profiles, leaderboards, guilds and the player market. In profiles, friend lists and guild lists, your online and last-seen status is limited to friends by default; Settings lets you show it to everyone or hide it. During shared party activities, the connection status needed by the party remains visible. These features do not disclose your account email address or password hash to other players.
Public chat messages are visible to participants of the relevant channel. Whispers, party and guild chat, and game mail have a limited audience. Direct messages and player mail are limited to friends by default. Contact and presence choices and account blocks are stored with your account until you change or remove them, or the account is deleted. Blocks apply between accounts and are not displayed as a public list. Reports and moderation actions may include relevant messages, mail text, guild text, character and companion names, accounts involved, reasons and context as evidence. This evidence is for the authorised administrator. Displaying a message privately does not promise end-to-end encryption.
We process this content to provide the communication features you use (Article 6(1)(b) GDPR), and to handle reports and protect other players and the service (Article 6(1)(f) GDPR). Article 6(1)(c) GDPR may additionally apply where there is a specific legal obligation.
5. Support and enquiries
For email enquiries, we process your sender address, message and any attachments you choose to send. In-game support also records your account association, ticket category, title, messages, status and timestamps. The game version, previous view, browser information and window size are included for troubleshooting. Screenshots are optional.
Your tickets are visible only to you and the authorised administrator. Internal handling notes are not public. Please do not send passwords, payment secrets or unnecessary information about other people. We need enquiry data to handle your request; depending on the request, the basis is Article 6(1)(b) or (f) GDPR.
6. Internal game statistics
With your voluntary consent, the server records selected game actions and game connections, combat and dungeon results, offline yields, character and profession progression, and immediate gold changes from game actions. Records contain your account identifier, time, event type, class, level, game release and relevant game values such as duration, outcome, rewards or stop reasons. We use these records to examine balance, progression, obstacles and new players’ return visits to improve the game. Summaries may also include offline progress that previously occurred in the game or combat already in progress. The administration can associate individual events with your account and character name. These statistics are not anonymous; no external analytics service or advertising network is involved. Hosting and backups use the recipients and safeguards described below.
The legal basis for this optional analysis is your consent under Article 6(1)(a) GDPR. Consent is not required to create an account or play and is not bundled with the terms of service or browser storage choice. Analysis remains disabled without consent. After reading the notice, you can select ‘Consent and enable analysis’ in Settings or the privacy dialog. We record the time and version of your consent. Your choice applies account-wide on all devices. A previous consent to the narrower scope or automatic activation is not consent to this expanded analysis; it requires fresh, explicit consent.
If your account has no applicable choice yet, we ask you once in the game for consent. Selecting ‘Do not consent’ or closing the dialog records a refusal on your account and leaves analysis disabled. After consent or refusal, the prompt does not appear again on other devices either. A previous explicit refusal is preserved. You can still change your choice in Settings.
You can withdraw consent at any time without giving a reason by selecting ‘Disable and delete data’ in Settings or the privacy dialog. This stops further collection and deletes your account’s analysis events from the active database. Refusal and withdrawal have no disadvantages for your account, login, progress or game features. Withdrawal does not affect the lawfulness of processing before withdrawal. Backups follow the rules below. You can also send privacy enquiries to info@aurevorn.net.
Individual analysis events are removed after 90 days at the next successful cleanup, which runs at server startup and daily. Earlier event versions are not included in the expanded analysis and are deleted from the active database at the next successful cleanup. Later consent does not retroactively legitimise earlier collection. The consent time and version remain on the account while consent is active; withdrawal removes them and records the time of the change, and account erasure also deletes this preference.
7. Hosting, email and backups
The website, game server and email mailbox are hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The game server is located in Austria. netcup supplies the hosting and email infrastructure and processes the data necessary to provide those services.
Encrypted database backups are stored with Backblaze, Inc., 2261 Market Street STE 81006, San Francisco, CA 94114, USA, in the selected EU Central region (Amsterdam, Netherlands). Additional backups are held on the game server and the operator’s computer. Cloud backups are encrypted before upload; the private decryption key is held by the operator.
Backblaze is a US company. EU storage does not fully exclude a third-country connection, for example in corporate and support operations. Backblaze is actively certified under the EU–US Data Privacy Framework for non-HR data (register checked on 29 September 2026). Where personal data within the scope of that certification is transferred to the US, the European Commission’s adequacy decision provides the basis under Article 45 GDPR. The official register and Backblaze’s privacy information explain the certification’s scope and data subject rights; you can request copies or further information about applicable safeguards from the operator.
On the operator’s side, only Nico Winkler has administrative access to player data, support and backups. Data may also be disclosed where a specific legal obligation requires it or where necessary to establish or defend specific legal claims. Data is not shared for advertising.
8. Retention and erasure
Your account and progress are retained for the duration of your service contract. You can request closure and erasure at info@aurevorn.net. Once your entitlement to the request is checked, account data no longer needed is erased or personal links are removed where shared game histories need to remain for other players. Clearing browser data or signing out does not erase your server-side progress.
The periods below apply to data subject to regular cleanup. Cleanup takes place on the next successful run after the period expires; server downtime can delay the run. Records needed for a specific legal dispute or statutory retention obligation are kept separately and limited to what is necessary until that purpose or the applicable period ends.
Contract records and consent status are retained while the account exists. After closure, a record is retained only where needed for an identifiable legal dispute or a specific statutory obligation. The mere possibility of a future dispute does not result in indefinite retention of the entire account.
Backups on the game server are subject to daily cleanup with a 14-day age threshold. Because ages are rounded down to whole days and cleanup runs daily, backups may remain for up to approximately 16 days when runs take place as scheduled. Backups on the operator’s computer whose local modification date is more than 60 days ago are removed on the next successful backup retrieval. Offline periods and operational disruptions may delay cleanup. An automatic rule is configured for all cloud backups at Backblaze: files are hidden one day after upload and permanently deleted 60 days after being hidden. Each step is processed on the next daily run after its period expires; operational disruptions may cause delays. For existing backups that are still visible when the rule is introduced, the 60-day period starts only when they are hidden. Their total age can therefore exceed the sum of these periods. Encrypted backups are not used for normal gameplay or analytics. Remaining backups are included when handling an erasure request; after a restore, previously completed erasures and withdrawals must be reapplied before normal operation resumes.
| Data | Period and cleanup |
|---|---|
| Pending registration | 24 hours; at startup and hourly. Successful requests are removed when the account is created. |
| Login sessions | Valid for up to 30 days; expired sessions are removed at startup and daily. |
| Guest access without an account | 14 days after last use, the guest access, its progress and associated data are removed by an hourly cleanup. If the progress is saved to an account before then, the rules for accounts apply. |
| Stored public chats, whispers and game mail | 30 days; hourly cleanup. Party and guild chat is transmitted live. Limited reporting context remains in memory and can be used for reports for up to 24 hours; older entries are displaced by further messages or removed on restart. An actually reported incident may need to be kept longer as moderation evidence. |
| Network identifiers, security transfers, review notes | 30 days; at startup and daily. Registration quotas: two days. |
| Optional game statistics | 90 days, then at the next successful cleanup (server startup and daily); removed from the active database upon withdrawal. |
| Closed support tickets | 90 days after the last update visible to you on a ticket that remains resolved, including messages and attachments; at startup and daily. |
| Resolved reports and ended moderation actions | 180 days after resolution or the effective end of the action; at startup and daily. Active permanent bans remain documented for enforcement. |
| Contact emails | Normally 90 days after final resolution; manual cleanup. |
| Aurevorn web server and application logs | Approximately 14 days during normal operation through daily rotation: at most 13 archives in addition to the current file. Older content carried over when rotation was configured on 29 September 2026 may remain during the first 13 further successful daily rotations. Operational disruptions may delay cleanup. Necessary evidence of specific incidents is handled separately from general logs. |
9. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing relies on consent, you can withdraw it for the future. Applicable legal conditions and exceptions are considered when handling requests.
Contact info@aurevorn.net to exercise these rights. A proportionate check that you are entitled to make the request may be necessary to protect other people’s accounts. Do not send identity documents unless specifically requested. Requests generally require a response within one month; any legally permitted extension must be explained to you.
You may also complain to a data protection supervisory authority, in particular where you live, work or where you believe an infringement occurred. For the operator based in North Rhine-Westphalia, the relevant authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.
10. Your right to object
Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. This also applies to profiling based on those interests. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. Send your objection to info@aurevorn.net. For optional game statistics, the right to withdraw consent at any time without giving a reason, described above, applies instead.
11. Browser storage and external links
Details about session cookies and local settings are available under “Cookies & storage”. Fonts and game artwork are served locally. Discord is provided as an external link; opening it takes you to that service. Processing there is also subject to that provider’s information. No payment-provider integration is configured in the current game.
12. Decisions and updates
There are no solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR. Game calculations and technical rate limits are part of the service’s operation; moderation complaints are reviewed by the operator. Updated information is published with a new revision date. New consent is obtained where required for changed optional processing.