Privacy notice
Who to contact
Arcana76 is an independent, non-commercial fan project. The operator is responsible for the account data described here. Contact: GM Arcana on the Arcana76 Discord server: https://discord.gg/AraAwgfhu. For anything about your personal data, send GM Arcana a direct message; do not post it in a public channel.
What we use and why
We use your account number, password hash, email address and character data to provide your game account, let you sign in, create characters and handle account-support requests. We use a necessary session cookie for sign-in and forms, and IP-based security checks to limit abuse. The game uses a legacy password-hash format; choose a strong password that you do not use anywhere else.
Server access logs can contain your IP address, request path, time, response status and User-Agent (the browser or client information sent with your request). Security records help investigate failures and abuse. Passwords and password-reset query strings must not be written to those logs. Email recovery is not enabled at opening; contact the operator on Discord if you need help.
Legal basis
We process the account and character data needed to provide the game service you request under our agreement with you (GDPR Article 6(1)(b)). We process security records, access logs and abuse-prevention data for our legitimate interests in keeping the service secure and protecting players from abuse (GDPR Article 6(1)(f)).
How long data is kept
Accounts, character data and their backup copies: kept for as long as the server runs, or until you ask us to delete them. Backup copies are kept for a limited time; we aim to delete them within 90 days. The data is stored on a server rented from a hosting provider (Contabo GmbH), in a data centre in the EU.
Access and security logs: website access logs are kept for 14 days and game server logs for up to 90 days.
Your requests
Send GM Arcana a direct message on Discord to ask for deletion or a copy of your data. To prove the account is yours, we ask you to log in and say a short code with one of its characters in the game. We normally handle a request within 30 days. Copies in backups are deleted as the backups expire.
You may request access to or correction of your personal data, deletion or restricted processing, and data portability where applicable. You may object to processing based on legitimate interests.
You also have the right to complain to a data protection supervisory authority if you believe your personal data has been handled unlawfully. You can contact the authority where you live or work, or where the alleged breach took place (GDPR Article 77).
Discord is a separate service. Its own privacy terms apply when you use it.