Privacy Policy

Placeholder text -- not a substitute for real legal review. A checkbox alone isn't what makes handling personal data compliant (GDPR or otherwise); this page should say honestly what's actually collected and why before the game is opened beyond trusted friends. Update the table below to match reality first. (See DevNotes/PRE_RELEASE.md.)

Last updated: [date]

What we collect

Data	Why	Kept for
Username & password (hashed)	To let you log in	Until you delete your account
Email address	Account recovery ("forgot password")	Until you delete your account
IP address	Rate-limiting logins/registration to stop abuse	[fill in -- currently in-memory only, cleared on server restart]
Chat messages	Moderation (so a report or ban has evidence)	[fill in]
Gameplay data (characters, items, gold)	The game itself	Until you delete your account

Who sees it

Nobody outside this project. [Fill in if that changes -- e.g. a hosting provider, an email-sending service once one is set up.]

Your rights

You can ask to have your account and its data deleted. [Fill in the actual process -- right now this would mean contacting the game's host directly.]

Cookies / local storage

The game stores your login session and a couple of display preferences (like your chosen theme) in your browser's local storage. Nothing is used for tracking or advertising.