PRIVACY POLICY
Last updated: September 2026
1. Who we are
Driftkeep is operated by BSquared Software Development Ltd, a company registered in England and Wales (company number [TO CONFIRM: company number]), registered office: [TO CONFIRM: registered office address]. We are the data controller for the personal data described in this policy ("we", "us", "our"). ICO registration: [TO CONFIRM: ICO registration number].
For anything about your personal data, email privacy@driftkeep.com. You don't need a Discord account to reach us.
2. Information we collect
Your account
- Username (shown to other players)
- Email address (for verification, sign-in help and password resets)
- Password — stored only as an argon2 hash, never in readable form
- Confirmation that you are 13 or over. We ask for your date of birth at sign-up to check this, but we don't store it — only the yes/no result.
- Guest accounts: a sign-in code instead of a password. We store only a one-way hash of the code, and it stops working once you claim a full account.
Your game data
- Characters: class, level, appearance, inventory, equipment, bank, quests and skills
- Progress: XP, gold, community goal contributions, leaderboard positions
- Session data: when you log in and out, zones visited
What you post
- In-game chat messages and whispers
- Forum threads, replies, edits, votes, your forum profile and avatar
- Images you upload to the forum. We re-encode them before publishing, which removes embedded metadata such as the GPS location a phone camera adds.
- Reports you make about other players
Security and anti-abuse data
- IP address
- Browser or device user agent
- A device fingerprint: the game client combines your device's processor, graphics card, operating system, device model, screen size and language into a one-way hash. We use it only to enforce bans and detect ban evasion.
- A login history of the above, with timestamps
If you choose to use them
- Discord: if you link your Discord account, we store your Discord user ID so the Driftkeep bot can show your profile and progress
- Push notifications: if you allow them in the forum or staff dashboard, we store your browser's push address and encryption keys
We don't take payments, run advertising, or use analytics or tracking tools.
3. Why we use it, and our lawful basis
UK data protection law requires a lawful basis for each use of your data. Ours are:
- Performing our contract with you (UK GDPR Article 6(1)(b)) — creating and running your account, saving your progress, offline gains, community goals, chat and forum features, and account emails such as verification and password resets.
- Our legitimate interests (Article 6(1)(f)) — keeping the game and its players safe: moderating chat and the forum, preventing cheating, fraud and ban evasion (IP address, user agent, device fingerprint and login history), securing accounts, and improving game balance from gameplay data. We have weighed these interests against your rights and keep the data only as long as it is needed (see section 7). You can object to this processing (see section 9).
- Your consent (Article 6(1)(a)) — push notifications and linking Discord. You can withdraw consent at any time by turning notifications off in your browser or unlinking Discord.
- Legal obligation (Article 6(1)(c)) — checking you are old enough to play, and responding to lawful requests from authorities.
4. Cookies and browser storage
We only use storage that is strictly necessary to sign you in and run the game, so we don't ask for cookie consent. There are no advertising or tracking cookies.
| Name | Where | Purpose | Lasts |
|---|---|---|---|
| dk_web_token, dk_forum_token, dk_admin_token | Cookie (httpOnly, secure) — website, forum, staff dashboard | Keeps you signed in. Scripts on the page can't read it. | 7 days |
| dk_web_csrf, dk_forum_csrf, dk_csrf, and a csrf_token copy in local storage | Cookie and local storage | Security token that stops other sites making requests as you | 7 days / until you log out |
| Game session and settings | Browser storage used by the web game | Your sign-in token, guest code (if you play as a guest) and game settings, so you stay signed in and keep your preferences | Until you log out or clear site data |
5. Who we share it with
We don't sell your personal data. It is shared only with:
- Hetzner Online GmbH (Germany) — hosts our servers, database and file storage
- Resend (United States) — sends account emails such as verification codes and password resets
- Browser push services (such as Google, Mozilla or Apple, depending on your browser) — only if you turn on push notifications. Notification contents are encrypted.
- Discord — only if you link your account or use the Driftkeep bot; Discord's own privacy policy applies there
- Other players — your username, characters, level, leaderboard positions, chat messages, forum posts and forum profile are visible to others
- Authorities — when the law requires it
6. International transfers
Our servers are in Germany. The UK recognises the European Economic Area as providing adequate protection, so no further safeguard is needed for that transfer. Resend processes email data in the United States; that transfer is protected by [TO CONFIRM: the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in our agreement with Resend]. You can ask us for a copy of the relevant safeguards at privacy@driftkeep.com.
7. How long we keep it
- Account and game data: while your account exists. If you delete your account it is disabled straight away and your personal data is erased within 30 days.
- Login history (IP address, user agent, device fingerprint): 90 days
- In-game chat: 90 days. Messages that were flagged or removed by a moderator are kept as moderation evidence for one year, or until one year after any related report is resolved or ban ends, whichever is later
- Ban records (including banned IP addresses or device fingerprints): while the ban is in force
- Discord linking codes: deleted once they expire
- Anonymous, aggregated statistics that can no longer identify you may be kept to balance the game
8. Security
All traffic is encrypted with HTTPS. Passwords are hashed with argon2, guest codes are hashed, sign-in cookies can't be read by scripts, and staff access is limited by role and logged. No system is perfectly secure, so please use a strong password that you don't use anywhere else.
9. Your rights
Under UK GDPR you have the right to:
- Access and portability — download a copy of your data yourself from your account page
- Erasure — delete your account yourself from your account page (you'll need your password), or email us
- Rectification — correct inaccurate data
- Restriction — ask us to pause using your data
- Objection — object to processing based on our legitimate interests
- Withdraw consent — for push notifications or Discord linking, at any time
Guest accounts can't sign in to the website, so email us for any request about a guest account and include your guest username. For any request, email privacy@driftkeep.com. We reply within one month.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to sort it out first.
10. Children
Driftkeep is not for children under 13, and every sign-up path checks this. If you believe a child under 13 has given us personal data, email privacy@driftkeep.com and we will delete it promptly.
11. Changes to this policy
We may update this policy. We'll tell you about significant changes in the game or by email. The "Last updated" date at the top shows when it last changed.
12. Contact us
BSquared Software Development Ltd, [TO CONFIRM: registered office address]. Email: privacy@driftkeep.com. You can also reach us in our Discord community, but please use email for data-protection requests.