This English text translates the French politique de confidentialité, which prevails.
Tyrvanor only collects what the game needs to run, and counts its visitors without following them. No ads, no tracking, and no data is ever sold. This page covers the service’s three sites: tyrvanor.com, play.tyrvanor.com and wiki.tyrvanor.com.
Controller
Tyrvanor’s publisher, a private individual described in the legal notice. For any question or request about your data: contact@tyrvanor.com.
The data we process
Your account
When you create an account, the server you choose records your email address, your password if you choose one (hashed: nobody, not even the publisher, can read it), the choices you made when signing up (lord name, calling, invitation code, language, the version of the terms you accepted) and the dates your account was created, your address confirmed and you last signed in. Your email address is only used to sign you in and to write to you about your account (confirming your address): never newsletters or ads.
Why: to provide the game (performance of the terms of use, GDPR article 6(1)(b)).
Signing in with Google, Discord, Twitch or Facebook
You can also create your account and sign in with your Google, Discord, Twitch or Facebook account, without a password. You then go through that service’s page, which asks you to agree to share your profile with Tyrvanor. It sends the game server your email address, your name or username, the address of your profile picture and the identifier of your account there, which the server keeps with your account and updates at each sign-in. The server receives neither your password for that service, nor your contacts, nor your posts; it shows neither your name nor your picture to other players, who only see your lord’s name. The service you choose learns that you sign in to Tyrvanor, and processes its data under its own privacy policy. Until you click one of its buttons, nothing is sent to it.
Why: to sign you in the way you chose (performance of the terms of use, GDPR article 6(1)(b)).
Your game
The server keeps your realm: lord, strongholds, resources, hosts, lore, reports, sworn friends, Order, applications, bids, the gifts you received, your spins of the Wheel of Fortune and what they won, the warbands the world sent against you, and when you were last active. Part of it is visible to other players, as in any online game: your lord’s name, renown, strongholds on the map, Order, the badges of your objectives, and what battles and scouting reveal. If your lord is among the ten best of a category, the website’s Rolls show anyone, without an account, your lord’s name, your Order’s tag, your calling and your renown or honour. They are measured again every ten minutes, so a lord who leaves the world leaves them within ten minutes.
Why: to run the game (performance of the terms of use).
The chat
The lines you write are kept so their readers can read them: the world channel and your Order’s, read by their members, and whispers, read only by the lord they are sent to. The publisher may read them to handle a report or enforce the rules.
Why: the chat is part of the game (performance of the terms of use); moderation serves the legitimate interest of protecting players (GDPR article 6(1)(f)).
Alerts on your devices
If you turn alerts on in the game’s settings, your browser gives the game server an address at its push service and two encryption keys, which the server keeps with your lord, together with the kinds of alert you chose (each is off until you choose it). When something you chose happens while you are away (a host marching on your realm, a battle, ravens over one of your strongholds, a work finished, a host’s errand done, the end of a quest, a find or a warband nearby, a whisper, news of your Order), the server sends an alert to that address: it names the lord marching on you, your stronghold and when the host arrives, the title of the report, the work finished, or the lord who whispered to you (never what they wrote). The alert is encrypted for your browser alone: the push service that delivers it (Google’s for Chrome, Edge, Opera or Samsung Internet, Mozilla’s for Firefox, Apple’s for Safari, Microsoft’s on Windows) cannot read it, but learns that an alert went to your browser, and when. Your browser asks your leave before the first alert, and you can turn them off at any time, in the game’s settings or your browser’s.
Why: to tell you what you asked to be told (performance of the terms of use, GDPR article 6(1)(b)).
Invitations
If you sign up through a friend’s link, the server records who invited you. The lord who invited you sees your lord’s name, the day you joined and your renown on their invitation page, never your email address.
Why: to pay the invitation rewards (performance of the terms of use).
Technical data
As with any site, our hosting providers receive your device’s IP address, its browser and the pages or requests asked for. Cloudflare processes them to serve the sites and protect them from attacks; Supabase records them in the game servers’ logs (requests, sign-ins and errors), used for account security and troubleshooting. Supabase’s built-in analytics also draw the servers’ usage statistics from these logs: how many requests and sign-ins there are, how fast the servers answer, which errors occur. They are only for us, to run the servers.
Why: the security and smooth running of the service (legitimate interest, GDPR article 6(1)(f)).
The bot check
When you create an account, sign in or ask for a new confirmation link, Cloudflare Turnstile checks that a person, not a program, is filling in the form. Your browser runs a check from Cloudflare, which looks at your IP address and at characteristics of your browser and device. Most of the time you have nothing to do; sometimes you are asked to tick a box. Cloudflare uses this data to tell people from bots; the game server only learns whether the check passed.
Why: to protect accounts and the game from automated sign-ups and sign-ins, and from cheating (legitimate interest, GDPR article 6(1)(f)).
Audience measurement
To know which pages are read, where their visitors come from and how fast the pages load, the sites use Cloudflare Web Analytics. When a page opens, a small script from Cloudflare reports its address, the page that linked to it, your browser, operating system and type of device, your country and how long the page took to load. It sets no cookie, stores nothing in your browser and does not fingerprint your device: it cannot recognise you from one visit to the next, nor follow you to other sites. Your IP address only serves to tell your country and is not kept with the statistics. We only see totals (how many visits a page had, from which countries, with which browsers), never a visitor.
Why: to know how the sites are used and improve them (legitimate interest, GDPR article 6(1)(f)). Since it only produces anonymous statistics for our own use, this measurement needs no consent, as the CNIL’s guidelines on audience measurement allow (article 82 of the French Data Protection Act). You may object to it at any time: content blockers block the script, and the sites work just as well without it.
Cookies and browser storage
Tyrvanor uses no advertising, analytics or social media cookies: its audience measurement uses none (see above). The sites only keep in your browser (local storage) what they need to work: your language, the server you chose, an invitation code while you sign up (and your sign-up choices, while you go through Google, Discord, Twitch or Facebook if you sign up with one of them), your game session (to keep you signed in), the invitation page’s if you sign in there, and your game preferences (sound, graphics, the stronghold on screen, lines read, how far you got in the tutorial). Cloudflare may also set a security cookie that tells visitors from bots.
These are strictly necessary for the service you ask for: they need no consent (article 82 of the French Data Protection Act), which is why no banner asks for it. You can clear them at any time in your browser’s settings; you will then be signed out.
The sites serve their own fonts: apart from Cloudflare, which hosts them, measures their audience and runs the bot check on the forms, no third-party service is contacted during your visit, but Google, Discord, Twitch or Facebook if you choose to sign in with one of them, and your browser’s push service if you turn alerts on. The link to our Discord server sends nothing to Discord until you follow it; Discord’s own privacy policy then applies.
Who receives your data
- The publisher, to run and moderate the game.
- Other players, for what the game shows them (see above).
- Our processors, who act only on our instructions:
- Supabase (Supabase Pte. Ltd., Singapore) hosts the game servers: accounts, database, game rules, their logs and usage statistics, and sends the confirmation emails. The data is stored in Ireland, in the European Union.
- Cloudflare (Cloudflare, Inc., United States) hosts and serves the sites, measures their audience and runs the bot check on the forms.
- Google, Discord, Twitch or Facebook, if you sign in with one of them: it learns that you use Tyrvanor (see above).
- Your browser’s push service (Google, Mozilla, Apple or Microsoft), if you turn alerts on: it delivers them, encrypted, without being able to read them (see above).
- Authorities, only on a lawful request.
Transfers outside the European Union
Game data is stored in Ireland. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023. Supabase, and its own processors when they work from outside the Union, are bound by the European Commission’s standard contractual clauses in their data processing agreement. Alerts, if you turn them on, go through your browser’s push service, which may be outside the Union: they are encrypted, and it cannot read them.
How long we keep it
| Data | Kept |
|---|---|
| Account (email address, sign-up choices, the profile sent by Google, Discord, Twitch or Facebook) | as long as the account exists |
| Game (realm, reports, whispers, friends…) | as long as you play: a realm left 30 days without a sign-in (60 days if it rests in Sanctuary) crumbles and its data is deleted; the account stays, ready to found a new realm |
| World and Order lines | 30 days |
| Alerts: each browser’s push address and keys | until you turn alerts off there, its push service forgets it, or you turn them on in 10 more recent browsers; each alert is deleted once sent |
| Technical logs, and the servers’ usage statistics drawn from them | a few days to a few weeks, under our hosting providers’ rules |
| Audience statistics | anonymous totals only, kept a few months under Cloudflare’s rules |
| Bot check | nothing kept by us: Cloudflare processes it under its own rules |
| Browser storage | until you clear it |
When an account is deleted, all its game data goes with it.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability over your data (GDPR articles 15 to 21), and the right to set instructions for what happens to it after your death (article 85 of the French Data Protection Act).
- Access and portability: the Your data page gives you, in one click, a copy of everything a server holds about your account, in a file any program can read.
- Erasure: the same page deletes your account on a server for good, with all its game data, once you sign in.
- Rectification, or erasure when you can no longer sign in: write to contact@tyrvanor.com from your account’s address, naming the server. Your strongholds’ names and your settings can also be changed in the game.
- Your other rights are exercised at the same address.
We answer within one month. If you believe your rights are not respected, you may complain to the CNIL (Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr) or to the data protection authority of your country.
Minors
Tyrvanor is meant for players aged 15 and over. If you are under 15, ask a parent’s permission before creating an account. A parent may write to us to have their child’s account deleted.
Security
The sites and servers only talk over HTTPS. Passwords are hashed by Supabase Auth. Game data can only be read by the game servers, never straight from the browser, except chat lines, which the database only delivers to their readers.
Changes
If this policy changes, the new version is published here with its date. An important change is announced in the news.