Privacy notice

Information we process

When you create an account, we process your account identifier, display name, email address, connected login methods, authentication records, characters, and saved game progress. If you add a security email, it is stored as a separate recovery and account-security destination; it cannot be used to sign in or replace your account identity. During play we also process session, gameplay, performance, connection, security, and error signals needed to operate and improve the Realm.

When an account is first registered, a restricted moderator notification is sent through Discord. It includes the account name and email, sign-up method, first-touch source, external referrer, sanitized landing link and campaign parameters, approximate city, region and country, device class, and available operating-system and browser versions. It does not include the internal account ID, a custom creation timestamp, exact IP address, coordinates, raw user-agent string, ISP or ASN, connection or TLS details, or browser fingerprints. Missing or reduced browser and location values are shown honestly as unavailable.

Technical reliability signals can include a redacted browser error name and message, a short redacted stack fingerprint, loading-phase timing, renderer or asset fallback, network-protocol failure, and aggregated frame-time or latency measurements. We do not intentionally collect arbitrary console objects or ordinary console logs and warnings. Repeated technical issues may be grouped by fingerprint and linked to the affected play session so we can compare releases and environments.

Gameplay requires an account and an account-owned character. Before sign-in, limited anonymous technical identifiers may be used to diagnose reliability and abuse, but they cannot identify a playable hero or authorize any game request. Account-backed records are removed with the account where our storage relationships support deletion; anonymous operational aggregates may remain because they no longer identify a player.

First-party acquisition and journey measurement

When a public game page is requested, Realm of Echoes creates an opaque visit identifier and records a sanitized landing path, external referrer, UTM campaign values, recognized advertising click parameters, approximate country, region and city, coarse device class, operating system and browser, and limited evidence used to distinguish an edge request, browser confirmation, interaction, preview, or verified bot. Credentials, URL fragments, email-like values, authorization codes, passwords, secrets, session values, and oversized query values are removed. Same-origin referrers are ignored.

Secure, HTTP-only, same-site cookies retain the current visit and original first touch across ordinary navigation and Google or Discord authentication redirects. Original first touch is not overwritten. For analysis, a session can also use its current touch or the latest reliable non-direct touch from the preceding 30 days; direct visits do not replace that non-direct touch. The visit is linked to the existing installation and telemetry session identifiers, and to an account after verified authentication, so the private Echo Observatory can follow browser-confirmed visits through authentication, character selection, world entry, playable, engaged, and activated evidence.

Anonymous histories are joined only through the persistent installation identifier after verified account authentication. Realm of Echoes does not merge acquisition histories through an IP address, location, user-agent, TLS characteristics, or a device fingerprint. If one installation is used by multiple accounts, it is marked as conflicted and excluded from retroactive account merging. City-level location is approximate, referrers can be withheld, and browser or operating-system versions can be reduced by the browser.

Sanitized landing and referrer detail and per-session attribution are retained for up to 90 days. Compact anonymous attribution state is retained for up to 400 days. Compact account first-touch state remains until account deletion. Older compatible clients and the previous source-only cookie are identified as legacy evidence rather than being given inferred campaign, placement, or referrer values.

Lifecycle email and engagement signals

Realm of Echoes may send transactional or lifecycle messages, such as onboarding, account activity reminders, or a genuine non-promotional account or service notice to eligible registered accounts. A manual notice may include all eligible accounts or selected Email/password, Discord-linked, and Google-linked account groups. Overlapping groups and addresses that differ only by letter case are deduplicated, so one selected address receives at most one personalized message. Invalid addresses, synthetic Discord placeholders, unsubscribed accounts, and locally or provider-suppressed recipients are excluded. We do not use this system for newsletters, promotional campaigns, general marketing blasts, purchased mailing lists, or imported campaign address lists.

An operator may send an optional template test to any syntactically valid address they enter, even when it is not attached to a Realm account. The address and provider outcome are retained in an accountless test-delivery record for troubleshooting. Test messages use sample personalization, have an inert unsubscribe destination, contain no open pixel or tracked redirect, omit one-click unsubscribe headers, do not create or change an account or email preference, and are excluded from campaign and global production metrics.

When email engagement tracking is enabled, an email can contain an opaque image token and opaque redirect tokens for links. A requested image is counted as a reported open; it is not treated as proof that a person read the message because mail privacy tools, image proxies, and security scanners can request it automatically. Link requests are recorded separately as likely human, likely scanner, or unknown using limited request signals.

We do not retain raw IP addresses or full user-agent strings for email engagement. We retain the classification and reason, delivery and interaction timestamps, link destination, provider delivery status, exact-delivery unsubscribe timestamp, and aggregated counts. Campaign reports show only aggregate outcome and destination totals and never identify who clicked. We can also note authenticated play within 24 hours or activation within seven days after a send or first click. These are subsequent activities, not proof that the email caused them.

Raw delivery and interaction events are retained for up to 90 days, recipient-linked production delivery summaries and accountless test delivery summaries for up to 400 days, and anonymous daily aggregates for longer trend analysis. Detached tracked-link destinations may continue to redirect after analytics expires, but the request is no longer recorded.

Your email choice

Every production lifecycle or manual transactional email includes an unsubscribe link, and the same preference is available in the in-game Account Center. Unsubscribing is immediate, is attributed to the exact delivery when the link supports that attribution, and also cancels pending lifecycle sequences for that account. Older unsubscribe links still work but are not guessed onto an unrelated newer message. Essential account-security messages—including security-email verification and requested account-deletion messages—are sent even when lifecycle email is disabled. These essential messages contain no engagement tracking or unsubscribe link.

Account controls and deletion

The in-game Account Center shows sanitized active-session details, never session tokens or raw IP addresses, and lets you close other sessions. Password accounts can change their Realm password; accounts that use Google or Discord continue to manage provider passwords with that provider.

Account deletion requires a fresh sign-in and a single-use email confirmation. Opening a confirmation link does not change the account: the same signed-in account must deliberately confirm the request and type the destination email. If the login address cannot receive mail, a separately verified security email is required.

Confirmed deletion blocks gameplay immediately and is scheduled for seven days later. You may sign in during that period only to view the deletion state, cancel deletion, or log out. Cancellation restores access before permanent purging begins. Permanent deletion removes account-owned characters, personal telemetry, login sessions, preferences, and account-bound authority state after shared party, guild, auction, mail, and economy obligations are resolved. A completion record may remain only as an anonymous operational audit without an account identifier, email address, hero name, or reusable token.

Service providers and safeguards

Cloudflare infrastructure is used for application hosting, database storage, durable scheduling, queues, and transactional email delivery. Discord receives restricted operational account-registration notifications and supports selected Realm social features. Authentication providers are used only when you choose their sign-in method. Access to the private Echo Observatory is restricted to the creator session, and email editing actions are logged without storing email HTML or tracking tokens in the audit trail.

When you choose to make a purchase, Stripe hosts the payment page and processes the payment, billing, tax, fraud-prevention, refund, and dispute information needed for that transaction. Realm of Echoes sends Stripe the server-owned product reference, order reference, amount and currency, and your authenticated account email. Information you enter on Stripe's page is handled under Stripe's own privacy notice. Realm of Echoes does not receive or store your full card number.

Questions and requests

You can request information about your data, correction, deletion, or raise a privacy question by emailing hello@playrealmofechoes.com. The response may require reasonable account verification.