Privacy
What we hold about you, and what you can ask of us
Written in plain words from the record of processing this project keeps, and checked against the database it describes on every change. A draft: the controller's name and two legal questions are open, and they are named below rather than papered over.
Who is responsible
The controller is the person building Zizeeria, Martin. His legal name and postal contact are to be filled in here before this page is published as more than a draft; this sentence says so rather than inventing them. No data protection officer is appointed; whether Art. 37 requires one is for the lawyer, beside the two questions above.
Write to support@zizeeria.se. One address, read by the people building the game.
To run your account
What the game cannot run without: an address to reach you, a way to check your password, a name for other players to see, and your age. Basis: the account contract, Art. 6(1)(b).
- Your account: the address you sign in with, the name other players see, your date of birth, when you last signed in, and whether the account is active, suspended or banned.
Kept: the life of the account; no route deletes one today, and an erasure will leave a tombstone row that names nobody, for ever.
Who else sees it: the mail server, for the verification link (the address alone).
If you ask us to erase your account: kept with everything that names you removed.
- Which invite code let your account in while registration is by invitation.
Kept: for ever; the code, its label and its creator are the operator's.
If you ask us to erase your account: kept with everything that names you removed.
- The link we mailed you to prove the address, stored as a hash until it is clicked or expires.
Kept: consumed on click or expired after 86,400 s (ziz_verify_ttl_seconds), then swept.
Who else sees it: the mail server that carries the link.
If you ask us to erase your account: deleted.
- A verifier for your password (never the password) and when you last changed it.
Kept: the life of the account.
If you ask us to erase your account: deleted.
- Your sign-in sessions from the game client: a hashed token, the address it came from, and when it expires.
Kept: until expires_at, 1,209,600 s (14 days) after issue (ziz_player_refresh_ttl_seconds); swept every 900 s.
If you ask us to erase your account: deleted.
- A two-minute ticket that lets your client into a zone.
Kept: zone_admission_ticket_ttl_seconds = 120, swept every 900 s.
If you ask us to erase your account: deleted.
To run the world
Your characters and what they do and own. The server is authoritative, so every one of these rows is written by the server and not by your client. Basis: the account contract, Art. 6(1)(b).
- Each character you play: its name, look, sheet, talents and where it is standing.
Kept: the life of the account; a retired character keeps its name held for characters_name_hold_days = 30.
Who else sees it: other players, by sight, and the Chronicle's public page (the name).
If you ask us to erase your account: kept with everything that names you removed.
- The abilities your character has learned.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Your action bar: which learned ability sits in which slot.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Every change to your character, in order, so a repeated request cannot apply twice.
Kept: for ever, pending a retention decision.
If you ask us to erase your account: kept with everything that names you removed.
- Your crafting professions.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Your journal: the quests your character has accepted.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- The steps of your journal you have done.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- The recipes your character knows.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Which chat channels your character is in.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- What you said in chat, as you typed it.
Kept: chat_retention_days = 30, swept hourly by social-service.
Who else sees it: the players in the channel.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- Every movement of copper into or out of your character's purse.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The fights your character took part in: damage, healing, when.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- Friend requests you sent or received.
Kept: until answered.
Who else sees it: the other player.
If you ask us to erase your account: deleted.
- Your friends, as pairs of characters.
Kept: until removed.
Who else sees it: the other player.
If you ask us to erase your account: deleted.
- Your guild membership and rank.
Kept: until you leave.
Who else sees it: the guild.
If you ask us to erase your account: deleted.
- The guilds of the world and who founded each.
Kept: the life of the guild.
Who else sees it: everybody in the game.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- What is in your bag and what is bound to your character.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- What an encounter rolled for your character.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The debt your character carries after a death, until it is cleared.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- A guild's ranks and what each may do.
Kept: the life of the guild.
Who else sees it: the guild.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The zone, guild and whisper channels; a whisper channel is named by the two characters in it.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The public record of what players did in the world, with character names as they were at the time.
Kept: for ever.
Who else sees it: everybody: the public Chronicle page.
If you ask us to erase your account: kept with everything that names you removed.
- Balance telemetry keyed to a pseudonymous account id. Nothing writes it today.
Kept: 90 days by the hypertable's retention policy; 18 rows, 0 with an account_id, and nothing posts to it.
If you ask us to erase your account: deleted.
- Whether accounts come back after a day, a week, a month. Nothing writes it today.
Kept: for ever; 0 rows, and nothing writes it.
If you ask us to erase your account: deleted.
To keep the service safe
The sign-in log, the audit of every change, the throttle, moderation. Basis: our legitimate interest in running a service other players can trust, Art. 6(1)(f) -- and a child would expect every one of these.
- A bug report you filed from the game: your words, the character, the client's details, and the ids of the Discord thread it opened.
Kept: for ever, pending a retention decision (design decision 14); the attachments below are swept.
Who else sees it: Discord Inc. -- the description, the character's name and id, the position, the screenshot and the log tail go to a webhook by your own act on the card.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- A silence a game master placed on you: until when, and why.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- What a game master did to which account or character, and the reason given.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The players you chose not to hear, and who chose not to hear you.
Kept: for ever, or until you remove it.
If you ask us to erase your account: kept with everything that names you removed.
- Reports players filed about players: the reporter's words and the outcome.
Kept: for ever, pending a retention decision (design decision 14).
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The screenshot and log tail sent with a bug report.
Kept: bug_attachment_retention_days = 30 after resolution, or three times that after filing, swept hourly.
Who else sees it: Discord Inc., with the report, by your own act.
If you ask us to erase your account: deleted.
- How many sign-in attempts failed recently for an account or from an address, so a password guesser is slowed.
Kept: 86,400 s after the last failure (_THROTTLE_RETENTION_SECONDS), swept every 900 s.
If you ask us to erase your account: deleted.
- Every authentication decision: sign-ins, refusals, registrations, bans; who, when, from where.
Kept: for ever, pending a retention decision (design decision 14); 23,231 rows.
Who else sees it: nobody; the auth role may INSERT and SELECT, the owner everything.
If you ask us to erase your account: kept with everything that names you removed.
- Who changed what and when, across every audited table, including copies of the rows as they were.
Kept: for ever, pending a retention decision (design decision 14); 25,165 rows.
Who else sees it: the roles zizeeria_character, zizeeria_content and zizeeria_grafana may SELECT it (measured grants); admin/audit shows it to a holder of content:read_admin.
If you ask us to erase your account: kept with everything that names you removed.
Seven further tables under this heading hold the operators’ own sign-in identities, keys, passkeys and permissions -- the people running the service, not players. They are in the register with a rule word each and are folded into this sentence here.
Only if you say yes
Nothing. There is no optional processing today: no newsletter, no analytics keyed to you, no third-party script. When something optional exists it will be asked for here, and not before.
No checkbox on the registration form asks you to agree to anything optional, because there is nothing optional to agree to. The one thing you do by your own act is filing a bug report from inside the game, whose card says where the words go.
Who else receives it, and the copies outside the database
An erasure rewrites the database. It does not rewrite these, and each has its own window.
Nightly database dumps, whole
Where: a disk in the same building.
Kept: 30 days, then destroyed.
The services' logs, including your address on each connection from the game client
Where: the log store on the database host.
Kept: 30 days (720 hours).
The zone host's own journal, with the same connection lines
Where: the zone host.
Kept: no cap today; a 30-day cap is designed and not yet shipped.
The web proxy's access log: your address and the pages you asked for
Where: the proxy, which serves other sites too.
Kept: fourteen daily rolls.
The verification mail we sent you
Where: our mail server.
Kept: the mail server's own retention, not decided here.
A bug report you filed, with its screenshot and log tail
Where: Discord Inc., in a private forum thread.
Kept: until we delete the thread by hand.
So: a copy of the database taken before your erasure exists for up to 30 days afterwards, on a disk in the same building, and is then destroyed. Nothing is sold. No third-party origin is contacted while you read this site: there is no analytics script, and the fonts are served from here.
Your rights, and how to use them today
Under the GDPR you may ask for a copy of the personal data held about you (Art. 15) and for its erasure (Art. 17). A copy needs no reason; an erasure we answer on the grounds Art. 17(1) lists, keeping only what the register above says stays. There is no button for this yet. Write to the address below from the address on your account and say whether you want a copy or an erasure; we answer within one month of receiving it, by hand (Art. 12(3)).
Write to support@zizeeria.se. One address, read by the people building the game.
When your account is erased, the rows that name you are deleted or rewritten as the register says for each table above; what stays is what the game keeps as evidence -- the ledger of copper, the record of a game master’s acts, reports, a ban -- pointing at an id that no longer names anybody. Copies outside the database age out on their own windows, listed above.
You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se.
Children
The minimum age is 13. The date of birth you enter is checked when the account is created and a registration below the limit is refused; the date is stored so a changed rule can be applied later, and it is shown to nobody. The age is self-declared: nothing verifies it. Nothing on this site asks a guardian for consent for a player aged 13 to fifteen today; a guardian’s mailed confirmation is designed and not built, and whether the contract basis holds for anybody under eighteen is one of the two questions a lawyer has to answer.
Cookies
The public site sets no cookie. The admin site, which only the operators can sign in to, sets one session cookie, zizeeria_admin_session, that lives fifteen minutes. The game client does not use cookies; it holds a sign-in token for the length of a session.
Changes
This page was generated from the register as measured on 2026-09-19 against the code at 38e8839. The register is docs/PRIVACY-REGISTER.md in the repository, and the legal page lists this document among those in preparation until it is reviewed.