Privacy
What we hold about you, and what you can ask of us
Written in plain words from the record of processing this project keeps, and checked against the database it describes on every change. A draft: the controller's name and two legal questions are open, and they are named below rather than papered over.
Who is responsible
The controller is the person building Zizeeria, Martin. His legal name and postal contact are to be filled in here before this page is published as more than a draft; this sentence says so rather than inventing them. No data protection officer is appointed; whether Art. 37 requires one is for the lawyer, beside the two questions above.
Write to support@zizeeria.se. One address, read by the people building the game.
To run your account
What the game cannot run without: an address to reach you, a way to check your password, a name for other players to see, and your age. Basis: the account contract, Art. 6(1)(b).
- Your account: the address you sign in with, the name other players see, your date of birth, when you last signed in, and whether the account is active, suspended or banned, and until when a suspension lasts.
Kept: the life of the account; no route deletes one today, and an erasure will leave a tombstone row that names nobody, for ever.
Who else sees it: the mail server, for the verification link (the address alone).
If you ask us to erase your account: kept with everything that names you removed.
- Which invite code let your account in while registration is by invitation.
Kept: for ever; the code, its label and its creator are the operator's.
If you ask us to erase your account: kept with everything that names you removed.
- The link we mailed you to prove the address, stored as a hash until it is clicked or expires.
Kept: consumed on click or expired after 86,400 s (ziz_verify_ttl_seconds), then swept.
Who else sees it: the mail server that carries the link.
If you ask us to erase your account: deleted.
- A verifier for your password (never the password) and when you last changed it.
Kept: the life of the account.
If you ask us to erase your account: deleted.
- Your sign-in sessions from the game client: a hashed token, the address it came from, and when it expires.
Kept: until expires_at, 1,209,600 s (14 days) after issue (ziz_player_refresh_ttl_seconds); swept every 900 s.
If you ask us to erase your account: deleted.
- A two-minute ticket that lets your client into a zone.
Kept: zone_admission_ticket_ttl_seconds = 120, swept every 900 s.
If you ask us to erase your account: deleted.
To run the world
Your characters and what they do and own. The server is authoritative, so every one of these rows is written by the server and not by your client. Basis: the account contract, Art. 6(1)(b).
- Each character you play: its name, look, sheet, talents and where it is standing.
Kept: the life of the account; a retired character keeps its name held for characters_name_hold_days = 30.
Who else sees it: other players, by sight, and the Chronicle's public page (the name).
If you ask us to erase your account: kept with everything that names you removed.
- The abilities your character has learned.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- The choices your character made when somebody in the world asked.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- The places your character has found: each place once, when it was first found, and the experience it gave.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Your action bar: which learned ability sits in which slot.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Every change to your character, in order, so a repeated request cannot apply twice; for an item a member of the team put in your bag, the reason they gave.
Kept: for ever, pending a retention decision.
If you ask us to erase your account: kept with everything that names you removed.
- Your crafting professions.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Your journal: the quests your character has accepted.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- The steps of your journal you have done.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- The recipes your character knows.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- Which chat channels your character is in.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- What you said in chat, as you typed it.
Kept: chat_retention_days = 30, swept hourly by social-service.
Who else sees it: the players in the channel.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- Every movement of copper into or out of your character's purse.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The fights your character took part in: damage, healing, when.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- Friend requests you sent or received.
Kept: until answered.
Who else sees it: the other player.
If you ask us to erase your account: deleted.
- Your friends, as pairs of characters.
Kept: until removed.
Who else sees it: the other player.
If you ask us to erase your account: deleted.
- Your guild membership and rank.
Kept: until you leave.
Who else sees it: the guild.
If you ask us to erase your account: deleted.
- The guilds of the world and who founded each.
Kept: the life of the guild.
Who else sees it: everybody in the game.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- What is in your bag and what is bound to your character.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- What an encounter rolled for your character.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The debt your character carries after a death, until it is cleared.
Kept: the life of the character.
If you ask us to erase your account: deleted.
- A guild's ranks and what each may do.
Kept: the life of the guild.
Who else sees it: the guild.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The zone, guild and whisper channels; a whisper channel is named by the two characters in it.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The public record of what players did in the world, with character names as they were at the time.
Kept: for ever.
Who else sees it: everybody: the public Chronicle page.
If you ask us to erase your account: kept with everything that names you removed.
- Balance telemetry keyed to a pseudonymous account id, and from the next release each character's play sessions: when one starts and ends, and which zone server reported it, which is how long a character plays and whether it comes back. From the same release, each death a creature deals a player: the region, the Calling, the level, how long the death took and which creature, with no character or account named, so that row is about no one. From release 0.1.24, what the launcher reports about updating the game and about the game crashing: how an update ended, which releases it went between and how long it took, and for each crash the engine's word for it and a fingerprint of where in the code it happened, all under a random id the launcher made for your installation and never your account. Those reports do not rest on the account contract this section names: the launcher sends them before anybody signs in, so their basis is our legitimate interest in a launcher that updates and a game that does not crash, Art. 6(1)(f). The rest of a crash folder, the memory dump among it, stays on your computer, and a file named reports-off beside the launcher's log stops the reports. Nothing writes it today.
Kept: 90 days by the hypertable's retention policy; 18 rows on 2026-09-25, none with an account_id or a character_id.
If you ask us to erase your account: deleted.
- Whether accounts come back after a day, a week, a month. Nothing writes it today.
Kept: for ever; 0 rows, and nothing writes it.
If you ask us to erase your account: deleted.
To keep the service safe
The sign-in log, the audit of every change, the throttle, moderation. Basis: our legitimate interest in running a service other players can trust, Art. 6(1)(f) -- and a child would expect every one of these.
- A bug report you filed from the game: your words, the character, the client's details, and the ids of the Discord thread it opened.
Kept: for ever, pending a retention decision (design decision 14); the attachments below are swept.
Who else sees it: Discord Inc. -- the description, the character's name and id, the position, the screenshot and the log tail go to a webhook by your own act on the card.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- A silence a game master or an operator placed on you: until when, and why, and whether it was lifted early.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- What a game master or an operator did to which account or character, and the reason given.
Kept: for ever.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- What the game server holding your character did with an order to remove you from the world.
Kept: for ever.
Who else sees it: nobody; the character role may INSERT and SELECT, the owner everything.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The players you chose not to hear, and who chose not to hear you.
Kept: for ever, or until you remove it.
If you ask us to erase your account: kept with everything that names you removed.
- When your character's movement or requests fall outside what the game allows, the game server records it, and when what your character holds or has done does not add up, the character service's own checks record that too: what kind of thing it was, how many times in each hour, when in that hour it was first and last seen, and the largest number measured, with the region and the build of the game server when a game server measured it. A person reads these counts; nothing is done to you or your account automatically because of them. The game server can still refuse a request, or close the connection, at the moment it happens, as it always could; this record decides nothing. Nothing writes this record until a later release of the game.
Kept: 90 days, deleted by character-service's daily sweep, which ships with the first release that writes this record.
Who else sees it: nobody; the character role may SELECT, INSERT, UPDATE and DELETE, the owner everything.
If you ask us to erase your account: deleted.
- Reports players filed about players: the reporter's words and the outcome.
Kept: for ever, pending a retention decision (design decision 14).
If you ask us to erase your account: kept, pointing at an id that names nobody.
- The screenshot and log tail sent with a bug report.
Kept: bug_attachment_retention_days = 30 after resolution, or three times that after filing, swept hourly.
Who else sees it: Discord Inc., with the report, by your own act.
If you ask us to erase your account: deleted.
- How many sign-in attempts failed recently for an account or from an address, so a password guesser is slowed.
Kept: 86,400 s after the last failure (_THROTTLE_RETENTION_SECONDS), swept every 900 s.
If you ask us to erase your account: deleted.
- Every authentication decision: sign-ins, refusals, registrations, bans; who, when, from where.
Kept: for ever, pending a retention decision (design decision 14); 23,231 rows.
Who else sees it: nobody; the auth role may INSERT and SELECT, the owner everything.
If you ask us to erase your account: kept with everything that names you removed.
- Who suspended, banned or reinstated your account, when, until when, and why.
Kept: for ever.
Who else sees it: nobody; the auth role may INSERT and SELECT, the owner everything.
If you ask us to erase your account: kept, pointing at an id that names nobody.
- Who changed what and when, across every audited table, including copies of the rows as they were.
Kept: for ever, pending a retention decision (design decision 14); 25,165 rows.
Who else sees it: the roles zizeeria_character, zizeeria_content and zizeeria_grafana may SELECT it (measured grants); admin/audit shows it to a holder of content:read_admin.
If you ask us to erase your account: kept with everything that names you removed.
Seven further tables under this heading hold the operators’ own sign-in identities, keys, passkeys and permissions -- the people running the service, not players. They are in the register with a rule word each and are folded into this sentence here.
Statistics: what we count, and what we keep
Counts about the site and the game as a whole. Where a count is small it can still be about you, and the paragraphs below say which small counts are kept.
Visits to this site
We count visits to this site from our own server's log. To estimate how many different visitors there were, we compare the address and browser of each visit within a day, a week and a month, in memory, and keep only the totals. We keep no address and no browser string, only the device type, operating system and kind of program read from it, and the country the address is in. We find the country in memory, in a copy of DB-IP's free list of address ranges kept on our own server, so no address is sent anywhere to look it up. For each day we keep totals of visits, of visits from Windows, of pages opened, of different visitors that day and in the seven and the thirty days to it, of log lines read, of requests by the kind of program that sent them, and of the most visits made from any one address and browser, and how many installer downloads of each release started and finished, in a browser or the launcher, and from how many different visitors. For each week we keep its number of visits, and counts of the pages opened, of the sites and campaign links that sent people here and the page each of them arrived on, of device type, operating system, browser language and country and of each device with each system, and of the missing pages people asked for and the sites that linked to them. Anything sent by fewer than three different visitors in its week, and anything past the week's 25 largest, is counted only in a row named (other); the totals of a day and of a week are kept however small, so a day with a single visitor is kept as a count of one. No cookie or script is involved, and a browser that sends Global Privacy Control or Do Not Track is left out of every count except the number of log lines read and a daily count of how many different visitors sent it.
Basis: Our legitimate interest in knowing which pages and links bring people to the game, Art. 6(1)(f). Counting from the log is a further use of it for statistics, which Art. 5(1)(b) allows with the safeguards Art. 89(1) asks for: only counts are kept, never an address, a browser string or a time of day.
Kept: The counts are kept for as long as the site exists. The log they are counted from is not copied: it stays where it already is, for as long as the copies below say.
Country data: IP Geolocation by DB-IP, licensed CC BY 4.0.
Version of this paragraph: traffic-89b26cba1a68
Play in the game
From the records the game keeps to run, we count how many players play each day and week and how many staff play each day, how often they sign in, how long they play, whether they come back after a day, a week and a month, how far new players get through registering, verifying, signing in, making a character, entering the world and finishing their first quest, why registrations are refused, where new players stop in the first hour, how much copper comes into and leaves the game and for what, how many sessions name a character that no longer exists, and how many crash reports and launcher runs each release of the game sends; and from the servers' own gauges, how many clients were connected at the busiest minute of each day, the test harness's among them, and how much copper the whole game holds. We also count, each day, how often the test harness signs in and plays. We keep only those counts. A day's count of players, or of what they did, that would describe one or two of them is not kept, and nor is a week's count of players that would, except in three places. How many players joined or first played, and how many characters were first played, in each week is kept however small. Where at least three joined or first played in a week, how many of them reached each step or came back is kept however small, so a step only one of them reached is kept as a count of one. And any other breakdown that would describe fewer than three players is kept only in a row named (fewer than three), which, while it would describe one or two, keeps no number but how many it describes. Refused registrations make no player, and are counted by reason however few. Set against the days that are kept, a week's numbers can still show what a day that is not kept came to, such as the new players of that day or the copper moved in it. While few people play, a count can still be about you, and only the operator sees them.
Basis: Our legitimate interest in knowing whether the people who play come back, Art. 6(1)(f). Counting from the game's own records is a further use of them for statistics, which Art. 5(1)(b) allows with the safeguards Art. 89(1) asks for.
Kept: The counts are kept for as long as the game exists. The records they are counted from keep their own windows, listed in the sections above.
Version of this paragraph: game-911174b9bf42
Each of these counts is switched on only after its paragraph, in the version shown, is published here, and not before. Its first pass also counts what the log and the game’s records still hold from before that day.
Only if you say yes
Nothing. There is no optional processing today: no newsletter, no analytics keyed to you, no third-party script. When something optional exists it will be asked for here, and not before.
No checkbox on the registration form asks you to agree to anything optional, because there is nothing optional to agree to. The one thing you do by your own act is filing a bug report from inside the game, whose card says where the words go.
Who else receives it, and the copies outside the database
An erasure rewrites the database. It does not rewrite these, and each has its own window.
Nightly database dumps, whole
Where: a disk in the same building.
Kept: 30 days, then destroyed.
The services' logs, including your address on each connection from the game client, and the web proxy's access log: your address, the pages you asked for, and the headers your browser sent with them, among them its browser string, its language and the site that sent you, with the time of each request and the status and size of each answer; and, from the game server release that writes them, a line at most every five minutes for each connection and kind of thing when the game server measures something the game does not allow, with the kind, how many times and the number measured, naming no character, no name and no address
Where: the log store on the database host.
Kept: 30 days (720 hours), then removed within hours by the log store's clean-up.
The zone host's own journal, with the same connection lines and the same lines about what the game server measured, which name no character
Where: the zone host.
Kept: no cap today; a 30-day cap is designed and not yet shipped.
The web proxy's access log: your address, the pages you asked for, and the headers your browser sent with them, among them its browser string, its language and the site that sent you, with the time of each request and the status and size of each answer
Where: the proxy, which serves other sites too.
Kept: until fourteen rolls of 100 MB have passed; the rolls go by size, not by day, and we set no time limit, so how many days that is depends on how busy this site is.
The verification mail we sent you
Where: our mail server.
Kept: the mail server's own retention, not decided here.
A bug report you filed, with its screenshot and log tail
Where: Discord Inc., in a private forum thread.
Kept: until we delete the thread by hand.
So: a copy of the database taken before your erasure exists for up to 30 days afterwards, on a disk in the same building, and is then destroyed. Nothing is sold. No third-party origin is contacted while you read this site: there is no analytics script, and the fonts are served from here.
Your rights, and how to use them today
Under the GDPR you may ask for a copy of the personal data held about you (Art. 15) and for its erasure (Art. 17). A copy needs no reason; an erasure we answer on the grounds Art. 17(1) lists, keeping only what the register above says stays. There is no button for this yet. Write to the address below from the address on your account and say whether you want a copy or an erasure; we answer within one month of receiving it, by hand (Art. 12(3)).
Write to support@zizeeria.se. One address, read by the people building the game.
When your account is erased, the rows that name you are deleted or rewritten as the register says for each table above; what stays is what the game keeps as evidence -- the ledger of copper, the record of a game master’s acts, reports, a ban -- pointing at an id that no longer names anybody. Copies outside the database age out on their own windows, listed above.
You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se.
Children
The minimum age is 13. The date of birth you enter is checked when the account is created and a registration below the limit is refused; the date is stored so a changed rule can be applied later, and it is shown to nobody. The age is self-declared: nothing verifies it. Nothing on this site asks a guardian for consent for a player aged 13 to fifteen today; a guardian’s mailed confirmation is designed and not built, and whether the contract basis holds for anybody under eighteen is one of the two questions a lawyer has to answer.
Cookies
The public site sets no cookie. No script on it counts you either: the statistics above are counted from the server’s own log. The admin site, which only the operators can sign in to, sets one session cookie, zizeeria_admin_session, that lives fifteen minutes. The game client does not use cookies; it holds a sign-in token for the length of a session.
Changes
This page was generated from the register as measured on 2026-09-19 against the code at 38e8839. The register is docs/PRIVACY-REGISTER.md in the repository, and the legal page lists this document among those in preparation until it is reviewed.