Privacy Policy

At Ironveil, we believe in radical privacy. We do not sell, rent, monetize, or broker personal information to advertisers or data aggregates. Our systems are engineered around data minimization: collecting the least amount of personal identifiable information (PII) required to deliver a secure, performant sandbox experience.

Data You Provide Directly

• Account Credentials: Your chosen master IronveilID username, character names, and encrypted password hash (salted using bcrypt; plain-text passwords are never stored or accessible).
• Contact Information: Your registered email address, utilized solely for essential security alerts, account verification, and automated password recovery.
• Communication Logs: Support tickets, bug reports, or appeals voluntarily submitted via the web portal or linked Discord verification channels.

Data Collected Automatically

• Network & Security Telemetry: IP addresses and connection timestamps, utilized strictly for DDoS mitigation, connection routing, and enforcing account quota integrity (max 2 game accounts).
• In-Game Activity Records: Game action telemetry (combat events, trade transactions, chat logs within public channels) stored strictly to investigate exploit attempts, griefing claims, and trade disputes.

We process your data strictly under the following legitimate interests and contractual obligations:

• Authentication & Session Management: Authenticating your identity when you access the Ironveil portal, game launcher, or shard game world.
• Shard Integrity & Anti-Cheat: Preventing multi-account exploitation, identifying automated botting scripts, and ensuring a fair competitive playing field.
• System Stability & Telemetry: Diagnosing server performance issues, packet loss, lag spikes, and software crashes.
• Security & Abuse Prevention: Guarding against unauthorized access, brute-force attacks, and infrastructure vandalism.

We do not share your information with external parties except for infrastructure partners essential for hosting and network defense:

• Network Protection & CDN: We use Cloudflare to shield our web infrastructure against distributed denial-of-service (DDoS) attacks and manage SSL/TLS encryption.
• Community Authentication: If you voluntarily link your account to Discord for role syncing or community notifications, we process your Discord User ID via the official Discord OAuth2 API.
• Legal Disclosures: We will only disclose player data if strictly compelled to do so by a binding court order or lawful subpoena issued by a court of competent jurisdiction.

The Ironveil portal uses only functional, strictly necessary cookies required for user authentication sessions and Cross-Site Request Forgery (CSRF) protection. We do not employ third-party advertising cookies, behavioural trackers, or pixel beacons.

For an exhaustive breakdown of every cookie utilized by our infrastructure, please consult our dedicated Cookie Policy.

We enforce defense-in-depth security measures to protect your credentials and data against unauthorized access, destruction, or disclosure:

• All web traffic is encrypted in transit using industry-standard TLS 1.3 encryption.
• Database servers and backups are isolated behind private network firewalls with restricted administrative key-based SSH access.
• Transient operational logs (connection timestamps, IP access logs) are automatically rotated and purged on a rolling 90-day cycle, unless required for ongoing security investigations.

Under the European Union General Data Protection Regulation (GDPR) and similar international privacy legislation, you possess explicit rights regarding your personal information:

• Right of Access: You may request a machine-readable export of all personal data held concerning your Ironveil account.
• Right to Rectification: You may update or correct inaccurate profile details and email addresses at any time via your account settings.
• Right to Erasure ("Right to be Forgotten"): You have the right to request permanent deletion of your account, email address, and associated personal data. Upon confirmed deletion, your credentials will be purged permanently.