Who is responsible
The ASCII Realms game and this site are run by Ithoro LLC, which decides how the information described here is used (the "controller" in data protection law). Questions about this policy or your information go to support@asciirealms.com.
Signing in to the game uses an Ithoro login, the login Ithoro's games share, kept by Ithoro accounts, also run by Ithoro LLC. What Ithoro accounts keep about your login is described in their own privacy policy; this policy covers everything the game itself keeps.
The game: what it collects, and what it doesn't
This section covers the ASCII Realms game on every platform it runs on, including in a web browser.
Your account and sessions
- The first time you play, we make a game account for you with a random identifier. You can play as a guest without giving us anything about yourself. A guest account belongs to the device it was made on: until you save it, it can't be recovered if you sign out or lose the device.
- To save your account, or to play it on another device, you sign in with an Ithoro login: with an email address and password, or with Apple or Google. The game itself receives only your login's identifier, never your password, and Apple and Google give the game nothing about you.
- When you sign in, we keep a session record, including the IP address and the device or browser description the sign-in came from, to keep you signed in and protect your account. We also use IP addresses to prevent abuse.
Characters and gameplay
- We store your characters and their progress: such as each character's name, class and appearance, its level, experience, gold and items, its stats and where it is in the world, the cosmetics your account owns, and records of gameplay events (such as rewards, deaths and stat changes) that keep the game fair.
- Character names are public: other players in the world see your character and its name. Don't put personal information in a name.
- You can delete a character at any time on the character screen, with everything that is its own.
Reports and blocks
- If you report another character's name, we store the report (who reported which character and account, the name, the reason and when) and what we decided. We use it to review the name, and may hide it or rename the character. The player you report isn't told who reported them.
- If you block a player, we store the block (your account, theirs and when), so their characters' names stay hidden from you. Only you see your blocks, and the player you block isn't told.
The Google Play pre-registration reward (Android only)
If you pre-registered for ASCII Realms on Google Play, the Android app claims its reward, a cosmetic, for your account. Our server checks the purchase with Google and keeps a record of the claim: a one-way fingerprint of the purchase, what it was and gave, the account and when, and Google's order number if the reward's product was bought. We check with Google for refunded or revoked purchases and take back what they gave. The game on other platforms collects none of this.
Crash and error reports
If the game or our servers hit an error, a report goes to our error monitoring provider, so we can find and fix the fault. A report can contain technical details of the error, the game's version, your device's model, operating system and hardware, a random identifier for your installation, and, while you are in the world, your account's and character's identifiers. The provider also records whether the game's sessions crash. It receives your IP address, as any server does, and keeps only the approximate location it works out from it, not the address. Reports don't contain your email address, your character's name, your password or what you type.
Updates and server logs
Installed games download content updates from our servers. Those requests carry no identifier, though our provider sees your IP address to deliver them. Our servers log the requests they receive, including the IP address each came from, to run the service and keep it secure.
What the game doesn't do
- It shows no ads and doesn't use an advertising identifier.
- It uses no analytics and doesn't track you across other companies' apps or websites.
- It doesn't access your contacts, photos, microphone, camera or the device's location.
- There is nothing to buy in the game.
- We don't sell your information or share it for advertising.
The website: what it collects, and what it doesn't
If you sign up for updates
We store your email address, when and where you signed up (on this site, or with our form on Facebook or Instagram), which version of the signup wording you agreed to, whether and when you confirmed the address, and the country your connection came from when you signed up or confirmed (a two-letter code). We store nothing else with your signup: no name, no password, not your IP address or anything more precise than the country.
To confirm your address we email you a code (for a signup from our form on Facebook or Instagram, a link). We never send news to an address that hasn't been confirmed. We keep a record of each code and link we send, but not the code or link itself, to check it and prevent abuse; a code's record is deleted two days after the last code. Our emails contain nothing that tracks whether you open them.
If you sign up on Facebook or Instagram
Our ads on Facebook and Instagram can open a short form from Meta that asks only for your email address. When you submit it, Meta passes the address to us, and we put it on the same list as described above. We take nothing else from Meta about you. Meta handles what you do on its services as its own privacy policy describes.
When you visit any page
As with every website, our hosting provider receives the technical details needed to deliver pages and protect the service, such as your IP address, your browser's user agent and the page you asked for. We don't use analytics tools. The only advertising tool is the Meta Pixel, under the rules in Ad measurement, below; while it isn't running, the site sets no cookies and loads nothing from other sites.
To prevent abuse of the signup form, we briefly count recent attempts from each network, without storing your IP address, and limit how many codes an address can receive.
Sometimes the form asks for a quick check that you're not a bot: Cloudflare Turnstile, which the form loads from Cloudflare only then. To tell people from bots, Cloudflare processes signals from your browser and connection (such as your IP address and your browser's user agent) as its Turnstile Privacy Addendum describes. We receive only whether the check passed. The legal basis is our legitimate interest in keeping the form from being abused to email people who didn't ask (GDPR Article 6(1)(f)).
When something on the site goes wrong
If the site fails, an error report goes to our error monitoring provider, so we can find and fix the fault. A report contains technical details of the error, the page's address, your browser and operating system, and the site's version, never your email address or anything else you type. The provider receives your IP address with a report from your browser, and keeps only the approximate location it works out from it, not the address.
Ad measurement (Meta Pixel and Conversions API)
We may advertise ASCII Realms on Meta's services (Facebook and Instagram). To learn whether those ads bring people to the site and to the signup, the site can use the Meta Pixel and Meta's Conversions API, tools from Meta.
When it runs
- In the United States, it runs without asking first, and you can turn it off at any time with "Your privacy choices" at the bottom of every page.
- In Canada, outside Quebec, it runs without asking first and the first page you visit says so, with "Turn it off" (also in "Your privacy choices" at any time). Your hashed address isn't sent from Canada unless you choose "Allow".
- Everywhere else, and whenever we can't tell where you are, it runs only if you choose "Allow" when the site asks. If you choose "Decline", or never choose, it doesn't load at all.
- Global Privacy Control always wins: if your browser sends it, the pixel stays off wherever you are, and the site doesn't ask.
Once you turn it off or decline, it stays off in that browser. To know which applies, the site uses the country (and, in Canada, the province) your connection comes from, and stores nothing for it.
While it runs
- Your browser loads Meta's script and tells Meta about the pages you view (their address, your IP address and browser details, and the Meta cookies below) and that a signup happened. The pixel itself never receives your email address or anything else you type.
- When you confirm a new signup, our server may also report it to Meta directly (Meta's Conversions API), with your email address in hashed form, the IP address and browser details of the request, and the Meta cookies or ad click identifier, so the signup is counted once. A hashed address isn't anonymous: Meta compares it with its accounts' addresses to connect your signup to its ads. In the United States this is sent while ad measurement is on; everywhere else, Canada included, only if you chose "Allow".
-
Meta's script sets the cookies
_fbp(a random browser identifier, kept 90 days) and_fbc(only when you arrive from a Meta ad link) on this site, and may keep the same identifiers in this site's browser storage. If you are logged in to Facebook or Instagram in the same browser, Meta can connect these visits to your Meta account. - We use this only to measure and improve our ads. Meta uses what it receives as its own privacy policy describes, which includes using it to show you ads.
What is stored on your device
Your choice is kept in this site's browser storage until you clear it, so the site doesn't ask again on every page, and a reported signup's random identifier is kept for 7 days, so it is never reported twice. None of this identifies you.
Changing your mind
Use "Your privacy choices" at the bottom of any page. Turning it off stops the pixel at once, deletes the Meta cookies and storage entries it left on this site, and stops any later signup from this browser being reported. It can't delete what Meta already received; Meta's privacy policy explains how to ask Meta.
Why we use it
In the game
- Your game account, characters and gameplay are used to provide the game you play: to keep your progress and run the shared world. The legal basis is the performance of our contract with you, these terms (GDPR Article 6(1)(b)).
- Sessions, IP addresses and server logs are used to keep you signed in and to keep accounts and the service secure, and reports and blocks to keep offensive names out of the world and let you hide players you don't want to see. The legal basis is our legitimate interest in a secure, safe game (GDPR Article 6(1)(f)).
- Google Play reward records are used only to give you the reward once, to the right account, and to prevent fraud. The legal basis is the performance of our contract with you for giving you the reward (GDPR Article 6(1)(b)), and our legitimate interest in preventing fraud for checking it and keeping its record (GDPR Article 6(1)(f)).
- Crash and error reports are used only to find and fix faults in the game. The legal basis is our legitimate interest in a game that works (GDPR Article 6(1)(f)).
On this website
- Your email address is used only to confirm it and, once you have, to send you news about ASCII Realms, including when it launches. The legal basis is your consent (GDPR Article 6(1)(a)), which you give by submitting the form and confirm with the code or link.
- Where you signed up and your country are used only to count, in total, how many people sign up from each country and through each form. The legal basis is our legitimate interest in understanding our audience (GDPR Article 6(1)(f)); we never use them to identify you or to target you.
- The technical details of a visit are used only to deliver the site and keep it secure. The legal basis is our legitimate interest in running a working, safe website (GDPR Article 6(1)(f)).
- Error reports are used only to find and fix faults in the site, on the same basis: our legitimate interest in a website that works (GDPR Article 6(1)(f)).
- Ad measurement is used to measure and improve our ads on Meta's services. Outside the United States and Canada (other than Quebec) the legal basis is your consent (GDPR Article 6(1)(a), and for the cookies the ePrivacy rules on storing information on your device), which you give by choosing "Allow" and can withdraw at any time. In the United States it runs unless you opt out. In Canada outside Quebec, the pixel runs with the notice and opt-out described above, as the Privacy Commissioner of Canada's guidelines on online behavioural advertising describe for non-sensitive information.
Giving your address is entirely optional: without it you simply don't get updates, and the site works the same whether or not you allow ad measurement. We don't sell your information or make automated decisions about you, and we use your email address for advertising only as Ad measurement describes. Ad measurement shares information about your visit (and, where it applies, your signup) with Meta for advertising, which some US state privacy laws call "sharing" or "targeted advertising". You can opt out of it with "Your privacy choices" or by sending Global Privacy Control, which we honor as an opt-out.
Who else handles it
Our service providers handle information for us, and only to provide their services to us: hosting our servers, database and website, delivering network traffic and content updates, sending our emails, monitoring errors and, on the website, checking for bots.
Apple and Google handle the sign-in when you choose Sign in with Apple or Google, on their own pages and under their own privacy policies. On Android, Google (Google Play) gives the pre-registration reward and handles any payment, under its own terms and privacy policy; our server tells Google nothing about your account.
While ad measurement runs, Meta receives the information described under Ad measurement: Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland) if you are in the EU or the EEA, and Meta Platforms, Inc. elsewhere. For visitors in the EU and the EEA, we and Meta Platforms Ireland Limited are joint controllers for collecting that information on this site and sending it to Meta, under Meta's Controller Addendum to its Business Tools Terms; Meta alone is responsible for what it does with it afterwards, as its privacy policy explains, including the legal basis and how to exercise your rights with Meta. You can also exercise them with us, and we'll pass your request to Meta.
If you sign up with our form on Facebook or Instagram, Meta collects what you enter in that form on its services and passes it to us, under its Lead Ads Terms. Of what Meta passes, we keep only the email address.
We don't share your information with anyone else unless the law requires it.
Where it is stored
Ithoro LLC is based in the United States. We and our service providers store the information described here in North America, most of it in the United States, and requests to the game and this site may pass through data centres around the world on their way to us. For players and visitors in the EU, the UK and Switzerland, these transfers rely on a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or approved contractual safeguards such as the European Commission's Standard Contractual Clauses with the relevant UK or Swiss provisions; the mechanism depends on the provider. Contact us for the one that applies and a copy of the safeguards.
While ad measurement runs, what Meta receives may be processed in the United States and other countries where Meta operates; Meta's privacy policy describes the safeguards it relies on for those transfers.
How long we keep it
In the game
- Your account and characters: We keep your game account, its characters and their progress until you delete them. We don't yet delete guest accounts that are no longer played, so a guest account stays until it is deleted.
- Sessions: We keep session records no longer than your account.
- Reports and blocks: A report is kept until the reporting account, or the reported character or its account, is deleted, and a block until either account is deleted or the block is removed.
- Google Play reward records (Android): We don't delete them: without them, the same purchase could be claimed again. When your account is deleted, they lose their link to it and Google's order number.
- Server logs: We haven't yet set a fixed period after which our servers' request logs are deleted.
- Crash and error reports: up to 90 days, then they are deleted.
- Backups: Each backup of the game database is deleted 2 days after it was made.
On this website
We keep your address for as long as you stay on the list. When you unsubscribe or ask us to remove it, we delete it from the list. The database keeps a recovery history for up to 30 days, so a removed address can remain in that history until it ages out. If we stop sending ASCII Realms updates, we will delete the list.
Error reports are kept for up to 90 days, then deleted.
While ad measurement runs, the _fbp cookie lasts 90 days, and your choice stays in your browser
until you clear it. What our server sends Meta about a signup is kept only until Meta accepts it (at most 24 hours); after that we keep only that it was reported, for 30 days. Meta keeps what it received as its privacy policy describes.
Deleting your account
You can delete your ASCII Realms account at any time: choose Delete account in the game, or email support@asciirealms.com. That deletes your game account with everything it owns: its characters and their progress, its cosmetics, its sessions, the reports and blocks it made or that name it, and its link to your Ithoro login. You can choose to delete your Ithoro login at the same time. Our account deletion page shows the steps.
After a deletion we keep only:
- crash and error reports that name your account's identifier, for up to 90 days;
- server logs, as described under How long we keep it;
- database backups, until they are deleted 2 days after they were made;
- a record that the deletion happened, with no link to any account, so the game can confirm it, kept 30 days, then deleted within a day;
- Google Play reward records, with no link to any account, so the same reward can't be claimed again;
- if you deleted an Ithoro login that signs in with Apple, what is needed to end Sign in with Apple, for at most 30 days;
- your Ithoro login, unless you delete it too.
Your choices and rights
- Delete your characters or your account in the game at any time (Deleting your account).
- Unsubscribe at any time. Every update will include a way to unsubscribe, and you can ask us at support@asciirealms.com to remove your address. Withdrawing consent doesn't affect anything done before you withdrew it.
- Access, correction, deletion and more. Depending on where you live, you may have the right to a copy of your information, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable format. Write to support@asciirealms.com. Requests cost nothing, and we answer within the time the law requires (generally one month under the EU and UK GDPR). We may need to check that the request comes from you.
- Complaints. You can complain to the data protection authority where you live, work or believe an infringement happened, without contacting us first: in the EU through the European Data Protection Board's list of authorities, in the UK to the Information Commissioner's Office, in Switzerland to the Federal Data Protection and Information Commissioner.
- Ad measurement, Do Not Track and Global Privacy Control. You can turn ad measurement off, or decline it, at any time with "Your privacy choices" at the bottom of any page (Ad measurement). If your browser sends Global Privacy Control, we treat it as an opt-out of sale and sharing, keep the pixel off wherever you are and don't ask. We don't respond to Do Not Track separately.
Children
The game and the updates list are not meant for children under 13, or the higher minimum age required by the law where you live. If you are younger, please don't play or sign up. If you think a child has an account or has signed up, contact us and we'll delete it.
Security
The game and this site send everything to us over encrypted connections, and we use technical and organisational measures to protect what we hold. We collect only what the game and the list need. No way of sending or storing information is perfectly secure, so we keep what we hold to a minimum.
Changes to this policy
If this policy changes, the new version will appear here with a new effective date. If a change would use your address for something new, we'll ask for your consent first.
Contact
Ithoro LLC
169 Madison Avenue, Suite 38015, New York, New York 10016, United States
support@asciirealms.com