This policy explains what personal data the ForgottenL website and game server (the “Service”) collect, why, how long we keep it and what rights you have. It follows the EU General Data Protection Regulation (GDPR). The controller of your data is the ForgottenL team; see Contact below.
Data we collect
- Account data: account name, e-mail address, nickname, a hash of your password (we never store it in plain text), recovery key hash, creation date, premium and donation-point balance, optional avatar and profile information.
- Character and game data: character names and attributes, items, guild membership, deaths, chat on public channels, last login time and the IP address used to log in.
- Content you post: forum posts, comments, polls votes and messages.
- Technical data: IP address, browser details and requested pages in server logs; a short-lived record of your IP address used to limit login and registration attempts.
- Payment data (when donations are enabled): a payment reference, amount, date and status supplied by the payment provider. We never see or store your card or bank details.
Why we use it and on what legal basis
- To create and run your account and let you play and use the forum (performance of the agreement you accept with the Terms – Art. 6(1)(b) GDPR).
- To keep the Service secure, prevent cheating, fraud and abuse, enforce the Rules and investigate attacks (legitimate interest – Art. 6(1)(f)).
- To process donations, keep accounting records and answer support requests (contract and legal obligation – Art. 6(1)(b) and (c)).
- To send you account e-mails such as password recovery or important notices. We do not send marketing e-mails.
Cookies
We use only one strictly necessary session cookie (FLSESS) to keep you logged in and protect forms against forgery. It is deleted when you close the browser or log out. We do not use advertising, analytics or tracking cookies, so no cookie banner is required. The site does not load third-party scripts, fonts or trackers.
How long we keep it
- Account, character and forum data: while your account exists. Deleted accounts are removed from the live database; copies in backups disappear within 14 days.
- Web server logs (including IP addresses): up to 14 days.
- Login and registration rate-limit records: 24 hours.
- Database backups: 14 days.
- Payment and accounting records: as long as the law requires.
Who receives your data
We do not sell your data. It is processed on servers of our hosting provider, which acts as our processor. If donations are enabled, the payment provider receives the information needed to process the payment. Staff only access personal data when needed to run the Service. We may disclose data if the law or an authority requires it, or to protect the Service and its users. Your nickname, character name, level and public posts are visible to other players and visitors.
Transfers outside the EU/EEA
We host the Service in the European Union and do not intentionally transfer your data outside the EU/EEA. A payment provider may do so under its own safeguards.
Your rights
You can ask us to give you access to your data, correct it, delete it, restrict or object to its processing, or give you a copy in a portable format. You can withdraw any consent you gave at any time. To use these rights, or to have your account deleted, contact us below and we will answer within one month. You also have the right to complain to your national data protection authority.
Security
The Service uses encrypted connections (HTTPS), hashed passwords, access controls, limited access for staff and regular backups. No system is perfectly secure; choose a long, unique password and keep your recovery key private. If a breach affects your rights we will notify you and the authorities as required by law.
Children
The Service is not intended for children under 16 without parental consent where required. If you believe a child has registered without consent, contact us and we will delete the account.
Changes
We may update this policy; the date above shows the latest version. We will announce important changes on the website.
Contact
For privacy questions and requests, contact the ForgottenL staff listed on the Support List (in game or through the forum).
See also: Terms of Service · Donation Terms · Game Rules.