Privacy Policy
This policy explains what personal data the game Elunor (the game, its website sunsigil.dev, the SunSigil account at account.sunsigil.dev and its servers) collects, why, how long it is kept and the rights you have. It is written to meet the UK General Data Protection Regulation and Data Protection Act 2018 (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).
1. Who is responsible
The data controller is SunSigil.dev, the studio that makes Elunor ([legal name of the operator], [postal address]). Contact for anything in this policy: privacy@sunsigil.dev. If we appoint a representative in the UK or the EU, their details will be listed here.
2. What we collect and why
- Data
- A device identifier: a one-way hash of your device's ID (Android ID, or on Windows the machine ID). The raw ID never leaves your device.
- Why
- It is your login: it lets the same device return to the same character.
- Legal basis
- Contract (providing the game)
- Data
- Sign-in details, if you link an account: your email address and a salted password hash, or the account ID and display name a provider (Google, Microsoft, Discord, Steam, Twitch, Facebook) shares with us.
- Why
- So you can reach your character from other devices and recover it.
- Legal basis
- Contract
- Data
- Your SunSigil account, if you make one: your email address, a salted password hash (never the password itself), whether you confirmed the email, and the character it plays. While you are signed in on account.sunsigil.dev we keep a record of each signed-in browser: a one-way hash of its sign-in token and when it ends. The 6-digit codes we email you are kept only in the server's memory for 15 minutes, and the one-time code that signs a game in for 2 minutes.
- Why
- To run your account, sign you in to our games with one click and let you recover a forgotten password.
- Legal basis
- Contract
- Data
- Sign-in security: the IP address a sign-in, registration or password request comes from, and how many wrong passwords were tried for an email address. They are counted only in the server's memory, for a few minutes, and never written down.
- Why
- To stop people guessing passwords or flooding the service.
- Legal basis
- Legitimate interests (a secure service)
- Data
- Your profile from character creation: first name, surname, date of birth, your language, the game language, and which agreements you accepted and when.
- Why
- To check you are old enough to play, to keep a record of your consent, and to contact or verify you if your account needs support. It is never shown to other players.
- Legal basis
- Contract; legal obligation (age and consent records)
- Data
- Your character: its name, body, position, progress, items, coins, land and buildings, and messages you send in game.
- Why
- To run the game world and keep your progress.
- Legal basis
- Contract
- Data
- Technical and security data: IP address, connection times, game version, and integrity checks of the game files on your device (a fingerprint of the installed files, whether a debugger or modified files are present, whether several copies run).
- Why
- To keep the servers running, stop cheating, bots and abuse, and handle appeals against suspensions.
- Legal basis
- Legitimate interests (a fair and secure game)
- Data
- Purchases of credits: an order or payment reference, the item and the amount. Card and bank details go to Google Play or Stripe only; we never see them.
- Why
- To deliver what you bought, handle refunds and keep the records tax law requires.
- Legal basis
- Contract; legal obligation
- Data
- Appeal messages you send us.
- Why
- To review a suspension.
- Legal basis
- Legitimate interests
- Data
- Emails you send us (for example to support@sunsigil.dev or privacy@sunsigil.dev): your address, the message and our reply. Emails we send you from noreply@sunsigil.dev (your codes and account notices) are not kept after they are sent.
- Why
- To answer you and keep a record of the conversation.
- Legal basis
- Legitimate interests; legal obligation where a request concerns your rights
- Data
- Visits to our website, sunsigil.dev: your IP address and the page asked for, used by the web server only to send the page. We keep no access logs, use no analytics, and load fonts and images from our own server, so no third party learns of your visit.
- Why
- To show you the website.
- Legal basis
- Legitimate interests
We do not sell your data, we do not show advertising, and we do not use your data for profiling or automated decisions with legal effect. Anti-cheat checks may flag an account; a suspension can always be appealed and is reviewed by a person on request.
3. Streamer mode
Streamer mode keeps your real name, birthday, email address and position out of a stream or recording. On Windows the game asks the system to leave that text out of screen captures; on phones and in the browser it is shown as dots. It is on by default on phones and in the browser, and turns on by itself on a PC while streaming software runs. The game checks only the names of running programs for this, on your device; nothing about them is sent to us.
4. Who we share it with
- Our hosting provider, which runs the game servers, the database, the website and our email in the European Union (OVHcloud, France).
- Payment providers: Google (Google Play Billing) on the Play Store version, Stripe elsewhere - only for purchases you make.
- The sign-in provider you choose, when you sign in with it. The SunSigil account is our own: signing in with it shares nothing with anyone else.
- Google Play Integrity, on Android, to check the app is genuine.
- Authorities, if the law requires it.
Other players see only your character name, your character and what you do in the game world.
5. International transfers
Our servers are in the EU. Some providers (Google, Stripe, sign-in providers) may process data in the United States or elsewhere. Where that happens the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework and the UK extension to it) or by standard contractual clauses / the UK International Data Transfer Addendum.
6. How long we keep it
- Your account, character and profile: while your account exists. If you ask us to delete your account, we delete them within 30 days, apart from the records below.
- An account not used for 3 years may be deleted after we try to warn you.
- A signed-in browser on account.sunsigil.dev: 30 days, or until you sign out, change your password or delete the account.
- Purchase records: as long as tax and accounting law requires (up to 10 years, depending on the country).
- Security logs and anti-cheat records: up to 12 months; suspension records for as long as the suspension and any appeal last.
- Emails you send us: up to 2 years after the conversation ends, unless a request about your rights needs keeping longer.
7. Your rights
Under UK and EU law you can ask to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where we rely on consent you can withdraw it at any time (for example, game news). With a SunSigil account you can do two of these yourself at account.sunsigil.dev: "Download my data" saves a copy of what your account and character hold about you (a JSON file), and "Delete account" removes your sign-in at once and has your character erased within 30 days. For anything else, write to privacy@sunsigil.dev; we answer within one month. You can also complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU the authority of the country you live in.
8. Children
The game is for players aged 13 and over. Where the law of your country sets a higher age for consenting to online services (up to 16 in some EU countries), a parent or guardian must agree for you. If we learn that a child under 13 has an account, we delete it.
9. Storage on your device
The game keeps settings (such as volume, the dark theme and Streamer mode) and downloaded game content on your device. The browser version uses local storage and a service worker for the same reasons, the website remembers only your choice of light or dark theme, and account.sunsigil.dev sets one cookie that keeps you signed in. These are strictly necessary or kept at your own request; we use no advertising or tracking cookies. Our Cookies Policy (sunsigil.dev/elunor/cookies/) lists each one.
10. Security
Connections to our servers, website and email are encrypted (TLS), passwords are stored only as salted hashes, and access to the servers is limited to the operator. Account pages cannot be shown inside another website, accept requests only from our own pages, and ask for your password again before an account is deleted.
11. Changes
If we change this policy in a way that matters, we tell you in the game before the change takes effect and, where the law requires, ask you to agree again.