Thousandvale — what we keep about you
A small test game run by one person on one computer. This page says, in plain words, what is stored, for how long, and how to have it removed. Last changed 2026-10-06.
Short version: no sign-up, no real name, no payment, no ads, no tracking. You get a random sign-in key that stays in your browser. We keep your characters and your progress, chat for 30 days (so reports can be checked), and backups for 14 days. If you claim your account we also keep your username, a scrambled copy of your password and, only if you type one, an email address.
What is stored
| What | Why, and how long |
|---|---|
| A random sign-in key (guest token) | A random 256-bit key kept in your browser's local storage so you are signed in next time. The server stores only its SHA-256 fingerprint (hash), never the key itself, so a leaked database cannot be used to sign in. A guest account keeps it for good (that is how a guest gets back in); a claimed account drops it when you log out on that browser. Clearing your browser data loses a guest account unless you claimed it. |
| Username and password (only if you claim your account) | The username you pick, and the password stored only as a slow, salted scrypt hash; nobody can read it back, and it is never logged. If you forget it, the game's keeper gives you a reset code in game. Kept until the account is deleted. |
| Email (optional, claimed accounts only) | Only if you type one when claiming. It is used for nothing except helping you get back in when you forget your password; the game sends no email by itself. Kept until the account is deleted. |
| Characters | Name, class, look, level, experience, gold, where you stood, gear, bag, quests and other progress. Kept until the account is deleted. |
| Save journal | Small records of item and gold changes, written every couple of seconds so a crash loses almost nothing. Cleared each time your character is fully saved (within minutes). |
| Account times | When the account was made and last signed in. |
| Chat | Every line said on any channel (say, party, guild, zone, trade, world, whispers), with who said it and when. Logged for 30 days so a report can be checked, then deleted automatically. |
| Friends, ignore list, guild, mail | What you set up in game, including items and gold sent by mail while they wait to be taken. Kept until you change it or the account is deleted. Mail you sent stays with the person who got it. |
| Reports | When someone reports a player: who reported whom, the reason, and the reported player's last chat lines (up to 20), so the keeper can check it. Kept until the report is dealt with and cleared. |
| Feedback | When you send a suggestion or a bug report from the Feedback button: what you wrote, your account and character (name, class, level), where the character was standing, and the last lines of the game's own log in your browser (up to 60), so a bug can be found. The game's admins read these reports. Kept until an admin clears it. |
| Bans | A ban stores the account and a salted one-way hash of the internet address, never the address itself. Kept for the length of the ban. |
| Game totals | Hourly totals of gold and items entering and leaving the game, by level band. No names; kept for balancing. |
| Server logs | Technical messages (start, stop, errors, logins counted, admin actions), without passwords, keys or chat text. Kept a few weeks by the operating system, never shared. |
Your internet address
The server sees your internet address (IP) while you are connected and uses it, in memory only, to limit how many connections and new accounts one address can make. It is not written to the database (a ban keeps only a salted hash, above). Server logs may contain it; the machine keeps logs for a limited time and they are never shared.
The link reaches this computer through Cloudflare, which therefore also sees your address and the pages you load, under Cloudflare's privacy policy. If a human check (Cloudflare Turnstile) is switched on, it runs Cloudflare's script when a new account is made. The game's lettering is served from this computer, not from a font company.
Backups
The database is copied every hour (copies kept 48 hours) and once a day (copies kept 14 days). A nightly copy may also be stored with a cloud storage company (Amazon S3 or Cloudflare R2), encrypted, and deleted after 14 days. So anything deleted from the game is gone from every copy within 14 days.
What we never do
- Sell or share your data.
- Ask for a real name, a birthday, a phone number or payment. (An email is only ever optional, when you claim an account.)
- Use cookies, ads, analytics or tracking pixels.
Your choices
- Play as a guest and nothing about you beyond the game itself is kept.
- Claim with a username only — the email is optional.
- Have your account and everything in it deleted (below).
Deleting your account
Ask the game's keeper (whisper them in game) or the person who sent you the link, and say your character's name. The account, its characters, mail, friends and guild membership are deleted within 7 days; your chat lines go with them (or age out after 30 days); backups age out within 14 days.
Children
This test is not meant for children under 13. If you think a child has made an account, ask for it to be deleted as above.
Thousandvale is an independent project by Radley Sustaire. This note will change if the game changes; the date at the top says when it last did.