DRAFT, not yet in force. This text is waiting for the owner's approval and may still change.
Privacy Policy
This policy explains what personal data ArionRO handles, why, for how long, and what you can
do about it. It covers the website (ro.arionword.com), the browser game client
(play.arionword.com), the desktop game client, and support by email and Discord.
Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is Toms,
the private individual who runs ArionRO, based in Latvia. Contact for anything in
this policy: support@arionword.com.
What we collect, why, and for how long
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Account: username, password (stored only as a hash, never readable), gender of the character model, email address if you give one, account number, creation date | To run your account and the game | Contract (Art. 6(1)(b)) | Until you ask us to delete the account |
| Pre-registration: email, reserved character name, IP address | To hold your name and tell you when the server opens | Contract; your request to be notified | Until launch; the email is used for the launch notice and account matters only |
| Security logs: IP address at registration, voting and login, failed login attempts, the address your game connection comes from | Stopping bots, brute-force attacks, multi-account and voting abuse | Legitimate interest (Art. 6(1)(f)): keeping the service secure | 180 days |
| Game chat: public, party, guild and whisper messages | Investigating reports of harassment, scams and cheating | Legitimate interest: enforcing the Code of Conduct | 90 days |
| Browser client errors: the error text and where in the client it happened, your account number and character name, the map, the client version, your browser name and IP address (never your password or what you type) | Finding and fixing bugs in the browser game client quickly | Legitimate interest (Art. 6(1)(f)): a game that works | 30 days |
| Game activity: characters, items, zeny, trades, vending, quests, staff commands | Running the game, restoring items after bugs or scams, catching duplication | Contract; legitimate interest | Game data while the account exists; trade and item logs 12 months |
| Votes on server listing sites: your account number and the time (sent back to us by the listing site), your IP address | Giving vote rewards once per 12 hours | Contract; legitimate interest against vote fraud | Vote history while the account exists; IP 180 days |
| Premium purchases: order number, amount, date, your email and country, payment status (no card or bank details: the payment provider keeps those) | Delivering what you bought, refunds, chargebacks | Contract; legal obligation (bookkeeping) | As long as Latvian accounting law requires |
| Support messages you send us | Answering you | Legitimate interest; contract | Up to 2 years after the conversation ends |
We do not sell data, show ads, use analytics or tracking cookies, or build marketing
profiles. We send email only about your account, purchases, and the server launch you
signed up for.
Cookies and browser storage
- arion_session: one strictly necessary cookie that keeps you logged in on the website (14 days, encrypted). No consent banner is needed for it, and there are no other cookies.
- The browser game client stores game files and your game settings in your browser's storage so the game loads faster next time. This stays on your device; you can clear it in your browser settings. Your hotkey layout is also saved on our server so it follows you between devices.
Who else processes data for us
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Server hosting (website, game, database) | EU |
| Backblaze, Inc. | Encrypted backups, kept 30 days | EU data centre (Amsterdam) |
| Cloudflare, Inc. (Turnstile) | Checking that the person registering is not a bot; sees your IP and browser signals on the register and pre-register pages | USA / global, EU-US Data Privacy Framework |
| ImprovMX and Google (Gmail) | Receiving and storing support email | USA / EU, Data Privacy Framework or Standard Contractual Clauses |
| Resend | Sending account and purchase emails | EU sending region; US company, Data Privacy Framework |
| Stripe, PayPal | Taking Premium payments (they are also controllers for the payment data they collect) | EU / USA, Data Privacy Framework or Standard Contractual Clauses |
| Discord | Community and support chat, if you use it (Discord's own privacy policy applies) | USA |
Server listing sites you vote on are separate services with their own policies. Backups
are encrypted before they leave our server, so a deleted account can survive in a backup
for up to 30 more days and then disappears.
Your rights
You can ask us to access your data, correct it, delete it, restrict or
object to how we use it, and get a copy in a portable format. Write from the email
on your account (or tell us your account name and prove it is yours) to
support@arionword.com. We answer within one month.
Deleting an account removes its characters and items for good. Some records stay longer
where we must keep them (bookkeeping for purchases) or where they show a rule was broken
(a ban and its reason), and only for that purpose.
If you think we handle your data unlawfully, you can complain to the Latvian Data State
Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or to the
data protection authority where you live.
Age
ArionRO is for players aged 13 and over. If you believe a child under 13 has an
account, tell us and we will delete it.
Security and automated blocks
Passwords are stored only as hashes. The website and game traffic are encrypted (HTTPS and
secure WebSockets). Repeated failed logins from one address trigger an automatic temporary
block of that address; this is a security measure, not a decision about you, and it ends
on its own. Anti-cheat signals are always reviewed by a person before an account is
penalised.
If a data breach is likely to put you at risk, we tell the supervisory authority within
72 hours and tell you without undue delay.
Changes
We announce changes to this policy on the website before they take effect. The date at the
top shows the current version.