The short version
- We keep an account name, a password (only as a scrambled hash), an email address, and what your characters do in the game.
- Your email is only used to confirm your account and reset your password. Other players never see it. We do not sell data and we do not run advertising.
- You must be 13 or older to play.
- You can ask us to delete your account at any time.
Who we are
Hallowmyr is a small, independent browser game run by its owner. "We" means the people who run Hallowmyr. Contact: the Hallowmyr Discord, /bug in the game, or CONTACT_EMAIL.
What we collect, and why
| Data | Why, and what it holds | Kept |
|---|---|---|
| Account name | To log you in. Your character names are shown to other players; your account name is not, except to game masters. | Until the account is deleted |
| Password | To log you in. We never store the password itself, only a salted scrypt hash that cannot be turned back into it. | Until the account is deleted or you change it |
| Email address | To confirm your account and to send a password-reset link. It is stored in lower case. It is never shown to other players or written to the game's logs. Game masters see only a masked form (for example a***@e***.com). | Until you remove it or the account is deleted |
| Account details | When the account was created, whether the email is confirmed, and which version of these terms it was created under. | Until the account is deleted |
| Characters and game progress | To run the game: level, class, appearance, items, gold, quests, guild, home and so on. Parts of this are public inside the game (name, level, class, guild, title, the Legend). | Until the character or account is deleted. A deleted character is held in an archive for 30 days so a game master can restore it, then purged. |
| Settings | Your keybindings and game options are saved to your account so they follow you between devices. | Until the account is deleted |
| Letters and market listings | In-game mail and market offers are stored on the server so they can be delivered. Unclaimed enclosures return to the sender after 30 days. | As described, or until the account is deleted |
| Chat | Chat is delivered live and is not saved to a log. Your own client keeps the last few lines it received in memory only. If a player is reported, the lines from them that the reporter saw (up to 12) are saved with the report. | With the report (below) |
| Reports about players | To moderate: who reported whom, the reason typed, and the recent chat lines. Guilds and in-game offices never see reports; only the people who run Hallowmyr do. | Deleted 90 days after they are filed |
| Bug reports, suggestions and help requests | To fix things. A report includes what you typed, your account and character name, level and class, where you were in the world, your browser or app name, screen size, frame rate and recent game error messages. If you attach a screenshot, an image of the game window is uploaded too. Please do not type secrets into a report. Replies come back to you in the game and by letter. | Deleted 90 days after the report is resolved or closed (with its screenshot) |
| IP address | To limit abuse: login attempts, account creation and password-reset requests are counted per IP address. These counters live in the server's memory for a few hours and are not written to the save file or the game's records. Our hosting providers (below) necessarily see IP addresses, as any web host does, and we pass your IP address to Cloudflare Turnstile when you create an account. | Server memory, a few hours |
| Game records | An audit trail of economy events (item and gold moves, trades), account events (such as "account created", "password changed", "email confirmed") and every action by a game master. They identify accounts and characters by internal ID. They do not contain passwords, email addresses or chat. | Rotated files; the oldest are deleted automatically |
| Backups | A nightly copy of the server's save data, so a failure does not lose everyone's progress. It contains everything above. Backups are kept for about 14 days, so deleted data can remain in a backup for up to that long. | About 14 days |
What other players can see
- Your character's name, level, class, appearance, title, guild and what you choose to share, including your Inspect panel and the Legend.
- The public Who's online list on this website shows character name, level, class and title for players who are online. You can opt out in the game under Esc, Settings ("Show me on the website": Hidden). You are then still counted but not named.
- Never your email address, password or account name.
Who else handles your data
- Oracle Cloud hosts the game server and its saves.
- Cloudflare hosts this website and provides the Turnstile bot check when you create an account. Turnstile runs in your browser and looks at your browser and IP address to tell people from bots, and may set its own identifiers; see Cloudflare's privacy policy. The website may also use Cloudflare's privacy-friendly web analytics.
- Resend sends our account emails (confirmation and password reset). It receives your email address and the message.
- Google Fonts serves the typefaces on this website, so your browser contacts Google when you open a page here.
- GitHub holds the game's source code and website and the downloads of the desktop app. Your game data is not stored there.
- Discord is where the community talks. It is a separate service with its own privacy policy.
We do not sell your data, we show no advertising, and we share your data with nobody else unless the law requires it.
Cookies and browser storage
The game and this website set no tracking cookies of their own. The game stores a few things in your browser so that it works:
- Local storage (stays on your device): your account name if you tick "Remember me"; your settings and sound levels; and whether you have dismissed the alpha notice and the first-time tips.
- Session storage (this tab only, gone when you close it): a one-use session token that logs you back in after a reload or a game update, and your last chosen character.
Clearing your browser data removes all of this. The Windows launcher (the desktop app) is a window around the same game and keeps the same kind of storage in its own profile folder on your PC.
Your choices and rights
- See or export your data: ask us and we will send you what we hold about your account.
- Correct it: change your email and password under Esc, Settings, Account.
- Delete it: in the game, Esc, Settings, Account, "Delete my account". Your account is deleted 14 days later with its characters, letters and email; logging in during those 14 days cancels it. The same page has "Download my data". You can also contact us (CONTACT_EMAIL, the Discord, or
/bugin the game). A few things outlive deletion for a short while: backups (up to about 14 days), and entries in game records that carry only an internal ID. Reports you made about other players may be kept where needed to keep the game fair. - Remove your email: you can do this in the game; you then cannot reset your password by email.
If you live in the UK or the EU you also have the usual rights to access, correct, delete, restrict and object, and to complain to your data protection authority. Contact us first and we will do our best to put things right.
Children
Hallowmyr is for people aged 13 and over. Do not create an account if you are younger. If we learn that an account belongs to someone under 13, we will delete it. If you are a parent and think this has happened, please contact us.
Security
Passwords are hashed with scrypt, links in emails work once and expire, and sign-in attempts are rate-limited. No system is perfectly safe, and this is an alpha: use a password you do not use anywhere else.
Alpha test
Because Hallowmyr is an alpha, saves can be wiped or moved and how we handle data may change as we build things like account deletion. If something important changes, we will say so in the News and update the date below.
Changes to this notice
We may update this notice. The date at the bottom shows the latest version.
Contact
The Hallowmyr Discord, /bug (or Esc, "Report a bug or idea") in the game, or CONTACT_EMAIL.
Last updated 2 November 2026. Version 2026-11-02.