Edrath Online Privacy and Storage Notice

1. Who is responsible and how to contact them

MistByte AB is the controller responsible for the personal information described in this notice. We are registered in Sweden under organisation number 559425-7734 at Tornavägen 3, 241 33 Eslöv, Sweden. Contact support@mistbyte.se for privacy requests, including when you cannot sign in. This notice explains data handling separately from the game rules: accepting the Terms of Service does not give consent to optional device storage or every use of personal data.

You can email support@mistbyte.se without creating an account or signing in, including if you are a guardian or cannot access your account. The signed-in Help tools also accept private player reports. Do not send passwords, account tokens, or identity documents in an initial request, or post them publicly. Only provide information reasonably needed to understand your request; any necessary identity checks must use an appropriate private follow-up.

2. Information the service handles

Account information includes your chosen username, email and any pending email, password hash, verification and recovery records, account creation and login information, selected character, account permissions, and the terms version and time you accepted. Authentication also uses session and token records. The application hashes passwords rather than storing the original password as an account field; this is not a guarantee that every communication you enter elsewhere is secret.

Game information includes characters, names, portraits, skills, progression, equipment, inventories, purchases within the game economy, trades, guilds, friendships, block lists, presence, and other actions needed for the persistent world. Player content includes supported chat, direct messages, in-game mail, player-authored names, and reports or feedback you submit.

Technical and security information includes request and connection data, IP addresses processed for network delivery and abuse controls, and operational logs. A submitted player report can include diagnostic context such as browser user agent, language, timezone, viewport, game route, build and request identifiers, connection status, and recent activity or error codes. Automatic report diagnostics omit chat transcripts and unrestricted logs, but text you type into a report can still contain personal information.

Gameplay analytics use internal account, character, and session identifiers with events and summaries about activity, progression, the economy, combat, and social features. These records are pseudonymous: the identifiers can link records back to an account, so they must not be described as anonymous. The current application does not include an advertising tracker or an official payment processor. If paid products or additional data collection are introduced, the notice and relevant collection flows must be updated first.

3. Sources, purposes, and legal grounds

Information comes from what you provide, your use of the game and its communication features, your device and network requests, and other players' interactions or reports involving you. Service providers can generate delivery, reliability, or security records while carrying out their role. A report from another player is an allegation to assess, not automatically an established fact.

The purposes include providing accounts and persistent gameplay, authentication and recovery, delivering requested communications, preventing abuse and fraud, reviewing reports, diagnosing faults, balancing and improving the game, reconciling the economy, sending service notices, and meeting applicable legal obligations. Email verification, password recovery, and legal-update messages are service communications. Accepting the terms is not a marketing subscription.

We process account, authentication, requested communications and persistent gameplay data to perform our agreement with you (GDPR Article 6(1)(b)). We rely on legitimate interests (Article 6(1)(f)) for proportionate fraud and abuse prevention, network and service security, fault diagnosis, moderation, and pseudonymous game-balance and service-quality analysis: our interests are a safe, reliable and fair game. These interests must be weighed against your rights, including the interests of younger players; you can object through support. Optional device persistence relies on your separate consent (Article 6(1)(a)), which you can withdraw. Where a specific law requires records or disclosure, the relevant processing relies on that legal obligation (Article 6(1)(c)); this is not a general permission to retain everything.

Registration requires an email, username, password, and eligibility and terms confirmation. Without the required information the account cannot be created. You can browse public pages without an account. Public browsing still involves network requests, and voluntarily using chat, reports, and social features creates additional records. Where processing relies on consent, withdrawal must be as accessible as giving it and does not undo processing that was lawful before withdrawal.

4. What other people can see

Public character pages can be viewed without signing in and show game details such as character names, portraits, challenge information, builds, skills, equipment, and guild names or tags. Other players can see additional information through supported social features, including in-game presence or location and relevant market or ranking details. Treat public game identities as public and choose a pseudonym that does not reveal sensitive real-world information.

Messages are visible to the participants or channel audience, and recipients can copy or redistribute them. Direct messages, guild chat, and in-game mail are not end-to-end encrypted and should not be used as a confidential storage service. Authorized administrators can access reports, and service records may be reviewed for support, safety, security, or legal purposes. Blocking communication does not make public character information private or erase existing copies.

Passwords, authentication secrets, and contact email addresses are not intended as public profile fields. Do not place them in names, chat, screenshots, mail, or report text. Other players' copies and independent websites are outside the operator's direct control; a request to remove information from Edrath cannot guarantee removal from the entire internet.

5. Service providers, disclosures, and international transfers

Railway Corporation provides our application hosting and the hosted database, cache and monitoring services. Production application hosting is in California, United States. Traffic may pass through other Railway network locations; a nearby European edge does not mean the data is stored only in Europe. We use one.com (One.com Group AB, Sweden) to deliver verification, recovery and service emails, including the recipient address and message content needed for delivery. These providers receive the information needed for their roles; player content is disclosed to its intended audience as described above.

one.com states that EU customers' data is hosted in Denmark. Its Data Processing Agreement at https://www.one.com/en-gb/legal/dpa/ also lists subprocessor locations, including outside the EEA; Danish hosting does not mean all processing or access stays in the EEA. Its GDPR information is available at https://help.one.com/hc/en-us/articles/360000253649-How-does-one-com-comply-with-the-GDPR.

Railway publishes its Data Processing Addendum at https://railway.com/legal/dpa, including EU Standard Contractual Clauses and international-transfer provisions, and its subprocessor information through https://trust.railway.com. Processing outside the EEA requires an applicable transfer mechanism and appropriate safeguards. You can contact support@mistbyte.se for information or a copy of the safeguards applicable to your data, including email delivery. A provider’s published agreement or this notice is not, by itself, proof that a particular transfer is protected.

Information may also need to be disclosed in response to a valid legal requirement, to address a substantiated security or safety matter, or to establish or defend legal claims, subject to necessity and applicable protections. A business transfer does not create unrestricted permission to sell or repurpose personal information. Any materially different use, new recipient, or required choice must be addressed before that processing begins.

6. Storage periods and deletion limits

Accounts and persistent gameplay records do not have a general automatic inactivity expiry in the application. They remain until an applicable deletion or retention process acts on them. Account settings offer deletion with a seven-day cooling-off period; its confirmation explains cancellation and the effects on your characters and progression. Ending a session, uninstalling the launcher or game client, clearing website data, or abandoning an account does not itself delete server records.

The game's chat history targets seven days for direct messages and custom channels, thirty days for guild chat, and twenty-four hours for global chat, with each stored channel also capped at five hundred messages. Zone and party chat do not have persistent history in the chat system. These history limits do not erase copies made by recipients, information submitted in a report, or separate lawful investigation records. Mail and reports do not share those chat expiry rules.

Stored gameplay event categories have maximum retention targets of thirty days for combat damage and healing, ninety days for social lifecycle events, rare encounter rolls and combat settlement, and four hundred days for other events; a shorter configured period may apply. Per-account analytics summaries, stored mail records, reports, moderation records, and some audit records do not have automatic time-based record deletion. Mail normally has a thirty-day availability window; expired attachments are processed when relevant mailbox activity triggers a check, which does not mean the stored message is erased. Automated expiry is not necessarily instantaneous physical removal from every storage layer.

Account deletion removes account-owned records through the supported erasure process. Shared free text, relevant reports and audits, other players’ copies and infrastructure backups or exported logs can require separate handling. We retain incident and dispute material only while needed to investigate, protect players or establish, exercise or defend legal claims, subject to applicable law and review. Some shared records are de-identified; remaining free text can still identify a person. Legal-publication text is retained as history. An absence of automatic expiry is not permission to keep personal data indefinitely.

Railway Pro currently makes up to thirty days of logs accessible in its dashboard; this is an access window, not a verified physical-erasure deadline. Application monitoring metrics use a fifteen-day or two-gigabyte retention limit, whichever is reached first. We do not currently run recurring Railway volume backups. Existing snapshots have individual expiry dates and are restricted to recovery use; deleting active records does not immediately remove them from an existing snapshot. Restored data must be checked against completed erasure requests before returning to service.

Email delivery and security records, provider-managed copies and exported logs have separate retention arrangements. one.com's published agreement does not give a fixed deletion period for SMTP delivery records, and a mailbox recovery window is not a delivery-log retention period. We limit copies under our control to their necessary service, recovery, security or legal purpose and review continuing retention. Contact support@mistbyte.se for retention details concerning your data. Session or link expiry ends validity, not necessarily every stored copy.

7. Cookies, local storage, and your device

Edrath sets no application cookies and loads no third-party advertising trackers. Optional browser storage is off until you actively choose it. Accept optional storage, Reject optional storage and individual choices are available in the cookie and storage settings. Refusing optional storage does not prevent registration or play. Terms acceptance is separate from these choices.

Necessary storage: after you request sign-in, session storage holds authentication tokens, account information and selected character for the current tab. Browsers may restore a tab and its session storage; sign out on shared devices. If device storage is unavailable, the current page uses memory. We store your explicit consent or refusal, its policy version and timestamps in local storage for 180 days to honour your choice. Nothing is written to application browser storage on an untouched first visit.

Save interface preferences is optional. It allows local storage of window layouts, keybindings, automatic targeting, detached-window settings and geometry, unread counts, and client-build coordination. Stay signed in is a separate optional choice that allows authentication tokens, account information and selected character to persist between visits. These are first-party functions supplied by MistByte AB; they are not advertising or third-party analytics.

Use Cookie & storage settings on any main website or game page to change or withdraw either choice. Withdrawal removes the corresponding saved local-storage values and prevents further persistence; the current tab can continue in memory and necessary session storage. Older values without a current consent record are removed rather than treated as consent. Choices expire after 180 days; saved optional values are removed when the application next checks the expired choice. Browsers do not independently expire local-storage strings while the site is closed.

Access tokens are valid on the server for fifteen minutes and refresh sessions for thirty days, with renewal during use. Signing out clears application authentication storage. Clearing browser site data can reset your choice and sign you out, but does not delete your server account or other players’ messages. Infrastructure operated by hosting providers must follow the same no-cookie-before-choice policy; deployment verification must check their response headers as well as application code.

8. Access, correction, deletion, and other rights

Depending on the law that applies, you may have rights to receive information and a copy of your personal data, correct inaccuracies, request erasure or restriction, obtain portable data, object to particular processing, withdraw consent, and challenge qualifying automated decisions. These rights have conditions and exceptions; another person's privacy or a lawful retention duty can affect what is supplied or deleted. A request should be assessed on its substance rather than requiring a particular legal phrase.

Email support@mistbyte.se to request access or a copy, correction, erasure, restriction, portability where applicable, or to object to processing. You can do this without an account or when locked out. Account settings also offer self-service deletion. Export and general email correction are handled through support. We use proportionate identity checks and protect other people’s information; do not send identity documents, passwords or tokens in your initial message or post them publicly.

We respond to GDPR rights requests without undue delay and normally within one month. If the law permits an extension for complexity or number of requests, we explain the reason within that initial month. You may complain to Sweden’s Integritetsskyddsmyndigheten (IMY), https://www.imy.se, or a competent supervisory authority in the place of your residence or work or the alleged infringement. You may also seek a court remedy; these rights do not depend on completing an informal game-support process.

9. Analytics and automated systems

The server automatically calculates gameplay outcomes, progression, rewards, and eligibility for actions, and applies technical rate limits and account-security controls. Gameplay analytics and per-account summaries help analyze activity, balance, reliability, social systems, and the economy. These systems involve processing account-linked information; an internal identifier is not a guarantee of anonymity.

Automated gameplay is distinct from a decision with legal or similarly significant real-world effects. We assess profiling or automated enforcement before introducing it and provide required explanations and ways to contest qualifying decisions or obtain human review. Contact support@mistbyte.se to challenge a restriction or raise a concern about an automated outcome. The game does not currently provide a comprehensive automated moderation service.

10. Age eligibility and younger players

Edrath's minimum age is sixteen. Players who are still legal minors where they live need their parent or guardian's permission to play. Signup records a declaration of eligibility, not a verified date of birth or guardian identity. The game does not ask for a birth date as part of its current registration flow. Do not send a child's personal documents through player chat or report text.

A service age rule does not replace any applicable child-data protections or a required method of obtaining and verifying parental consent for particular processing. If the operator learns that an account does not meet the age requirement, it must assess access and handling of the child's data under the relevant law, using private and proportionate procedures. Guardians and younger people can contact support@mistbyte.se about safety or privacy without creating an account.

11. Security and incident response

The application uses password hashing, authenticated access controls, session expiration, verification and recovery flows, and abuse rate limits. No online service can guarantee perfect security. Protect your password, mailbox, device, and recovery links; use the password-reset flow if compromise is suspected. Direct messages and in-game mail are not end-to-end encrypted.

Security arrangements must also include restricted staff and provider access, safe backup handling, investigation procedures, and any legally required breach notifications. Whether an incident requires notice to affected people or a regulator depends on the applicable law and circumstances. These duties cannot be waived by accepting the game rules, and listing them here does not replace an operational incident-response process.

12. Changes to this notice

This is the initial Privacy and Storage Notice for Edrath Online. We will explain material changes and send account service emails when the terms or this notice change, linking to the applicable wording. Records of accepted terms and future published changes allow you to identify the rules and information that applied at the relevant time.

An email notice is not evidence of new consent. New purposes, materially different processing, optional tracking, or other changes may need additional information or permission before they start. The operator must meet those requirements rather than treating a posted revision, continued play, or service email as blanket approval.