Privacy and Cookie Policy

Effective from:

1. Who is the data controller

The controller of players' personal data is the operator of the game Torvidia: , , (details in the Impressum). For matters concerning personal data, write to: .

2. What data we process and why

Data	Purpose	Legal basis
Email address, character name, password hash	Creating and maintaining the account, logging in, contact regarding account matters	Performance of a contract – Art. 6(1)(b) GDPR
Email address and the date consent was given or withdrawn (only if you tick the consent box)	Sending messages about news, events and promotions in the game	Consent – Art. 6(1)(a) GDPR. You can withdraw it at any time in Settings or via the link in the message; withdrawal does not affect the lawfulness of messages sent before.
Gameplay data: character state, items, fight history, guild membership, rankings	Providing the game service	Performance of a contract – Art. 6(1)(b) GDPR
IP address, date and time of logins and account activity, technical browser data, device identifier (cookie tvd)	Game security, detecting multi-accounts, bots and abuse, diagnosing bugs	Legitimate interest – Art. 6(1)(f) GDPR
Date of acceptance of the Terms of Service and its version	Proof of conclusion of the contract and of consent to its terms	Legitimate interest – Art. 6(1)(f) GDPR
Content of correspondence with the operator	Responding to a report, appeal or request	Legitimate interest – Art. 6(1)(f) GDPR
Purchase data: character name, package, amount, date, Stripe payment ID, consent to immediate delivery of diamonds	Processing diamond purchases, complaints and refunds, accounting and tax obligations	Performance of a contract – Art. 6(1)(b) GDPR; legal obligation – Art. 6(1)(c) GDPR
Database backups (all of the above data)	Protection against data loss and restoring the game after an outage	Legitimate interest – Art. 6(1)(f) GDPR

Providing your email address, character name and password is voluntary, but necessary to create an account. We do not collect special categories of data and do not ask for your first name, last name or home address.

3. Passwords

We do not store players' passwords. We only save their cryptographic hash (bcrypt algorithm), from which the password cannot be recovered. The password is never stored anywhere in plain text – nobody, including the operator, knows your password.

4. What other players see

Other players see your character name, its level, statistics, equipment, ranking positions, guild membership and content you publish yourself (messages to them, chat and guild description, market offers). Your email address and IP address are not visible to other players.

5. Who we share data with

• Hosting: the game and the database run on a server of a hosting provider based in Poland (seohost.pl), which processes data on our behalf under a data processing agreement (Art. 28 GDPR).
• Backups: we store encrypted database backups in the Google Drive service (Google). The backups are encrypted on our server before being sent, and only we know the key – Google has no access to their content. Google may also store files outside the European Economic Area (including in the USA) on the basis of the EU-US Data Privacy Framework and standard contractual clauses.
• Payments: diamond purchases are processed by Stripe Payments Europe, Ltd. (Ireland). You enter payment details (e.g. card number, BLIK or bank account details) directly on the Stripe page – we do not receive them. We pass to Stripe the account email address, the amount and the description of the purchase. Stripe processes payment data as a separate controller under its own privacy policy (stripe.com/privacy) and may transfer it to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses.
• Email: the email provider through which we reply to messages.
• Public authorities: if we are required to do so by law.

We do not sell data or share it for advertising purposes.

6. How long we keep data

• account and gameplay data – until the account is deleted;
• fight history and activity logs – for a period limited by the game settings, after which they are automatically deleted;
• login data and IP addresses – up to 12 months;
• purchase data – for the period required by tax and accounting law (up to 10 years from the end of the year in which the payment was made), also after the account is deleted;
• correspondence – up to 3 years after the matter is closed, in case of claims;
• backups – backups from the last hours and days, plus one backup from each month, kept for a maximum of 13 months; after this time they are automatically deleted. Data of a deleted account may remain in backups until they expire – backups are not used for anything other than restoring the game after an outage.

After an account is deleted, the data are erased or anonymized, except for data we must retain under legal provisions or to defend against claims.

7. Your rights

You have the right to: access your data and receive a copy of it, rectification of your data, erasure of your data, restriction of processing, data portability, and to object to processing based on legitimate interest. To exercise these rights, write to from the email address assigned to your account. We respond within one month.

You have the right to lodge a complaint with a supervisory authority. The authority competent for the operator is: . You may also lodge a complaint with the supervisory authority of your country of residence – in Poland this is the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

8. Automated decisions

The game automatically detects certain forms of abuse (e.g. overly fast, repetitive requests typical of bots) and may consequently temporarily restrict the account. The decision to permanently ban an account is always made by a human, and every ban can be appealed in accordance with the Terms of Service.

9. Cookies

The game uses only cookies that are strictly necessary for its operation (§ 25(2) TDDDG – they do not require consent):

Name	What it is for	How long
connect.sid	Keeps you logged in (session identifier). Without it, logging in does not work.	Until you log out; without “Remember me” 24 hours after the last activity, with “Remember me” 30 days
tvd	Random device identifier – game security: recognizing accounts playing on the same device (multi-account rules in the Terms of Service), detecting abuse and notifying you that you were logged out from another device. It is not used for tracking outside the game.	2 years

In addition, your browser stores a few convenience settings locally (in local storage), e.g. the selected tab. This data does not leave your device.

We do not use advertising, analytics or tracking cookies, which is why we do not display a consent banner. You can delete or block cookies in your browser settings, but then you will not be able to log in to the game.

10. Security

The connection to the game is encrypted (HTTPS), passwords are stored only as a hash (section 3), backups are encrypted before being sent off the server, and only persons authorized by the operator have access to the database and the administration panel, via a secured connection and with two-step verification.

11. Changes to this policy

We may update this policy, e.g. when legislation or game features change. We will inform you in the game about significant changes before they take effect.