Privacy Policy
- We collect what the game needs: your account, your game data, technical and security data (such as your IP address) and your purchase records.
- We never see or store your card number. Stripe and Steam handle payments.
- No advertising, no ad tracking, no analytics cookies. We do not sell your data.
- The game servers and database are in France (European Union).
- You can ask to see, fix or delete your data at any time: [PREENCHER: e-mail de contato].
1. Who is responsible
The controller of your data is [PREENCHER: nome da pessoa física ou empresa] ([PREENCHER: CNPJ/CPF/SIRET]), [PREENCHER: endereço], operating as Vahnora Studios. Contact for anything about privacy: [PREENCHER: e-mail de contato].
This policy covers the game Vahnora (Steam), the site vahnora.com and our Discord bot. It follows the EU General Data Protection Regulation (GDPR) and Brazil's General Data Protection Law (LGPD).
2. What we collect
Account
- Username and password. The password is stored only as a secure hash, never in plain text.
- E-mail address, when you register with one, sign in with Google, or give one at checkout. Accounts created through Steam or Discord without an e-mail get an internal placeholder address.
- Your Steam ID, Discord user ID (and the Discord e-mail when Discord says it is verified) and Google e-mail, when you sign in or link those services.
- Settings and preferences (language, key bindings, display options), VIP level, Crown balances, account status (for example a mute or ban and its reason).
Game data
- Characters, levels, items, gold, guild, friends, quests, achievements, rankings and everything you do that changes them.
- Chat: global and guild messages are saved. Whispers and party messages are not saved in our database, but pass through short-lived server logs.
- Reports you send in the game or in our bug tracker.
- Some of this is public by design: character names, guilds, levels, rankings and the Hall of Fame are visible to other players and on the site.
Technical and security data
- Your IP address at each sign-in to the game and to the site, and the time.
- On the site: the country and network provider of that IP, and whether it belongs to a data centre or VPN. We work this out on our own server with an offline database (DB-IP); the IP is not sent to anyone for that. We also keep a short code derived from your browser's user agent, not the full text.
- A log of game actions (for example trades, auction sales, item movements, chat) used for support and against cheating.
- Connection quality (latency) and error reports from the game client. An error report contains technical details of the crash and where you were in the game, never your files.
Purchases
- Stripe (card, Apple Pay, Google Pay, Link, PayPal, Pix): we receive the order number, amount, currency, status, payment method type, the card's country, a payment "fingerprint" (a code from Stripe that lets us recognise the same card again without knowing its number) and the e-mail typed at checkout. If your account has no real e-mail, we save that one on it for receipts and recovery.
- Steam: the Steam order number, your Steam ID, amount, currency, status and refunds.
- What you buy in the Crown Shop with your Crowns.
Messages to us
What you write to support, by e-mail, on the bug tracker or in Discord tickets.
3. Why we use it, and on what legal basis
| Purpose | GDPR basis (art. 6) | LGPD basis (art. 7) |
|---|---|---|
| Create and run your account and the game, sign-in with Steam/Discord/Google, Steam achievements | Contract (b) | Contract (V) |
| Sell and deliver Crowns, receipts, refunds | Contract (b) | Contract (V) |
| Accounting and tax records | Legal obligation (c) | Legal obligation (II) |
| Security, anti-cheat, fraud and chargeback prevention, enforcing the rules, checking the Brazil price | Legitimate interests (f) | Legitimate interest (IX) and exercise of rights (VI) |
| Support, bug fixing, game balance | Contract (b) and legitimate interests (f) | Contract (V) and legitimate interest (IX) |
We do not send marketing e-mails. We only write to you about your account, your purchases, security or support.
4. Automatic decision: the Brazil price
The Brazil price of Crowns is offered only to accounts whose every access to the site comes from Brazil and not from a data centre or VPN. This check is automatic and is based on the IP country and network. If you think it decided wrongly, you can ask for a review by a person (GDPR art. 22, LGPD art. 20).
5. Who receives your data
| Who | What for | Where |
|---|---|---|
| OVH | Game servers and database | France (EU) |
| Hostinger | Hosting of the site and e-mail | [PREENCHER: país do datacenter da Hostinger] |
| Stripe (and PayPal when you pick it) | Payments, fraud prevention | EU and United States |
| Valve (Steam) | Sign-in, Steam payments, achievements | United States |
| Discord | Sign-in, community, our bot | United States |
| Sign-in with Google; fonts loaded by some site pages | United States | |
| jsDelivr | Delivers a page library (Bootstrap) on some site pages | Global network |
| Authorities | Only when the law requires it | — |
Other players see your public game profile (section 2). We never sell your data and never share it for advertising.
6. Transfers outside your country
- Our database is in the EU. For players in Brazil this is an international transfer needed to provide the game you asked for (LGPD art. 33, IX).
- Transfers to the United States rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses used by those providers.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and game data | While the account exists. Deleted when the account is deleted (section 9). |
| Log of game actions | 14 days |
| Server files (errors, combat, latency) | 7 days |
| Saved chat (global and guild) | [PREENCHER: prazo] |
| Sign-in history (IP, country, network) | [PREENCHER: prazo] |
| Moderation records (warnings, mutes, bans) | While needed to enforce the ban, at most [PREENCHER: prazo] |
| Orders, payments, refunds and Crown Shop purchases | As long as tax and accounting law requires, also after the account is deleted: [PREENCHER: 5 anos BR / 10 anos FR] |
| Encrypted backups | About 30 days, then overwritten |
8. Your rights
Under the GDPR and the LGPD you can ask us to:
- confirm whether we hold data about you, and give you a copy (access, portability);
- correct it;
- delete it, or anonymise or block what is excessive;
- restrict or object to a use based on legitimate interest;
- tell you who we share it with;
- review an automatic decision (section 4);
- withdraw a consent you gave, if any.
Write to [PREENCHER: e-mail de contato] or open a ticket on our Discord. We may ask you to prove the account is yours. We answer within 15 days, and never later than one month.
You can also complain to a data protection authority: in Brazil the ANPD (gov.br/anpd); in the EU the authority of your country, or France's CNIL (cnil.fr).
9. Deleting your account
- Ask by e-mail ([PREENCHER: e-mail de contato]) or in a Discord ticket, from the e-mail or Discord account linked to your game account, and tell us the account name.
- We confirm the account is yours. If you lead a guild that has members from other accounts, pass the leadership first.
- An administrator deletes the account within [PREENCHER: 30] days. You are disconnected from the game first.
What is deleted: the account, all its characters with their items, gold, mail, auction listings, friends, guild membership and settings. Character names become free at once. A guild left with no members is dissolved.
What is kept: order, payment, refund and Crown Shop records (section 7, required by law and for disputes), sign-in history and moderation records for their periods, and logs and backups until they expire on their own.
Deletion is final. Crowns, VIP points and items cannot be restored. If you own another account, you can ask us to move your Crowns and VIP points to it before the deletion.
10. Cookies and local storage
The site only uses what it needs to work. That is why there is no cookie banner.
| Name | What it does | Duration |
|---|---|---|
| PHPSESSID (cookie) | Keeps you signed in | 30 days |
| vah_lang (cookie) | Remembers your language | 1 year |
| vahnora_lang, key bindings, display mode (browser storage) | Remember your choices on this device | Until you clear them |
The Stripe checkout page sets its own cookies on Stripe's site, for security and fraud prevention. Some site pages load fonts from Google and a library from jsDelivr; their servers receive your IP address when that happens.
11. Children
You must be at least 13 to create an account. Players under 18 need a parent or guardian's agreement. We only ask players for what the game needs, and no minor has to give more data to play. If you are a parent and think your child gave us data without permission, write to [PREENCHER: e-mail de contato] and we will delete it.
12. Security
Passwords are hashed, the site and the game use encrypted connections, access to data is limited to the administrator, and backups are encrypted. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
13. Changes
We will post any change here with a new date. For important changes we will also warn you on the site, in the game or on Discord.