Privacy Policy

This policy explains what personal data Azurite Solutions LLC collects when you use Starfire, why we collect it, and what you can do about it. We are the data controller.

We do not sell your personal data, and we never will. We do not run advertising, and we do not share your data with advertisers or data brokers.

1. What we collect

When you create an account

• Email address - to identify your account, verify it, and let you reset a password.
• Username and password - the password is stored only as a bcrypt hash. We cannot read it, and neither can anyone who obtains the database.
• Google account email, if you sign in with Google. We receive your email address and the fact that Google has verified it. We do not receive your Google password.

When you play

• Character and gameplay data - names, levels, inventory, location, quest progress and settings.
• Chat and other text you type, where it is retained for moderation and support.
• Login timestamps, so you can see when an account was last used.

Automatically

• IP address. Used to keep the service secure - specifically to detect and block repeated failed login attempts, which is what protects your account from being guessed into. Addresses that trip that threshold are recorded on a block list.
• Server logs - errors, request timings and similar operational records.
• Aggregate website analytics - see the Cookie Policy. These are anonymous, collected without cookies, and cannot identify you.

When you buy something

We never see your card details. Payments are handled entirely by our payment provider, who acts as merchant of record. We receive a record that a purchase happened - what was bought, when, the amount, and a transaction reference - so we can grant what you paid for and handle support. Your payment details stay with the provider, under their own privacy policy.

When you contact support

Your email address, what you tell us, and our replies - kept so we have the history of your issue.

2. Why we use it, and our legal basis

3. Who we share it with

Only processors who help us run the service, and only what each of them needs:

• Our hosting provider - runs the servers the game and website sit on.
• Our email provider - sends verification and password-reset emails, and receives your email address in order to do so.
• Our payment provider - takes payments as merchant of record and holds your payment details under their own policy.

We may also disclose data where the law requires it, or where it is necessary to investigate fraud, abuse, or a threat to someone's safety.

4. International transfers

We operate from the United States, so data is processed there. Where data is transferred out of the UK or the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

5. How long we keep it

• Account and character data - while your account is open.
• After you delete your account - characters and account data are deleted. Records we must keep for tax and accounting (transaction records) are retained for as long as the law requires, typically seven years.
• Security records - failed login counters expire within minutes. Entries on the block list persist until removed, because their purpose is to keep blocking.
• Support tickets - up to two years after the issue is closed.
• Server logs - typically 30 days.

6. Your rights

Depending on where you live, you have some or all of the following rights. UK and EU residents have all of them under GDPR; California residents have comparable rights under the CCPA/CPRA.

• Access - a copy of the personal data we hold about you.
• Rectification - correction of anything inaccurate.
• Erasure - deletion of your data. You can do this yourself from your account page, which deletes your characters too.
• Portability - your data in a machine-readable format.
• Objection and restriction - to processing we base on legitimate interests.
• Withdraw consent - at any time, where we relied on consent.
• Non-discrimination - we will not degrade your experience for exercising any of these.

Email support@starfiremud.com from your account's address and we will respond within 30 days. If you are unhappy with our response you may complain to your data protection authority - in the UK, the Information Commissioner's Office.

7. Children

Starfire is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, tell us and we will delete it.

8. Security

Passwords are hashed with bcrypt. Traffic to the website and the web client is encrypted with TLS. Access to production data is limited to the people who need it.

Telnet is not encrypted. That is inherent to the protocol, and it is worth knowing: on an untrusted network, someone positioned between you and us could read a telnet session, including the password you type at login. If that matters to you, use the web client, which is encrypted end to end.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

9. Changes

We will announce material changes to this policy in game and on the news page before they take effect. The date at the top always reflects the current version.

10. Contact

Azurite Solutions LLC, Arizona, United States · support@starfiremud.com