Privacy Policy

1. Data we collect

• Sign-in: with Apple or Google, an account identifier and, if the provider shares it, your email address (and from Google, your name). A guest account has no sign-in data.
• Account and devices: when the account was created and last used, the device platform (iOS or Android), your language, and the sessions that keep you signed in.
• Sign-in records and IP address: the date, method, app version and IP address of each sign-in. From the IP address we derive your approximate country and city and whether it belongs to a VPN, proxy or data centre. Other players see the flag of the country you sign in from; never your IP address or city.
• Gameplay: your characters, items, progress, guild, chat messages and game logs (for example trades and item changes).
• Community forum: your nickname, character badge, posts, reports and blocks.
• Voice chat: your voice is sent live to players in the same voice room and is not recorded. We keep which room you joined for 24 hours, and voice reports and mutes.
• Push notifications: if you allow them, a push token from Apple or Google, your device language and app version.
• Support requests: your messages, the form answers, the character you choose, your browser type, and any screenshots, videos or files you attach.
• Beta waitlist: the email address you enter, when you signed up, your IP address, browser type and language, and the campaign link you came from.

We do not access your contacts or precise (GPS) location. The app uses the microphone only for voice chat, and your camera, photos and files only when you attach them to a support request. We never receive payment card details.

2. Why we use it

• to create your account, sign you in and run the game, the forum, voice chat and notifications you choose to use (our contract with you);
• to keep the game fair and safe: protecting accounts and detecting cheating, bots, ban evasion and fraud (our legitimate interest);
• to answer support and privacy requests and to tell you about important changes;
• to send beta invitations to the waitlist;
• to understand, in aggregate, how many players we have per country or platform; and
• to comply with the law.

Some safety tools are automatic (for example, a short voice chat mute after several reports, or rate limits). Bans and other serious decisions are taken or reviewed by our staff, and you can ask for any automatic decision to be reviewed by a person.

3. Who we share it with

Only with the service providers that help us run ElvanOnline, under contracts that require them to protect the data:

• Apple and Google: sign-in and push notifications;
• Cloudflare: website hosting, network protection, game downloads and support attachments;
• hosting providers (such as Hetzner): the servers our account service, database, game and voice servers run on;
• ipapi.is: receives IP addresses only, to look up country and network;
• Google Fonts: delivers the fonts of elvanonline.com; and
• our email provider, for messages to and from support@elvanonline.com.

We also share data with authorities when the law requires it. Some of these providers process data outside the UK and the EEA (for example in the United States); we then use the safeguards the law requires, such as standard contractual clauses.

4. How long we keep it

When you delete your account, your data is removed after a 14-day waiting period; a few records are kept or anonymised. Our Delete your account page lists exactly what.

5. Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. Write to support@elvanonline.com, if possible from the email address linked to your account. We answer free of charge within one month. We may need to confirm the account is yours first.

If you are not happy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk), to the data protection authority where you live, or, in Türkiye, to the Personal Data Protection Authority (see our KVKK Information Notice).

6. Children

ElvanOnline is for players aged 16 and over. We do not knowingly collect data from children under 16. If you think a child has created an account, contact us and we will delete it.

7. Website, cookies and local storage

elvanonline.com uses no advertising or analytics cookies. Your browser's local storage remembers the email you entered on the beta form and the language you picked, only on your device; clearing your site data removes them. Cloudflare may set strictly necessary security cookies, and the community forum uses one cookie to keep you signed in.

8. Security

Connections are encrypted (HTTPS/TLS), session tokens are stored only in hashed form on our servers, staff tools require individual accounts and two-factor authentication, and records are deleted automatically when their retention period ends. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

9. Changes

When we change this policy we update the date at the top of this page. If the change is significant, we will also tell you in the app or on our website.

10. Contact us