This policy explains information handling for Nyveris's website, downloadable client and online game. The operator and public contact are identified above. It distinguishes private account information from information shared during public play.
1. Information collected
- Account information: username, account creation time and a salted scrypt password hash. A password is processed to register, sign in or change it; the account database stores the hash and salt, not the plaintext password. A recovery email is optional at registration and can be set or changed using the account controls.
- Authentication information: random, opaque session tokens, expiry times, short-lived game connection tickets and password-reset tokens. The server stores hashes of session and reset tokens. Connection tickets are held temporarily for opening a game connection.
- Game information: character location and room, party and stored monsters, capture times and locations, monster levels and battle resources, inventory, in-game currency, progression, battle state and PvP scores and results. Recent catches are recorded for the public catch feed. Administrators' world changes, uploaded assets and saved drafts are stored to operate the game.
- Communications: in-room chat is transmitted to players in that room. Information you include in a support or privacy request is also received by the operator.
- Technical information: IP addresses, requests and connection information used to deliver the site and game, enforce rate limits and diagnose failures or abuse. Hosting, web-server and security services may also process request metadata and access or error logs. Administrative restart events and server failures can produce operational logs.
2. How information is used
Information is used to create and authenticate accounts, save progress, run multiplayer rooms and battles, show profiles and recent catches, deliver requested password recovery messages, maintain software and content, respond to requests, and prevent cheating, account misuse and service disruption. Recovery email is used for account recovery and account-related handling; the current recovery feature does not subscribe you to a marketing list.
Where applicable privacy law requires a legal basis, the relevant basis depends on the activity and your location, such as providing a service you request, protecting the service and its users, complying with legal obligations, or obtaining consent where required. This does not mean every activity uses consent or that every jurisdiction gives the same rights.
3. What other people can see
Public profiles can be viewed without signing in. They show your username, joining date, caught party monsters, stored monsters, storage counts and capacity, and PvP statistics. Monster details include species, level and available capture time and room metadata. The public recent-catch feed shows a player's username, captured monster and capture time and room.
While connected, players in the same room receive your character's name and position and chat sent to that room. Treat chat as shared, not private messaging. The profile interface can display a catch journal assembled from public catch metadata; that is not a private diary. Email addresses, password hashes and authentication tokens are not included in public profile responses.
Do not use a real name or share sensitive information if you do not want it visible to others. People can copy public information or chat; removing it from the service cannot reliably remove independent copies.
4. Browser and device storage
The website's account interface uses browser sessionStorage for its login token and, during recovery, a reset token. Authenticated API requests send a bearer token rather than using a PHP login-session cookie. Passwords are not saved by the site's account script. Browser session storage normally lasts for the tab's session, subject to your browser's restore and storage behavior; logging out clears the site's stored login token and revokes that server session.
The native client saves display settings and user-interface layout preferences locally on your device. These settings are distinct from server-held game progress. You can remove local preferences or browser site data using your device or browser controls, but doing so does not delete your server account.
The legal pages themselves do not need or load JavaScript. The site uses Cloudflare as an intermediary for traffic delivery and protection. Depending on its configuration, Cloudflare may process request and device information or set security-related cookies. This policy does not assert that all infrastructure is cookie-free or that no tracking occurs. Browser privacy settings can control cookies and storage, although blocking required storage or security checks may prevent sign-in or access.
5. Sharing and service providers
Information is shared with other players as described above and is accessible to the operator and authorized administrators as needed to operate, secure and moderate the service. Hosting and infrastructure services process data needed to provide the service. Cloudflare handles traffic for delivery and protection; the configured SMTP service and the recipient's email services process recovery emails, including the recipient address and reset-link content, to deliver them. Do not forward a live reset link.
Information may also be disclosed when legally required or reasonably necessary to investigate abuse, protect people and the service, or establish, exercise or defend legal rights, subject to applicable law. Provider identities other than Cloudflare, their locations and deployment-specific settings have not yet been confirmed for this draft; it does not represent an exhaustive verified provider list.
6. Retention
Account and game records are kept to maintain accounts and progress while needed for those purposes. The current software does not set an automatic deletion deadline for all inactive accounts. Requests to delete information must be considered alongside security, abuse prevention, legal obligations and the rights of others. Backup and service-provider copies may follow separate deletion cycles; those cycles are not confirmed in this draft.
Login sessions currently expire after 24 hours and may be revoked earlier by logout, password reset or session replacement. Game connection tickets expire after 60 seconds and are consumed on use; password-reset links expire after 20 minutes and can be used once. Expiry controls whether a token can be used, not a promise that every related log or backup is deleted at that instant. Expired session and reset records are cleaned by server maintenance. The recent-catch feed uses a bounded set of recent records rather than a fixed number of retention days.
Technical logs and support correspondence should be retained only as needed for troubleshooting, security, handling requests and applicable legal obligations. No universal log, backup or correspondence retention period has been confirmed for this draft.
7. Security
Safeguards in the current service include salted password hashing, random authentication tokens, hashed server-side session and recovery tokens, token expiry, access checks and request limits. Public traffic uses HTTPS and secure game connections; the recovery-mail transport is configured to require TLS outside isolated local tests. These measures reduce risk but cannot guarantee complete security.
Use a unique password, keep your recovery email secure and report suspected compromise to the public contact above. Do not include passwords, authentication tokens or live reset links in a support request.
8. Your choices and rights
You can choose whether to provide a recovery email, update it through the account controls, log out, and stop using the service. A valid recovery email helps regain access; omitting it may make recovery impossible. There is no claim here that logging out, clearing browser storage or uninstalling deletes server-held data.
Depending on applicable law, you may have rights to access, correct or delete personal information, obtain a portable copy, restrict or object to processing, or withdraw consent where processing actually relies on consent. Rights can have conditions and exceptions. Send requests to the public contact above, identify your account without sending a password, and describe the request. The operator may need proportionate verification to avoid exposing someone else's data. Where applicable, you can complain to the relevant data-protection authority.
A public contact has not yet been supplied. This draft cannot provide an operational privacy-request channel until that detail is confirmed.
9. Children and eligibility
The minimum age and any country-specific requirements for children's use have not yet been confirmed. This draft must not be treated as an invitation for children to register or as a completed children's privacy notice.
10. International processing and changes
Hosting, Cloudflare and email delivery may process information in countries different from yours. The operator's country is identified above when confirmed; this does not establish the locations of every provider. Provider locations and any legally required transfer safeguards must be confirmed for the deployment before this draft is finalized. No specific transfer mechanism is asserted without that confirmation.
Changes to this policy will be posted on this page. The last-updated date reflects the saved policy text and operator configuration, not the day you visit. Additional notice will be provided where required by applicable law.