Privacy Policy
This policy explains what personal data XETODUS collects, why, how long we keep it and the rights you have. It applies to xetodus.com, the game at xetodus.com/play and the installed app.
1. Who we are
XETODUS is published and operated by Legend Games LLC ("we", "us"). Legend Games LLC is the controller of your personal data. Contact us about anything in this policy at [email protected] with the subject line "Privacy". We do not have a separate data protection officer.
2. What we collect
| Data | What it is |
|---|---|
| Account data | Your username, email address (and whether it is verified), a password hash (Argon2id; we never store your password), and if you enable them, two-factor authentication settings (the secret is stored encrypted), recovery codes (hashed) and passkeys (public keys only). |
| Google sign-in (optional) | If you sign in with Google, the Google account identifier linked to your XETODUS account and the email address Google shares. We do not receive your Google password or contacts. |
| Gameplay data | Your pilots (names, faction, portrait and pilot card), ships, items, credits and Aether balances, skills, quests, achievements, market orders, contracts, clan membership, colonies and flotillas, kill records, and settings you choose to save to your account. |
| Chat | Messages you send in the system, global, faction, clan, help and trade channels, which other players can read. |
| Payment metadata | If you buy the Vanguard Charter or Aether, Stripe processes the payment. We receive a customer and subscription reference, the plan, amounts, currency, dates, payment status, refunds and disputes. We never see or store your card number. |
| Security and technical data | The IP address of your most recent sign-in, sign-in and session records, and short-lived rate-limit counters, used to keep accounts safe and stop abuse. Staff actions in the admin tools are logged. |
| Activity statistics | First-party, per-account daily records (the day, number of sign-ins, first and last time a pilot was active) used to understand how many people play and to plan servers. No third-party analytics service is used. |
| Anonymous performance reports | To improve performance on the wide range of graphics hardware our players use, the game sends anonymous technical reports about how it runs: your graphics card model and driver string, browser and operating system family, device type, a rough screen-size category, graphics settings, frame-rate ranges, and graphics errors. These reports contain no account, character, or contact information, are not linked to you, and we do not store your IP address with them. |
| Device storage | The game keeps your session token, graphics, audio and control settings, window layout and similar preferences in your browser's localStorage and sessionStorage. The site stores only your install-banner choice. |
3. Cookies, trackers and advertising
XETODUS uses no advertising, no third-party analytics and no tracking cookies. The browser storage described above is strictly necessary to sign you in and remember the settings you choose, so we do not show a cookie consent banner. Our typefaces are served from our own servers, so loading the site or the game contacts no third party other than our network provider (see section 6).
4. Why we use your data (lawful bases)
| Purpose | Lawful basis (GDPR / UK GDPR) |
|---|---|
| Creating and running your account, the game world and your purchases; customer support | Performance of our contract with you (Art. 6(1)(b)) |
| Security, fraud and cheat prevention, rate limiting, moderation of chat and conduct | Our legitimate interests in a safe, fair game (Art. 6(1)(f)) |
| Activity statistics to understand and plan the service | Our legitimate interests in improving and planning the service (Art. 6(1)(f)) |
| Anonymous performance reports | Our legitimate interests in product performance and compatibility (Art. 6(1)(f)) |
| Keeping payment and tax records | Legal obligation (Art. 6(1)(c)) |
| Optional features you switch on, such as Google sign-in | Your consent (Art. 6(1)(a)), which you can withdraw at any time by unlinking the feature |
Where we rely on legitimate interests you can object (section 9). We do not use your data for automated decisions that have legal or similarly significant effects, and we do not sell or share your personal information for advertising.
5. How long we keep it
- Account and gameplay data: for as long as your account exists. When you delete your account it is removed from the live database within 30 days.
- Payment records: kept for as long as tax and accounting law requires (typically up to 7 years), even after account deletion. Stripe keeps its own records under its policy.
- Chat: each channel keeps its most recent 80 messages; a channel's history expires after 30 days without new messages.
- Sessions: a sign-in session expires after 7 days without use.
- Anonymous performance reports: deleted automatically after 30 days.
- Server logs: rotated automatically and kept only for a short time (a few megabytes per service).
- Backups: database backups are kept for up to 90 days and then deleted automatically. Deleted accounts disappear from backups when those backups expire.
6. Who processes data for us
| Provider | What they do |
|---|---|
| Stripe | Payment processing, subscriptions, invoices and the customer billing portal. Stripe acts as an independent controller for some payment data; see stripe.com/privacy. |
| Cloudflare | Network security, DDoS protection and content delivery for xetodus.com. Your traffic, including your IP address, passes through Cloudflare. |
| Only if you choose Google sign-in (authentication). | |
| Email delivery | Our email service provider sends account emails such as verification and sign-in codes. |
| Hosting | The game servers and database run on hardware operated by Legend Games LLC. |
7. International transfers
Legend Games LLC is based in the United States and our servers are in the United States. If you play from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the US. Where our processors transfer data, they rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU–US Data Privacy Framework where they are certified.
8. Security
Passwords are hashed with Argon2id, two-factor secrets are encrypted, connections use HTTPS, staff access to player data is limited to administrators and moderators, and staff actions are logged. You can protect your account further with two-factor authentication or a passkey in Account settings. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.
9. Your rights
Depending on where you live you have the right to access your data, to rectification of inaccurate data, to erasure, to data portability, to restrict or object to processing, and to withdraw consent at any time. In the game, Account settings lets you correct your email and security settings, Download my data gives you a copy of your account data in a machine-readable file, and Delete my account erases it. For anything else, email [email protected] with the subject "Privacy" from your account's email address. We answer within one month and may need to verify your identity.
If you are in the EEA or UK you can also complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.
10. California and other US state privacy rights
If you live in California (CCPA/CPRA) or another US state with a comprehensive privacy law, you have the right to know what personal information we collect and how we use it (sections 2–6), to access and delete it, to correct it, and not to be discriminated against for using these rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not use sensitive personal information to infer characteristics about you. To make a request, use the in-game tools or email [email protected]; an authorised agent may act for you with written permission.
11. Children
XETODUS is not directed at children under 13 and you must be at least 13 to create an account, or older where the law of your country sets a higher age for consent to online services (for example 16 in some EU countries) unless a parent or guardian consents. If we learn that we hold data of a child below the applicable age without that consent, we delete the account. Parents can contact [email protected].
12. Changes
We will update this policy when the game or the law changes and show the date at the top. If a change is significant we will tell you in the game or by email before it takes effect.
13. Contact
Legend Games LLC. Email: [email protected] (subject "Privacy").