Gizlilik Politikası

İçindekiler

1. 1. Who we are
2. 2. What we collect
3. 3. Cookies, trackers and advertising
4. 4. Why we use your data (lawful bases)
5. 5. How long we keep it
6. 5a. Referral fraud prevention
7. 5b. Fair play and cheat detection
8. 6. Who processes data for us
9. 7. International transfers
10. 8. Security
11. 9. Your rights
12. 10. California and other US state privacy rights
13. 11. Children
14. 12. Changes
15. 13. Contact

This policy explains what personal data XETODUS collects, why, how long we keep it and the rights you have. It applies to xetodus.com, the game at xetodus.com/play and the installed app.

1. Who we are

XETODUS is published and operated by Legend Games LLC ("we", "us"). Legend Games LLC is the controller of your personal data. Contact us about anything in this policy at [email protected] with the subject line "Privacy". We do not have a separate data protection officer.

2. What we collect

Data	What it is
Account data	Your username, email address (and whether it is verified), a password hash (Argon2id; we never store your password), and if you enable them, two-factor authentication settings (the secret is stored encrypted), recovery codes (hashed) and passkeys (public keys only).
Google sign-in (optional)	If you sign in with Google, the Google account identifier linked to your XETODUS account and the email address Google shares. We do not receive your Google password or contacts.
Gameplay data	Your pilots (names, faction, portrait and pilot card), ships, items, credits and Aether balances, skills, quests, achievements, market orders, contracts, clan membership, colonies and flotillas, kill records, and settings you choose to save to your account.
Chat	Messages you send in the system, global, faction, clan, help and trade channels, which other players can read; private messages you send to another pilot, which only that pilot can read; and the list of pilots you have blocked.
Payment metadata	If you buy the Vanguard Charter or Aether, Stripe processes the payment. We receive a customer and subscription reference, the plan, amounts, currency, dates, payment status, refunds and disputes. We never see or store your card number.
Security and technical data	The IP address of your most recent sign-in, sign-in and session records, and short-lived rate-limit counters, used to keep accounts safe and stop abuse. Staff actions in the admin tools are logged.
Activity statistics	First-party, per-account records used to understand how many people play and to plan servers: daily activity (the day, number of sign-ins, first and last time a pilot was active), your total time online and number of play sessions (for your account and each pilot), the kind of device you play on (browser family, operating system, phone or desktop, and whether you use the website or an app), and your approximate location (country, region and city) worked out from your IP address when you connect. We keep only the latest approximate location and the first country seen, never the IP address used to work it out. The location comes from our network provider (Cloudflare) or a database on our own servers; no third-party analytics or location service receives your data.
Anonymous performance reports	To improve performance on the wide range of graphics hardware our players use, the game sends anonymous technical reports about how it runs: your graphics card model and driver string, browser and operating system family, device type, a rough screen-size category, graphics settings, frame-rate ranges, and graphics errors. These reports contain no account, character, or contact information, are not linked to you, and we do not store your IP address with them.
Device storage	The game keeps your session token, graphics, audio and control settings, window layout and similar preferences in your browser's localStorage and sessionStorage. The site stores only your install-banner choice.
Fair play records	To protect the game against cheating, automation and abuse of the in-game economy, a fair-play record for your account, described in section 5b.
Referral program (optional)	If you follow a Recruit a Wingmate link, or recruit other players, the referral code you arrived with, who recruited you, your recruits' milestones and the rewards paid, plus the hashed fraud-prevention signals described in section 5a.

3. Cookies, trackers and advertising

XETODUS uses no advertising, no third-party analytics and no tracking cookies. The browser storage described above is strictly necessary to sign you in and remember the settings you choose, so we do not show a cookie consent banner. Our typefaces are served from our own servers, so loading the site or the game contacts no third party other than our network provider (see section 6).

Two first-party cookies exist only for the referral program. Opening a referral link (xetodus.com/r/...) sets a signed attribution cookie that remembers which link you came from for up to 30 days, so that an account you create can be credited to the player who invited you; it is read once, when you sign up, and is not used for anything else. Players taking part in the program also get a random device identifier (kept in your browser's storage and in a cookie) used only for the fraud checks in section 5a. Neither cookie is shared with anyone, used across other websites or used for advertising.

4. Why we use your data (lawful bases)

Purpose	Lawful basis (GDPR / UK GDPR)
Creating and running your account, the game world and your purchases; customer support	Performance of our contract with you (Art. 6(1)(b))
Security, fraud and cheat prevention, rate limiting, moderation of chat and conduct	Our legitimate interests in a safe, fair game (Art. 6(1)(f))
Running the referral program and preventing referral fraud (section 5a)	Performance of the program's terms for the rewards (Art. 6(1)(b)); our legitimate interest in preventing fraud and abuse of the rewards for the fraud checks (Art. 6(1)(f))
Activity statistics to understand and plan the service	Our legitimate interests in improving and planning the service (Art. 6(1)(f))
Anonymous performance reports	Our legitimate interests in product performance and compatibility (Art. 6(1)(f))
Keeping payment and tax records	Legal obligation (Art. 6(1)(c))
Optional features you switch on, such as Google sign-in	Your consent (Art. 6(1)(a)), which you can withdraw at any time by unlinking the feature

Where we rely on legitimate interests you can object (section 9). We do not use your data for automated decisions that have legal or similarly significant effects, and we do not sell or share your personal information for advertising.

5. How long we keep it

• Account and gameplay data: for as long as your account exists. When you delete your account it is removed from the live database within 30 days.
• Payment records: kept for as long as tax and accounting law requires (typically up to 7 years), even after account deletion. Stripe keeps its own records under its policy.
• Chat: each channel keeps its most recent 80 messages; a channel's history expires after 30 days without new messages. Private messages are kept for 90 days, then deleted automatically, and are deleted with either pilot.
• Sessions: a sign-in session expires after 7 days without use.
• Anonymous performance reports: deleted automatically after 30 days.
• Fair play records: kept for up to 90 days after the activity they relate to, then deleted automatically. They are deleted when you delete your account, except for a record of any sanction, which is kept as described for staff audit records.
• Referral fraud-prevention signals and play-time records: deleted automatically 12 months after they were last seen; a decision older than 12 months keeps only its outcome.
• Server logs: rotated automatically and kept only for a short time (a few megabytes per service).
• Backups: database backups are kept for up to 90 days and then deleted automatically. Deleted accounts disappear from backups when those backups expire.

5a. Referral fraud prevention

Recruit a Wingmate rewards players for bringing friends into the game, so it is a target for people who create extra accounts to reward themselves. To keep it fair we check each referral reward against signals that show when a "recruit" is really the recruiter, or a batch of throwaway accounts. This applies only to players who take part in the program: recruiters who created a referral link, and players who signed up through one.

• Signals we use: the IP address your connection comes from and its network range (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), a random device identifier the game stores in your browser, and a browser fingerprint made from ordinary, stable settings: browser family and major version range, operating system, screen size and pixel density ranges, time zone, language, number of processor cores, memory range and the name of your graphics chip. We also use the domain of your email address (to refuse throwaway email services), whether the connection comes from the Tor network, your account's age, the time you actually spend playing as observed by our servers (real flight input and skill progress, not an idle connection) and, for rewards tied to a Vanguard Charter payment, the card fingerprint Stripe provides for that payment. We never receive or store your card number.
• Hashed, not raw: the browser fingerprint is hashed in your browser before it is sent. On our servers every signal (IP address, network, device identifier, fingerprint, card fingerprint, email domain) is stored only as a salted one-way hash made with a secret key, so the stored value cannot be turned back into the original. Staff reviewing a referral see whether two accounts share a signal, never the raw value.
• Purpose: only to decide whether a referral reward is paid, held for review by staff, refused or reversed, and to limit how many rewards one player can collect. The checks never ban anyone automatically and are not used for advertising, profiling or anything outside the program. A reward held for review is decided by a person.
• Lawful basis: our legitimate interest in preventing fraud and abuse of the program's rewards (Art. 6(1)(f)). You can object at [email protected]; if you do, you can keep playing, but we may be unable to pay you referral rewards.
• Retention: signals and play-time records are deleted automatically 12 months after they were last seen, and immediately when you delete your account. They are included in Download my data.
• No tracking elsewhere: we use no third-party fingerprinting or anti-fraud service and no cross-site tracking. The signals are collected only on xetodus.com and in the game, and are never sold or shared.

5b. Fair play and cheat detection

XETODUS is an online world with a shared economy, so cheating, bots and account farms harm every player. We check how the game is played to keep it fair. This section explains what we use and why; to keep the checks effective, we do not publish how they work in detail.

• What we use: gameplay data the game already sends to our servers while you play (such as your commands, flight and combat input and the rewards you earn), your trades, contracts, transfers and other activity involving other accounts, your chat messages, and a one-way hashed identifier derived from your network connection. We store the resulting findings and a risk assessment for your account. We do not install anything on your device for this, and we do not store your IP address or a device fingerprint for it.
• Why: to detect and prevent cheating, automated play, account farming, fraud, real-money trading and spam, to protect the in-game economy and other players, and to enforce our Terms of Service.
• Lawful basis: our legitimate interest, and that of our players, in a fair and secure game and in preventing fraud and abuse (Art. 6(1)(f)). We keep the data to what these checks need, and a finding on its own is never treated as proof.
• Automated checks and human review: while an account is under review, automated checks may temporarily reduce the in-game rewards it earns (such as experience and reward credits). Gameplay itself is not restricted, and nothing is removed from the account. Warnings, reward freezes, suspensions and bans are decided by our staff after reviewing the account, not by an automated system. If you think we got something wrong, write to [email protected]: a person will look at it, you can explain your side, and we will correct or lift a measure that was not justified.
• Who sees it: only our staff, and the service providers in section 6 that host our servers and network. We do not sell or share it, and we disclose it to authorities only where the law requires.
• Your rights: your rights in section 9 apply to these records, including access and objection. They are not part of Download my data; ask us at [email protected] and we will provide them where the law requires. Where the law allows, we may withhold specific details whose disclosure would help someone get around cheat or fraud detection, and we will tell you when we do. You can also complain to your data protection authority.

6. Who processes data for us

Provider	What they do
Stripe	Payment processing, subscriptions, invoices and the customer billing portal. Stripe acts as an independent controller for some payment data; see stripe.com/privacy.
Cloudflare	Network security, DDoS protection and content delivery for xetodus.com. Your traffic, including your IP address, passes through Cloudflare.
Google	Only if you choose Google sign-in (authentication).
Email delivery	Our email service provider sends account emails such as verification and sign-in codes.
Hosting	The game servers and database run on hardware operated by Legend Games LLC.

7. International transfers

Legend Games LLC is based in the United States and our servers are in the United States. If you play from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the US. Where our processors transfer data, they rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU–US Data Privacy Framework where they are certified.

8. Security

Passwords are hashed with Argon2id, two-factor secrets are encrypted, connections use HTTPS, staff access to player data is limited to administrators and moderators, and staff actions are logged. You can protect your account further with two-factor authentication or a passkey in Account settings. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live you have the right to access your data, to rectification of inaccurate data, to erasure, to data portability, to restrict or object to processing, and to withdraw consent at any time. In the game, Account settings lets you correct your email and security settings, Download my data gives you a copy of your account data in a machine-readable file, and Delete my account erases it. For anything else, email [email protected] with the subject "Privacy" from your account's email address. We answer within one month and may need to verify your identity.

If you are in the EEA or UK you can also complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.

10. California and other US state privacy rights

If you live in California (CCPA/CPRA) or another US state with a comprehensive privacy law, you have the right to know what personal information we collect and how we use it (sections 2–6), to access and delete it, to correct it, and not to be discriminated against for using these rights. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We do not use sensitive personal information to infer characteristics about you. To make a request, use the in-game tools or email [email protected]; an authorized agent may act for you with written permission.

11. Children

XETODUS is not directed at children under 13 and you must be at least 13 to create an account, or older where the law of your country sets a higher age for consent to online services (for example 16 in some EU countries) unless a parent or guardian consents. If we learn that we hold data of a child below the applicable age without that consent, we delete the account. Parents can contact [email protected].

12. Changes

We will update this policy when the game or the law changes and show the date at the top. If a change is significant we will tell you in the game or by email before it takes effect.

13. Contact

Legend Games LLC. Email: [email protected] (subject "Privacy").