Privacy policy

Visiting the website

This site measures traffic itself. It runs no third-party analytics, no advertising pixels, no social widgets and no embedded players — the browser makes no request to any host other than ryvakai.com, which is enforced by a Content-Security-Policy at the edge, not just by intention.

What is recorded, per page view:

• the path you visited, with any query string stripped before it is stored;
• the host of the referring site, if you arrived from one — never the full URL;
• a coarse device class (desktop, mobile, tablet) and browser family;
• a timestamp;
• and which of a short, fixed list of actions you took: clicking Download or the launcher, opening Discord, opening the changelog, opening a question in the FAQ, playing a trailer, opening the gallery, or turning the sound on. The list is closed — anything not on it is discarded rather than stored.

To count returning visits within a single day without identifying anybody, a visitor identifier is derived as HMAC-SHA256(daily_salt, IP + user agent), truncated. The salt is 32 random bytes regenerated every day and deleted after two days, at which point the identifiers are permanently unlinkable — they cannot be reversed to an IP address, and they cannot be joined across days by anyone, including us. Your IP address itself is never written to disk by this system.

The consequence, stated plainly: we cannot tell you how many unique people visited over a month, only the sum of daily figures. That is a limitation we chose on purpose.

If your browser sends DNT: 1, no measurement request is made at all. Nothing is stored in your browser for measurement or tracking, so there is nothing to consent to and no banner to dismiss.

Two things are stored in your browser, both only because you asked for them and neither used to identify you:

• If you turn the ambient sound on, a single localStorage key remembers that so it does not have to ask again. Turning it off clears it.
• If you tick Keep me signed in on the account portal, a session marker and a refresh token are held in sessionStorage — see the next section.

Separately, the web server keeps standard access logs, which do contain IP addresses, for security and abuse investigation. They roll over and are not used for analytics or combined with the data above.

If you create an account

An account is only needed for the pre-alpha client. Creating one stores:

• Your email address, as your login identifier.
• A password hash — argon2id, never the password itself. We cannot read, recover or tell you your password.
• Your role, when the account was created, and when it last signed in.
• Session records: a hash of each refresh token (never the token), its expiry, and the IP address and user agent of the sign-in. This is what makes it possible to detect a stolen session and revoke it.
• Your characters: name, archetype, appearance, stats, inventory, equipment, unlocked Techniques, position, region and playtime.
• Any structures your characters place in the world.

Sessions expire on their own: an access token lasts 15 minutes and a refresh token 30 days, rotated on each use. Signing out revokes it immediately.

What is held in your browser, and what is not. The access token is kept in memory only and never written to storage, so closing the tab discards it. If — and only if — you tick Keep me signed in, a session marker and the refresh token are written to sessionStorage, which the browser clears when the tab closes; signing out clears them immediately. Leave the box unticked and nothing at all is stored.

RYVAKAI is pre-alpha. Character data may be deleted or wiped between builds without warning while the save schema is still moving. Treat every test character as disposable — this is a development environment, not a service with a durability promise.

Who else sees any of it

Nobody. There is no advertising network, no analytics vendor, no CRM, no email marketing platform and no data broker in this system. Nothing is sold or traded.

The only third party involved at all is our hosting provider, which operates the server the whole stack runs on. If we were ever compelled by law to disclose something, we would comply with the law, and would tell you unless prohibited from doing so.

If you join the Discord, that is Discord’s service under Discord’s own privacy policy, and nothing you do there is connected to your game account by us.

Your choices

• Get a copy of everything stored against your account.
• Correct anything that is wrong.
• Delete your account and its characters. Ask, and it is done — there is no retention period we are clinging to.
• Browse anonymously: no account is needed to read any part of this site.

Ask in the Discord. It is the contact channel and it is read by the people who wrote the database schema, so a request goes to somebody who can actually action it.

Security, and its limits

Passwords are argon2id. Refresh tokens are hashed at rest and single-use, with reuse detection that revokes the whole token family. The database and cache are bound to loopback and are not reachable from the internet. Everything is served over HTTPS with HSTS.

That said: this is a pre-alpha run by a very small team. Do not reuse a password here that protects anything you care about, and do not put anything sensitive in a character name.

Children

The pre-alpha is not directed at children under 13, and accounts should not be created for them. If you believe one has been, tell us and it will be removed.

Changes

If this policy changes materially, the date at the top changes and the change is announced in the Discord. We will not quietly widen what is collected.