Privacy Policy

Old Light stores as little about you as it can while still running a persistent multiplayer game. Everything it does store is listed below. Old Light is run by Arjen Postma as a personal project, based in the Netherlands, and "Old Light" on this page means that operator. You can reach the operator through the contact page.

What we store

When you create an empire, you choose a display name. That name is the whole required account: it is visible to other players in the galaxy and, once your empire meets the conditions described under Public player profiles below, it is also published on a public web page that search engines index. Everything you do in the game (systems, buildings, fleets, messages, battle reports) is stored under that name on our servers so the galaxy keeps running while you are offline.

Messages you send to other players are private between the two of you inside the game, and no other player can read them. We can read them. The terms forbid abusive messages and harassment, and we have an operator tool that can list the conversations in a galaxy and open any of them; we use it to act on reports and to look into spam, and for nothing else. That rests on our legitimate interest in keeping the game usable and its players safe, and you can object to it through the contact page. Messages are deleted a year after they are sent. They can go sooner: a very long conversation keeps only its most recent messages, and when an empire is removed from the galaxy its messages are deleted with it, which also removes them for the other player in the conversation.

The terms allow us to limit how many actions an account can take in the game. If we apply such a limit to your account, we record on the account which limit is applied, when it was set, who set it, and a short note the operator writes about why. We keep that record so the limit can be reviewed and lifted later, and we use it for nothing else. If you think a limit on your account is wrong, tell us through the contact page and we will look at it again.

Signing up also issues you a login token. The token is generated randomly, and we store only a sha256 hash of it on the server. The raw token lives in your browser's localStorage so you stay logged in on that device.

We record the IP address a signup came from. It is used to limit signup abuse, for example capping how many unverified accounts can be created from one address. We also record how the account was created, for example through itch.io or directly on the site, so we can see where players come from.

If you arrived through another player's invite link, we record which account invited you, so we can place you in the same galaxy as the friend who brought you in. Your own invite code is derived from your account and is not shared beyond the people you send it to.

Game data and account data are kept for different lengths of time. An empire that sits inactive long enough is cleaned up automatically: small empires are removed from the galaxy, and larger ones are handed over to a computer-controlled player and disconnected from your account. How long that takes depends on the size of the empire and whether the account is verified; a small or unverified empire can be cleaned up in as little as a week, and we keep even the largest verified empires for no longer than about 8 months after your last activity. Account records, such as your display name, email address, sign-in data, and the signup IP, are kept until you ask us to delete them through the contact page. The legal grounds: game data is processed because it is needed to run the game you signed up for. Abuse-related data such as IP limits rests on our legitimate interest in keeping the service usable. Optional game and lifecycle emails rest on your having added and verified an address to receive them, which you can stop at any time through the unsubscribe link in any such email or the toggles in Settings.

Public player profiles

Once your account is verified, has been active within the last 30 days, and holds at least two star systems, we publish a public profile page for your empire at a page under oldlight.io/player/, and generate a share-card image for it. Everything shown there is already visible to other players inside the game: your empire name, crest, rank, score, the number of systems and sectors you hold, the month you joined, the complete list of every system you hold, by name, with each system's score, the sectors you control, and a map of your territory. It does not show your email address, buildings, economy, fleet, credits, or anything about when you were last online. Your empire name and a link to your page also appear in the neighbouring-empires list on the profile pages of up to twelve empires whose systems sit near yours. These pages are indexed by search engines and listed in a public sitemap, and the share-card image is what appears when a link to your profile is posted elsewhere.

Your profile stops being published as soon as your account falls outside that gate, for example if you go inactive, drop below two systems, or your empire is eliminated.

You can also take it down at any time, whether or not you still meet the gate. Open Settings in the game and switch on "Hide my public profile". The page, its share-card image, and the sitemap entry then stop being served within a few minutes, and other players' profiles stop linking to yours. Your empire itself is unaffected: nothing is deleted, and you remain visible to other players inside the game exactly as before. You can switch it back on later from the same place. If you would rather not do it yourself, ask us through the contact page and we will set it for you.

We publish these profiles because we have a legitimate interest in the game being found and shared. That is the legal basis, so you have the right to object to it, and the setting described above is how you exercise that right. Search engines and social platforms that already indexed or cached the page or its share image may keep showing that copy for a while afterward; we cannot force an outside cache to update immediately.

The game itself has no way to change an empire's name. If your empire name identifies you and you would rather it did not, ask us through the contact page and we will rename it for you.

Your email address

Email is optional; you can play without ever giving one.

If you add an email address, it is used to verify that the address is yours and to log you in on other devices through a magic link. Beyond that, game and lifecycle emails (such as onboarding tips or a notice that your empire is under attack) are sent only after you have verified the address, and every category of those emails has its own unsubscribe link in the email footer as well as a toggle in Settings. The verification email is the only message ever sent to an unverified address; login links and everything else go only to addresses that are already verified.

Emails are delivered through Resend, a third-party email provider, which processes the recipient address in order to send the message. Their handling of that data is described in the Resend privacy policy.

Analytics

We use Simple Analytics to count page visits. It is cookieless and collects no personal data, so there is no fingerprinting and no cross-site tracking. Details are in the Simple Analytics privacy policy.

Error monitoring

We use Sentry to find out when the game breaks. When an error happens in your browser or on our server, an error report is sent to Sentry. That report can include your IP address, your browser details, and the page you were on. We configure it not to include your email, name, or session tokens. Sentry is operated by Functional Software, Inc. in the United States, certified under the EU-US Data Privacy Framework. Their handling of error reports is described in the Sentry privacy policy.

Cookies

Old Light sets no tracking cookies. Your login token is kept in localStorage, not in a cookie. A few other small values are stored in your browser the same way: your player id, how you arrived at the site, any invite code from an invite link, and flags remembering which prompts you have dismissed. The invite code is kept until you create your empire and is then removed.

Hosting

The game runs on Railway, a hosting provider, which processes network traffic as needed to serve the site. Their handling of that traffic is described in the Railway privacy policy.

Resend and Railway may process data outside the European Union. Resend is certified under the EU-US Data Privacy Framework, and Railway provides a data processing agreement that includes the EU Standard Contractual Clauses. Both are described in their privacy policies linked above.

What we never do

We show no ads. We do not sell or rent your data to anyone, and it is not shared with any third party beyond the processors named above.

The contact page

A message sent through the contact page is emailed to us through Resend, together with the email address you enter so we can reply. If you are logged in when you send it, your player name and account are attached so we know which empire the message concerns. The sending IP address is used to limit abuse of the form. Contact messages arrive as email and are kept for as long as we need them to handle your request, then deleted.

Children

Old Light is not directed at children under 13, and we do not knowingly collect personal data from them. If the law where you live sets a higher age for using online services without parental permission, that higher age applies. If we learn that an account belongs to a child below the age that applies to them, we will delete it.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we process it, or object to how it is processed. Where the data you gave us is handled by automated means based on your consent or our agreement with you, you can also ask to receive it in a portable form. All of it goes through the contact page. If you believe we are handling your data unlawfully, you can complain to your data protection authority. In the Netherlands, where Old Light is operated, that authority is the Autoriteit Persoonsgegevens.

Deleting your account

If you want your account and its data deleted, ask us through the contact page and we will remove it.

Changes

If this policy changes, the updated version will be published on this page.