Privacy Policy

Old Light stores as little about you as it can while still running a persistent multiplayer game. This page lists exactly what that is, in plain language. Old Light is run by Arjen Postma as a personal project, based in the Netherlands, and "Old Light" on this page means that operator. You can reach the operator through the contact page.

What we store

When you create an empire, you choose a display name. That name is the whole required account: it is visible to other players in the galaxy, and everything you do in the game (systems, buildings, fleets, messages, battle reports) is stored under it on our servers so the world keeps running while you are offline.

Signing up also issues you a login token. The token is generated randomly, and we store only a sha256 hash of it on the server. The raw token lives in your browser's localStorage so you stay logged in on that device.

We record the IP address a signup came from. It is used to limit signup abuse, for example capping how many unverified accounts can be created from one address. We also record how the account was created, for example through itch.io or directly on the site, so we can see where players come from.

Game data and account data are kept for different lengths of time. An empire that sits inactive long enough is cleaned up automatically: small empires are removed from the galaxy, and larger ones are handed over to a computer-controlled player and disconnected from your account. Account records, such as your display name, email address, sign-in data, and the signup IP, are kept until you ask us to delete them through the contact page. The legal grounds are simple: we process game data because it is needed to run the game you signed up for, abuse-related data (such as IP limits) because we have a legitimate interest in keeping the service usable, and optional emails only with your consent, which you can withdraw at any time.

Your email address

Email is optional. You can play without ever giving one.

If you add an email address, it is used to verify that the address is yours and to log you in on other devices through a magic link. Beyond that, game and lifecycle emails (such as onboarding tips or a notice that your empire is under attack) are sent only after you have verified the address, and every category of those emails has its own unsubscribe link in the email footer as well as a toggle in Settings. The verification email is the only message ever sent to an unverified address; login links and everything else go only to addresses that are already verified.

Emails are delivered through Resend, a third-party email provider, which processes the recipient address in order to send the message. Their handling of that data is described in the Resend privacy policy.

Analytics

We use Simple Analytics to count page visits. It is cookieless and collects no personal data, so there is no fingerprinting and no cross-site tracking. Details are in the Simple Analytics privacy policy.

Error monitoring

We use Sentry to find out when the game breaks. When an error happens in your browser or on our server, an error report is sent to Sentry. That report can include your IP address, your browser details, and the page you were on. We configure it not to include your email, name, or session tokens. Sentry is operated by Functional Software, Inc. in the United States, certified under the EU-US Data Privacy Framework. Their handling of error reports is described in the Sentry privacy policy.

Cookies

Old Light sets no tracking cookies. Your login token is kept in localStorage, not in a cookie.

Hosting

The game runs on Railway, a hosting provider, which processes network traffic as needed to serve the site. Their handling of that traffic is described in the Railway privacy policy.

Resend and Railway may process data outside the European Union. Resend is certified under the EU-US Data Privacy Framework, and Railway provides a data processing agreement that includes the EU Standard Contractual Clauses. Both are described in their privacy policies linked above.

What we never do

We show no ads. We do not sell or rent your data to anyone, and it is not shared with any third party beyond the processors named above.

The contact page

A message sent through the contact page is emailed to us through Resend, together with the email address you enter so we can reply. If you are logged in when you send it, your player name and account are attached so we know which empire the message concerns. The sending IP address is used to limit abuse of the form. Contact messages arrive as email and are kept for as long as we need them to handle your request, then deleted.

Children

Old Light is not directed at children under 13, and we do not knowingly collect personal data from them. If the law where you live sets a higher age for using online services without parental permission, that higher age applies. If we learn that an account belongs to a child below the age that applies to them, we will delete it.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we process it, or object to how it is processed. Where the data you gave us is handled by automated means based on your consent or our agreement with you, you can also ask to receive it in a portable form. All of it goes through the contact page. If you believe we are handling your data unlawfully, you can complain to your data protection authority. In the Netherlands, where Old Light is operated, that authority is the Autoriteit Persoonsgegevens.

Deleting your account

If you want your account and its data deleted, ask us through the contact page and we will remove it.

Changes

If this policy changes, the updated version will be published on this page.