Privacy
Last updated: 6 November 2026
What this game keeps about you, and for how long. The short version: very little, and nothing with your name on it.
Who runs this
Heirs of Vaeloryx is run by [TO FILL: name and country of whoever is responsible].
Questions and requests go to [TO FILL: a contact email].
On your device
Your game is saved in your browser’s own storage on this device: the current game, older copies of it, your settings, and which hints you’ve seen. It stays there until you clear your browser’s data. The game sets no cookies.
On our server
Once there’s something worth keeping, after about a minute of play or a finished fight, the game quietly makes an anonymous account so your save can sync. While we’re testing, that may need an invite link. Without one, nothing leaves your device. The account holds:
- A random account ID, and a random ID for each linked device, with when it was linked and last seen.
- A scrambled copy (a hash) of each device’s secret token. The token itself stays on your device.
- Your current save and up to 5 older ones. A save is the state of your game: ship, crew, cargo, credits, where you are.
- A pairing code, if you ask for one to link another device. It lasts 10 minutes.
We don’t ask for a name, an email address or a password, and the account holds none.
How long we keep it
- An account with no save, and no device seen for 24 hours: deleted.
- An account no device has touched for 12 months: deleted, with everything in it.
- Deleted data is overwritten in the database at once. Copies of it leave our backups as those age out on a rolling basis: we keep the 14 most recent nightly backups on the server, and UpCloud’s own backups of the server’s disk, which hold those too, last [TO CHECK: how long UpCloud keeps them].
IP addresses
Neither the game’s server nor the web server in front of it logs IP addresses. The game’s server looks at yours to limit how many requests one address can make. That’s held only in memory and never written to disk.
The server’s operating system logs connections to its login port and those its firewall blocks, addresses included, for up to two weeks. That isn’t game traffic, but it’s an honest place to mention it.
Who else handles your data
- Cloudflare carries all traffic between you and our server, these pages included. It sees your IP address and handles what you send and receive, under its own privacy policy. Its network is worldwide, so traffic can pass through it outside the EU.
- UpCloud runs our server, and keeps its disks and backups, in Frankfurt, Germany.
We don’t sell your data or share it with anyone else.
No ads, no trackers
No ads, no analytics, no tracking and no third-party scripts or fonts. Everything on these pages and in the game comes from our own server.
Deleting your data
In the game, open Save and sync from the menu, then press Delete my data and confirm. That deletes your account, its saves and its backups from the server at once, for every linked device. Your game on this device stays until you clear your browser’s data, and our backups lose their copies as they age out, as above.
Your account has no name on it, so we can’t look it up for you. The button is the way. If you’ve lost every device, the account deletes itself after 12 months.
Your rights
We keep this data to do what you’d expect: keep your game and sync it between your devices. You can ask what we hold about you, have it corrected or deleted, or take a copy (Export, in the same panel, gives you your save as a file). You can also complain to your local data protection authority.
Changes
When this page changes, so does the date at the top. If a change matters, it’ll be in What’s new as well.