Privacy Policy
Version 2026-10-27-v6 (updated 2026-10-27 to add an optional analytics choice and simplify the notice wording). This explains what personal data Enigma collects when you use the website and game, why, who sees it, and your rights. The operator ("we") is Enigma, an independent game project based in the United States. Privacy contact: privacy@playenigma.net.
What we collect
Account: your username, email address, a salted hash of your password (never the password itself), the time you accepted our terms and which version, and a timestamp showing you confirmed you are at least 16. You enter your birthdate once to confirm age; we do not keep it. Game: your characters and their progress, items, and the gameplay events needed to run the world. In-game chat is relayed live; we do not keep a long-term chat archive, but reports may be kept for moderation. Security: the time, IP address and browser of sign-ins and sessions, and failed attempts. Optional: whether you want news emails, whether a character page is public, and any Discord or Google account you link (we receive its ID, name and verified email, nothing else). If you link Discord, our Discord server's bot uses your Discord ID to give you roles in the Enigma Discord server (such as Adventurer, your class and your level tier). If you turn on Raven messages with the /raven command, we use your linked Discord ID to send you private messages about in-game mail and auction results for your characters while they are offline: the sender, the subject and any money amount, never the body of a letter. If you open a support ticket there, we keep its messages in a private staff channel. If your game account is banned, we may also ban the linked Discord account from our server.
Why we use it, and our legal bases
- To create and run your account and the game: contract (our terms).
- To keep accounts and servers secure, prevent cheating and abuse, and handle reports: legitimate interests.
- To send verification, password and security emails: contract and legitimate interests.
- To send news, link Discord or Google, give you roles in our Discord server after you link Discord, or send you Raven messages on Discord if you turn them on with /raven on: your consent, which you can withdraw at any time in the dashboard or with /raven off (unlinking Discord removes your roles and stops Raven messages).
- To show a character's public page and its lookups in our Discord server (such as the /who and /character commands): legitimate interests. New characters are public by default, and you can make any character private at any time in the dashboard.
- To run support tickets and moderate our Discord server: legitimate interests.
- To meet legal duties and respond to lawful requests: legal obligation.
We do not sell your data, share it for advertising, or use it for automated decisions with legal effects.
Cookies
We set one cookie of our own, enigma_session, to keep you signed in; it is httpOnly and is used only with our API. We use no advertising cookies. If you press Accept on the cookie notice on our website pages, we also use Google Analytics, which sets its own cookies (_ga and _ga_*) and sends anonymous usage data, such as the pages you view and your approximate location, to Google so we can see how visitors find and use the site. It is off until you accept, it is never loaded in the game itself, and Google signals and ad personalization are disabled. Press Decline, or use Cookie settings in the page footer, to turn it off and clear those cookies; a browser that sends Global Privacy Control is treated as a refusal. Cloudflare, which protects our servers and runs the Turnstile check on forms, may set its own security cookies. Your browser may also store game settings, such as graphics options, on your device.
Who processes your data
We use these providers, who process data for us: Vercel (website hosting), Cloudflare (DNS, network protection and Turnstile), Resend (sending email), and an infrastructure provider that hosts our game and account servers. If you choose to sign in with Discord or Google, they process the sign-in; Discord and Google may also receive technical data from your browser. Discord also hosts our community server; what you post there is governed by Discord's own privacy policy as well as this one. When you set a password, our server checks it against the Have I Been Pwned list of breached passwords; only a short fragment of a hash leaves our server, never the password, and the lookup does not include your account details. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
International transfers
We are in the United States and our providers operate in the United States and elsewhere, so your data is processed in the US and may be processed in other countries. Where the law requires a safeguard for transfers from the EEA, UK or Switzerland, we rely on the safeguards our providers offer, such as Standard Contractual Clauses or Data Privacy Framework certification.
Public information
Characters are public by default. On 2026-10-27 every existing character was also made public. You can make any character private at any time in the dashboard. A public character page can be seen by anyone and may be found by search engines. It shows the character's name, level, class, equipped gear and appearance, and achievements. It never shows your inventory, bank, money, email or account details. Commands in our Discord server can show a public character's name, level, class and region to everyone in the server; characters set to private are never shown. Please do not use your real name as a character name.
How long we keep it
- Account and character data: while your account exists. After deletion (7 day cooling-off), it is removed from our live database.
- Sign-in history: 12 months, then deleted automatically. Sessions are deleted when they expire or you sign out.
- Web server logs (including IP addresses): up to 14 days.
- Raven message log (that a message was sent, never its text): 30 days.
- Support tickets: the ticket record is deleted after 12 months, and the transcript in our private staff channel is deleted when no longer needed, within 12 months.
- Backups: up to 35 days, after which deleted data is gone from them too.
- Email address of a deleted account: removed with the account; we may keep a record of a ban to keep the person from returning.
Your rights
Depending on where you live (for example the EEA, UK, or California), you can ask to access your data, correct it, delete it, restrict or object to its use, receive a portable copy, and withdraw consent. You can do much of this yourself in the dashboard: change your email and password, turn news emails on or off, sign out other devices, review sign-ins, make characters public or private, and delete your account. For anything else, email privacy@playenigma.net; we reply within one month and may ask you to verify your identity first. We will not treat you worse for using your rights. California residents: we do not sell or share personal information as defined by the CCPA, and we collect the categories above (identifiers, account and game activity, internet activity such as IP address) from you and your browser, for the purposes above. If you are in the EEA or UK you can also complain to your local data protection authority, such as the UK ICO.
Age
Enigma is for people aged 16 and over, and we do not knowingly collect data from younger children. If you think someone under 16 has an account, email privacy@playenigma.net and we will remove it.
Security
We protect data with encrypted connections, hashed passwords, access limits and rate limits. No system is perfectly secure; if a breach puts your data at risk we will tell you and the authorities where the law requires.
Changes
If we change this policy in a material way we will tell you before it takes effect, by email to verified addresses or a notice on the site, and change the version above. See also our Terms of Service.
Contact
Enigma, United States. Email: privacy@playenigma.net.