Privacy

The platform is run by Placeholder Legal entity, owner to supply.

Region where data is held: Placeholder Region, owner to set.

Contact: Placeholder Contact address, owner to supply.

The website is a set of static pages. It has no sign-in and no forms, and it asks you for nothing. The website itself sets no cookies and stores nothing in your browser.

Placeholder Owner to confirm that Cloudflare bot protection stays off on this domain. Its security cookies would make the sentence above untrue.

Cloudflare serves these pages, so every request passes through it. Like any web host, it sees your IP address and the details of the request. Logs of those requests are kept for 30 days in Grafana and 30 days in Cloudflare analytics, then archived for 12 months with the client IP removed. These periods are provisional.

Placeholder Owner to confirm whether the 30 day Grafana copy includes the client IP.

When it is enabled, the home page, the join page and the not-found page load Cloudflare Web Analytics. It uses no cookies and no local or session storage, and it does not fingerprint your device. That is why this site has no consent banner, a position that is pending the owner's legal view. Cloudflare states that it discards the IP address of these requests at the nearest data centre and does not store it.

The rules, terms and privacy pages never load it. Data is kept for six months in Cloudflare, and unsampled beacon data for 7 days.

Links to Steam and Discord take you to those services, and their own policies apply there.

You sign in with Steam, in your system browser. You never type a password into the app. Steam tells us your SteamID64.

We store your SteamID64, display name, the date your account was created, your roles and your sessions. Session tokens are random and are stored only as a hash on our side. On your PC, the token is encrypted with Windows DPAPI. Staff accounts also hold an encrypted two-factor secret and hashed recovery codes.

Your account is also linked to its points ledger and payouts, storage slots with saved dinosaur data, entitlements, gifts, daily claims, supporter tiers and notifications.

The companion app builds a device fingerprint so that staff can detect alternate accounts and enforce bans. Those two purposes are why it exists.

The signals

Placeholder Owner to confirm these plain descriptions against the app before this page is final.

How each signal is protected

On your PC, the app hashes each signal with SHA-256, name and value together. It then keys that hash with an HMAC, using a key specific to this deployment that is built into the app. Only the result leaves your PC.

Raw hardware values never leave your PC. The app sends hashes only. The key is shared by every copy of the app in this deployment, so it is not a per-player salt.

Because the key belongs to this deployment, the resulting hashes cannot be compared with those of any other platform. An alternate account can be matched here and nowhere else.

What is stored

• A primary hash for the device.
• One keyed hash per signal.
• A confidence value.
• When the device was first seen, and when each account was last seen on it.
• The link between the device and the accounts that used it.
• A count of other accounts on the same device.

Who can see it

Staff from trial admin upward see the count of other accounts and an alternate account marker on the online list. Admins also see device status and linked accounts. Nobody sees raw hardware values, because the platform does not have them.

Device bans

A device ban is a separate, logged action with its own reason, and it shows how many accounts match before it is applied. It is never automatic, so that a household is not banned by accident.

How long, and who to ask

Retention: Placeholder Device data period, owner to set.

Questions about device data go through the contact route.

The game server records joins, leaves, chat lines, chat commands, kills and admin commands.

A mod on the game server samples each player's position, direction, status, animal class and growth four times a second, tied to the SteamID. This comes from the server, not from your PC.

Unless you are staff, your app never receives another player's position, because the server filters it out. The one exception is voice: your app receives the direction and distance of the players you can currently hear, as described below. Staff can see all players on a live map, and every time staff open it an audit entry is written.

The live stream of positions lasts about 5 minutes. A once-a-second history with a 100 metre grid cell is kept for 24 hours and then dropped. Short windows at the full rate are kept as evidence for as long as the related ban or appeal.

The raw game server log holds chat and Steam ids. It stays on the game host for 7 days and is not shipped anywhere. Only structured events with hashed identifiers go from the game host to our log monitoring service. This arrangement is proposed and not yet final.

Separately, game events and positions go from the game host to the platform's own API host, tied to your SteamID, and staff can search those events by SteamID.

When you connect to voice, your microphone audio is sent live to the voice server and on to players near you. It is routed and it is not recorded. If that ever changes, the terms and a notice in the app will change first.

While another player can hear you, their app receives your SteamID, your display name, and your direction and distance from them, so that your voice can be placed around them. Your app receives the same details about the players you can hear.

Voice runs on a self-hosted LiveKit server and does not pass through Cloudflare. Admins can see who is connected.

Placeholder Owner to confirm whether LiveKit Cloud is used as a failover. If it is, it joins the vendor list.

The server stores voice connection events and subscription status reports with the session and UTC time. They can be looked up by SteamID and time range, and are kept for 30 days.

Detection tools only raise flags. There are no automatic bans. A ban needs a person's decision and it produces a reference id.

An evidence pack is stored at each flag and with each kick and ban, and an admin can build one for a dispute. A pack holds an overview, findings, a timeline, vitals, a death snapshot, a device section, and the movement trails of the player concerned and of anyone within 100 metres. Your trail can be included if you were within 100 metres of the player concerned, even if nothing was raised against you.

Sanctions are kicks, timed or permanent bans, and device bans. If you are banned, you are told the reason. Every staff action goes into an admin log recording who did what, to whom and when.

Appeals run through a Discord ticket, which stays open to you after a game ban. The form asks for your SteamID64, the server, the time, your in-game state and your explanation. The reply quotes the reference id. Closing a ticket writes a transcript.

The platform collects no data about the players of other platforms.

Everything in this section is proposed and not yet final.

Logs that the platform's services ship to central logging identify a player by a short hashed id, made with HMAC-SHA256 and a log key, and not by SteamID64. The exception is the raw game server log described above, which holds Steam ids and stays on the game host. Staff can resolve a hashed id only through an audited admin tool. Discord user ids are hashed in the same way.

Among the logs of the platform's web services, a full IP address appears only in the web server access log. That log is kept for 30 days to enforce bans and for security and abuse review, has no archive, and is then deleted. It is held in Grafana. Application logs shorten IP addresses to the /24 or /48 network, and archives drop the IP field.

The game and voice servers also receive your IP address, because you connect to them directly.

Access tokens, stream tokens, voice tokens, two-factor codes and Steam sign-in parameters are never logged.

The app sends these automatically: crash and error reports, voice connection events, a sampled measure of how long map position updates take to reach the app, and the app version and operating system version with each API call.

It does not send your log files unless you choose to, your keystrokes or push-to-talk key, lists of your other programs or windows, raw hardware identifiers, or other players' positions. Audio is not sent as telemetry. Live voice is separate, and is covered above.

Crash reports go to Sentry. Before they are sent, the app strips your Windows profile path, IPv6 addresses and voice session ids.

Placeholder Owner to confirm whether crash reports are on by default, and whether the app can switch them off.

Placeholder Owner to confirm that the Sentry project does not store IP addresses.

Logs on your PC stay there unless you choose to upload them. The app keeps five files of 2 MiB, with sensitive values redacted.

You create a support bundle yourself. It is redacted a second time and zipped. You can attach it to a ticket by hand, or upload it with a single-use link to private storage, where it is deleted after 30 days. The ticket carries the bundle id.

Placeholder Owner to confirm that bundle upload will be offered.

These periods are recommended and provisional, because the owner has not approved them yet.

• Cloudflare for DNS, proxying, firewall, website hosting, Web Analytics, log delivery, traces, health checks, Workers, storage and staff access control.
• Grafana Cloud for server logs, metrics, traces, alerts and filtered edge logs. This choice is provisional.
• Sentry for crash and error reports from the companion app.
• Valve, through Steam, for sign-in.
• Discord for the community server, its bot, tickets, appeals and transcripts. Linking a Discord account is verified through Steam.
• Placeholder Hosting providers for the API, voice and game servers, and where they are, owner to supply.
• Placeholder Owner to decide whether third-party code running on the game server is listed here.
• Placeholder Payment provider for supporter purchases, owner to decide. None is offered today.

Placeholder Data subject rights, how to request access or deletion, and the legal basis, owner and legal review to supply.

Contact: Placeholder Contact address, owner to supply.

This draft will change before launch. When it is final, changes will be published on this page.

Effective date: Placeholder Effective date, owner to set.