Privacy Policy

1. Who is the data controller

The data controller is the publisher of Severborn, reachable at contact@playseverborn.com. Any question about your data can be sent to that address.

2. What data we collect

2.1 Account data

• Email address and password when you create an account. The password is never stored in clear text: it is hashed by our authentication provider, and we have no access to it.
• Google Sign-In (optional): if you choose this method, Google gives us your email address and your Google account identifier so we can create and recognise your game account. We do not receive your Google password, your contacts, or the contents of your mailbox.
• Invitation code, when access to the game is restricted.

2.2 Location data (sensitive data)

The game is built on your real position: engagement zone, nearby encounters, local weather. The app therefore requests the Android permissions ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION. You can refuse or revoke this permission at any time in your device settings; the game then becomes unplayable, but your account remains intact.

We apply three safeguards:

• No exact coordinates are ever stored. Your position is rounded to a grid of roughly 50 metres before it is written to the database.
• Limited retention. Your in-game position stays active for at most 6 hours after your last signal (the time your character remains exposed in the world), then it is deleted. The last GPS reading, used to recentre the map when you come back, is erased after 7 days. Positions attached to PvE encounters are erased after 30 days. We keep no movement history beyond that.
• Limited visibility. Other players never see your coordinates: they only perceive an approximate presence nearby, under the conditions defined by the game.

2.3 Game data

The character(s) you create, their name, attributes, progression, inventory and economy, the history of your fights and encounters, clan membership, and the content you deliberately publish in the game (messages, testimonies). This data is inseparable from the service: it is your game.

2.4 Device data

• Push notification token (a technical identifier issued by Firebase Cloud Messaging), platform (Android, iOS or web) and app version. This token is used solely to send you in-game notifications (combat preparation, activity completion). It is deleted when you log out or decline notifications.
• Technical connection data (IP address, timestamps, browser type), processed by our host and our database for security and abuse prevention.

2.5 What we do not collect

• No advertising identifier, no advertising SDK, no ad network.
• No audience measurement or behavioural tracking tool.
• No access to contacts, photos, microphone, camera, SMS or files.
• No health, biometric, financial or payment data.

3. Why we use it

4. Who we share it with

We neither sell nor rent any data. We share it only with the technical providers strictly required to run the service:

• Supabase — authentication, database and storage. Processes account, game and location data.
• Google Firebase Cloud Messaging — delivery of push notifications. Receives the device token and the notification content.
• Google Sign-In — only if you choose to sign in with Google.
• Open-Meteo — in-game weather. Receives deliberately degraded coordinates (rounded to ~11 km) and no player identifier.
• CARTO and OpenStreetMap — primary and fallback map tiles. When the map is displayed, your device requests tiles directly from these services, which therefore see your IP address and the area you are viewing.
• Our hosting provider — the servers the game runs on.

We may also disclose data where the law requires it, or to establish, exercise or defend a legal claim.

5. Transfers outside the European Union

Some providers (notably Google) may process data outside the European Union. Such transfers are covered by the European Commission’s standard contractual clauses or by an adequacy decision.

6. How long we keep it

• Location: in-game position 6 hours, last GPS reading 7 days, PvE encounter positions 30 days, then automatic deletion. Deleting a character erases its position immediately.
• Account and game data: as long as your account exists, then deleted within 30 days of your request.
• Push token: until you log out, uninstall the app or withdraw the permission.
• Technical logs: 12 months at most.

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time (by revoking the location or notification permission in your device settings).

Deleting your account and your data

Send a request from your account’s email address to contact@playseverborn.com with the subject “Account deletion”. We delete the account, the characters, the positions and the associated tokens within 30 days. Technical logs required for security may remain until they expire.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the supervisory authority of your own country.

8. Security

Traffic is encrypted end to end (HTTPS only, never cleartext). Database access is governed by Row Level Security rules: each player can read and modify only their own data. Passwords are hashed. As no system is infallible, we will inform you without delay of any data breach likely to result in a high risk to your rights.

9. Children

Severborn contains mature themes and combat, and is not intended for people under 16. We do not knowingly collect data about a child under 16. If you hold parental responsibility and believe your child has provided us with data, write to us: we will delete the account.

10. Changes

This policy may change as the game evolves. The date of the last update appears at the top of this page. In the event of a substantial change (a new category of data, a new recipient), we will inform you in the app before it takes effect.