Last updated 17 October 2026

Privacy Policy

1. 1. Who we are
2. 2. What we collect
3. 3. What we do not collect
4. 4. Why we use it
5. 5. Legal bases (EEA and UK)
6. 6. Cookies, storage and Do Not Track
7. 7. Who we share it with
8. 8. How long we keep it
9. 9. Security
10. 10. Your rights
11. 11. California residents
12. 12. Children
13. 13. International transfers
14. 14. Changes
15. 15. Contact

1. Who we are

The Olde World: Online is operated by crkhaus studios, a sole proprietorship established in California ("we", "us"). For the purposes of the UK and EU General Data Protection Regulation, we are the controller of the personal data described here. You can reach us at legal@theoldeworld.com.

This policy covers the website at theoldeworld.com and the game served from it. It does not cover our Discord server or our subreddit, which Discord and Reddit run under their own privacy policies.

2. What we collect

2.1 Account details

To play you choose an account name and a password. We store:

• The account name, as you typed it. It is your login. Staff can see it; the leaderboard never shows it. It does not have to be your real name, and we recommend it is not.
• A random salt and a scrypt hash of your password. We never store the password itself and cannot read, recover, or tell you what it is.
• When the account was created, whether it has staff powers, a few account-wide settings, whether it has been shown the developer's welcome letter, and, if staff have cleared a forgotten password for it, when.

2.2 Characters and game data

An account holds several characters (currently up to five). Each has its own character name, which every other player sees in the game, so choose it with the same care. So the world survives a restart, we store what each character is and where it left off: its appearance, position, statistics, skills and the effects on it, its settings (such as whether it allows crimes), the items it carries, wears and keeps in the bank, its houses and pets (with any names you give them), its corpse if it has one, and when it was created and last played. This is game state tied to your account, not information about you as a person.

2.3 The public record

The game keeps count of what characters do, and anyone can look a character up on the front page's leaderboard without logging in, or follow a link straight to its card. A card shows:

• the character's name, when it was created, the date it last played (never the time), and its total time played;
• its player-versus-player record: kills, deaths, assists, innocents killed, streaks, its rank, and the names of the character that has killed it most and the one it has killed most;
• its hunting: creatures and people slain, its favourite prey and strongest kill, and what has killed it;
• its best skills, its stats, and how many writings, techniques, pets and houses it has.

A card never shows the account name, where the character is, its gold or items, or whether it is online right now. Deleting a character deletes its record. A staff character's card shows only its name and that it is staff.

2.4 Chat

Chat is relayed between players in memory and is not written to our database or our logs. Other players can of course read what you say and keep their own record of it, and staff may see messages in the moment for moderation. Never type anything into game chat that you would not want a stranger to keep.

2.5 Help requests and bug reports

When you ask staff for help (the help window, /ticket or /bug), we keep what you write and what staff write back, which account and character sent it, where the character was (the nearest named place and its position), and when. A bug report also carries details from your browser so we can reproduce the problem: the game's build, your browser's user-agent string, the name of your graphics card, your window size and pixel density, your frame rate, and the last few errors the game hit.

2.6 Logins and moderation

Each time a character enters the world we record the account, the character, when the session started and ended, and the IP address it came from. For an IPv6 connection these records keep only the first half of the address (the block your provider assigns to your connection), not the whole of it. We use them to:

• enforce bans, including bans on an address;
• show staff which accounts have played from the same address in the last 30 days;
• keep the leaderboard honest, since a kill between two accounts on one connection does not count;
• work out each character's time played for the public record.

We also keep a record of moderation: bans and mutes, with their reasons, who gave them, and when they end. Some protections run on their own: chat that floods is refused, and six refusals inside a minute mute the speaker for two minutes; logins and new accounts are limited per address, and repeated wrong passwords make that address wait; and new character names are checked against a profanity filter.

2.7 Error reports

If the game hits an error in your browser, it sends our server the error message, where in our code it happened, and which build you are running. The server writes that to its log with your character's name (or your account number, before a character is chosen) so we can find and fix the fault. These reports are about our code, not about you.

2.8 How the game runs for you

While a character is in the world, the game sends our server a short report on how it is running for you, once a minute and once more when you close the page:

• your frame rate, the middle value over the last minute;
• the quality of your connection: how long a message takes to reach our server and come back, and how often your connection stalls;
• your time zone as your browser names it (for example Europe/Berlin), which tells us roughly what part of the world you play from;
• your progress through the first-day tutorial: the step you are on, whether you turned it down, closed it or finished it, and which of its goals you have done.

The server writes each report to its log as one line under your character's number, with no name. We use these reports to find where the game runs badly or loses new players, so we can fix it.

2.9 Server logs

Two servers keep logs, which we use for security, rate-limiting, abuse investigation, and diagnosing faults:

• The web server logs each request: your IP address, the date and time, the page or file requested, the response status, the page that linked to it, and your browser's user-agent string.
• The game server logs each connection and the IP address it came from, logins it refused and why, staff actions, the error and performance reports above, and some game events by character name.

We do not use the web server's logs to build a profile of you or to link your browsing to your play.

3. What we do not collect

To be unusually specific, because most policies are not:

• No email address. There is no email field anywhere. That is also why there is no password reset by email: only staff can clear a forgotten password, by hand.
• No real name, date of birth, postal address, or phone number.
• No payment information. The alpha is free and we take no payments, so we hold no card or bank details.
• No third-party analytics or advertising. There is no Google Analytics, no pixel, no ad network, no A/B testing tool, no session recorder, no heatmap, and no third-party error-reporting service. The game reports its own errors (section 2.7) and how it is running for you (section 2.8) to our own server.
• No third-party requests at all. Every file the site and the game load, including scripts, fonts, images, models and sounds, is served from theoldeworld.com. Loading these pages, or playing, contacts no other company.
• No cookies. See section 6.
• No sale or sharing of personal information, ever, for any price.

4. Why we use it

• To run the game. Authenticating your login, restoring your characters, and keeping the world consistent between sessions.
• To keep it working, fair and safe. Diagnosing crashes, bugs and poor performance, finding where new players get stuck, blocking abuse, rate-limiting, enforcing bans and our Terms of Service, and keeping the leaderboard honest.
• To answer you. Your help requests in the game, and your emails if you send any.
• To keep the public record. The leaderboard and character cards in section 2.3.
• To comply with the law where we are required to.

We do not use your data for advertising or profiling. The automatic protections in section 2.6 can refuse a line of chat, mute someone for two minutes, make a login wait, or turn down a character name. None of them has legal or similarly significant effects, and staff can lift a mute that caught you by mistake.

5. Legal bases (EEA and UK)

If the GDPR or UK GDPR applies to you, we rely on:

• Performance of a contract (Art. 6(1)(b)) for account details, characters and game data, and help requests, since without them we cannot provide the game you asked for or answer you.
• Legitimate interests (Art. 6(1)(f)) for login records and IP addresses, server logs, error, performance and bug reports, moderation records, and the public record: our interest in a secure, fair and working game with a public record of play, balanced against your interest in privacy. That is why the public record shows what characters did and never who plays them, and why none of it is used for advertising.
• Legal obligation (Art. 6(1)(c)) where we must retain or disclose something by law.

6. Cookies, storage and Do Not Track

We set no cookies, so there is no cookie banner on this site.

The game does use your browser's localStorage, which stays on your own device and is never transmitted to us as such:

• Settings and layout: video and audio settings, key bindings and macros, where your windows sit, your chat tab and hotbars, which guide lessons you have seen, how far you are through the tutorial (which the reports in section 2.8 include), the character you played last, and similar preferences.
• ow_name and ow_pass hold your login details, and only if you tick "remember me". With "log in automatically" also ticked, the game uses them to log you straight in.

Do Not Track and Global Privacy Control. We do not track you across other sites, and we do not sell or share personal information, so there is nothing for either signal to switch off: we treat every visitor as if they had sent one. No other company collects information about what you do here.

7. Who we share it with

We do not sell, rent, or trade your data. We share it only with:

• Our hosting provider, which operates the server the game runs on, in the United States, and therefore necessarily stores the database and logs on its hardware.
• Our staff. Game masters we appoint can see what moderation needs: who is online and where, an account's characters and moderation record, the address it plays from and the other accounts seen at that address in the last 30 days, and help requests and bug reports. They may use it for moderation only.
• Law enforcement or courts, where we are legally required to, or where we believe in good faith it is necessary to prevent serious harm. Given how little we hold, there is usually little to give.
• A successor, if the game is ever sold or transferred. You would be told first, and this policy would continue to apply until replaced.

Some things are public by design. Your character names, their appearance, and anything you say in chat are visible to other players, and your characters' records (section 2.3) are visible to anyone on the front page. We cannot control what other people do with what they see.

8. How long we keep it

• Account, characters and game data: for as long as the account exists. Deleting a character deletes it and its public record. Because the game is in open alpha, accounts, characters, and the world may also be wiped at any time as part of development, which deletes this data outright.
• Login records, with their IP addresses: for as long as the account exists.
• Moderation records (bans and mutes): for as long as the account exists, so staff can see its history.
• Help requests and bug reports, with their replies: for as long as the account exists.
• The web server's access logs: kept on a short rotation, ordinarily no more than 30 days, then deleted.
• The game server's log, including connection IP addresses and error and performance reports: kept with no fixed time limit while the game is in alpha.
• Email you send us: kept as long as needed to deal with the matter and any follow-up.

9. Security

• All traffic to the site and the game server is encrypted with TLS.
• Passwords are stored as scrypt hashes with a unique random salt per account and compared in constant time. A copy of our database would not reveal anybody's password.
• Staff never see or choose your password. To help someone who has forgotten theirs, staff can only clear it, and the next login within 24 hours sets a new one.
• Logins are limited per address, and repeated wrong passwords for an account make only the address they came from wait, so nobody can lock you out of your own account by guessing at it.
• The game server and internal services are bound to the local machine only and are not reachable from the internet except through the front-end web server.

No system is perfectly secure, and this one is an alpha built by one person. Please use a password you do not use anywhere else. If we ever discover a breach affecting your data we will say so publicly and promptly, and notify regulators where required.

10. Your rights

Wherever you live, you may ask us to:

• Access the data we hold about your account, and get a copy.
• Correct anything inaccurate.
• Delete your account and its data.
• Port your data to yourself or another service in a machine-readable form.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent, where we relied on it.

The simplest way to ask is from inside the game: send a help request (/ticket), which also shows the account is yours. Or email legal@theoldeworld.com from wherever you like, with your account name. Because we hold no email address, we may ask you to prove control of the account by logging in and confirming something in the game before we act on an emailed request. We will respond within 30 days, free of charge.

You can delete a character yourself on the character screen, which also deletes its public record. A whole account is deleted on request. Deletion is permanent and cannot be undone, and it takes the account's characters, items, pets and houses with it.

If you are in the EEA or UK and think we have handled your data badly, you may complain to your national data protection authority, and we would rather you told us first.

11. California residents

Under the California Consumer Privacy Act as amended by the CPRA, you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising them.

• We have not sold or shared personal information in the preceding twelve months, and we do not do so now. There is no "Do Not Sell or Share My Personal Information" link because there is nothing to opt out of.
• We do not use or disclose sensitive personal information for any purpose beyond providing the service.
• Categories collected in the preceding twelve months: identifiers (account and character names, and IP addresses), internet or other electronic network activity (server logs, login records, error reports, and performance reports with your time zone), and the browser and device details a bug report carries. Sources: you, and your browser. Purposes: as set out in section 4. Recipients: as set out in section 7. Retention: as set out in section 8.
• To exercise a right, email legal@theoldeworld.com. You may use an authorised agent, and we will verify their authority.

12. Children

The Service is for adults. You must be 18 or older to have an account, and logging in confirms that you are. We do not knowingly collect personal data from anyone under 18, and there is no part of the game aimed at children.

If you believe a minor has created an account, tell us at legal@theoldeworld.com and we will close it and delete the data.

13. International transfers

Our servers are in the United States. If you play from outside the United States, the data described here goes straight from your device to our servers there and is stored there, in a country whose data protection laws may differ from your own. We hold none of it in the EEA or the UK.

14. Changes

We may update this policy. The date at the top always reflects the current version, and for material changes we will give notice on the website or in the game before they take effect.

• 17 October 2026. The game now tells our server how it is running for you: your frame rate, the quality of your connection, your time zone, and your progress through the tutorial (section 2.8).
• 13 October 2026. Brought up to date with the game as it now is: several characters per account, login records with IP addresses, moderation records, help requests and bug reports, error reports, the public leaderboard, staff password resets, and the game server's log. Added Do Not Track and Global Privacy Control, and rewrote the section on international transfers.
• 20 August 2026. First version.

15. Contact

crkhaus studios
A sole proprietorship established in California
legal@theoldeworld.com

See also our Terms of Service.