Privacy Policy
This English translation is provided for convenience. The French version is the only legally binding one: Politique de données personnelles.
Shefira collects only what is strictly needed to let you play, keep your character from one session to the next and protect the game. This page explains what, why, for how long, and what your rights are (General Data Protection Regulation, GDPR).
1. Data controller
Mathéo Palmier (Echovillage), sole proprietor (entrepreneur individuel), 37 Hameau des Sagnes, 42130 Trelins, France, SIREN 104 531 561. Contact: contact@shefira.com.
2. What we collect
| Data | Why | How long |
|---|---|---|
| Nickname, character and guild names | Identifying you in the world and the chat (visible to other players) | As long as the account exists |
| E-mail address (optional) | Logging in to your account from any browser; it is also passed to Stripe to prefill the payment window. The game only writes to you when you ask, to send you a link to change your password: never any advertising. | As long as the account exists |
| Google or Steam identifier (if you log in through that service) | Recognizing you when you log in: the Google account identifier and its verified e-mail address, or only the Steam account number (SteamID). We receive neither your password, nor your contacts, nor your games. | As long as the account exists |
| Password (if you choose one) | Protecting the account. Stored only in hashed form (scrypt), never readable. | As long as the account exists |
| IP address and technical logs | Security: limiting the number of requests per address, detecting abuse, diagnosing outages. The request counter lives for only one minute; the web server and game server logs contain the IP address and time of requests. | Counters: one minute. Logs: 12 months at most |
| Game data | Characters (appearance, level, experience, position, gameplay statistics), inventory, gold and the history of their movements, portals discovered, chests opened, friends, blocked players, guild, Auction House sales, interface settings: running the game and keeping your progress | As long as the account exists |
| Reports and sanctions | Moderating the game: the reason and text of a report, the player reported; the sanctions imposed (mute, kick, ban), their duration and their reason | As long as the account concerned exists |
| Purchases | Delivering what you bought and keeping the accounts: the offer, the amount, the currency, the order status, its dates and the reference of the Stripe payment session. The payment itself is processed by Stripe; we neither receive nor keep your card number. | As long as the account exists; accounting records for 10 years (Article L123-22 of the French Commercial Code) |
Chat messages are not recorded: they are passed live to the players concerned and then forgotten by the server. Only the text you write yourself in a report is kept.
The database is backed up every night to a storage space separate from the server; each copy is erased after 30 days. Deleted data therefore disappears from the backups within 30 days at the latest.
We collect no profiling data and no advertising data, and we neither sell nor rent any data.
3. Legal basis
- performance of the contract (the terms of use and the terms of sale) for the account, the characters and purchases;
- our legitimate interest in protecting the game and its players, for security, moderation and connection logs;
- our legal obligations for keeping accounting records.
4. Cookies and local storage
Shefira uses no tracking cookies and no third-party audience measurement tools. Your browser only keeps, in its local storage:
- your session tokens (account and character), so you can reconnect without retyping your password;
- your interface preferences (sound, controls, display), also copied to your account;
- for the duration of the tab only, two display flags (return to the home screen, phone orientation banner dismissed).
These are essential for the game to work and therefore do not require consent. Clearing the site’s data in your browser deletes them. Only when you make a purchase, the payment window is loaded from Stripe’s servers, and Stripe may set its own technical cookies there (security, fraud prevention); see its policy.
5. Recipients and hosting
- Other players see your nickname, your character, its equipment, its level and what you write in the chat. Nothing else.
- Game masters also see reports and sanctions.
- Stripe Payments Europe, Ltd. (Ireland), for payments: it receives what you enter in the payment window, your account’s e-mail address if you have one, and the order reference. Stripe acts under its own policy, including for any transfers outside the European Union (standard contractual clauses).
- Google (Google Ireland Ltd.) and Valve (Steam), only if you choose to log in through them: you identify yourself on their page, and they confirm to us who you are. Each acts under its own privacy policy.
- Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), for sending password-change e-mails: it receives your e-mail address and the content of the message, only when you ask for it, and acts as our processor.
- Hosting: the game servers and the database are hosted in the European Union by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (+33 9 72 10 10 07).
No other third party receives your data, except where required by law.
6. Your rights
You can at any time access your data, correct it, ask for its portability, object to processing based on our legitimate interest, ask for its restriction or erasure, and set instructions for what happens to your data after your death.
Deleting your account is done in the game, on the website as in the iOS and Android apps: on your characters screen (“Back to Home” in the game’s settings), tap “Delete my account” under “Sign out”, then type the word asked for to confirm. Deletion is immediate and final; it only waits until none of your characters is still in the game. You can also ask for it by e-mail to contact@shefira.com, from your account’s e-mail address, or stating your nickname for a guest account.
The export of your data (in a readable file) and your other rights are requested at the same address. We may ask you to prove that the account really is yours. We reply within one month, which may be extended by two months for a complex request, in which case we will let you know.
Deleting the account erases your characters and all their game data, as well as the reports and sanctions that concern you; only the accounting records of your purchases are kept for the period stated above, detached from the account.
If you have forgotten your password, “Forgot your password?” on the login screen sends you a link valid for one hour to choose a new one. Without access to that address, write to us from another one, stating your nickname.
You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
7. Security
Connections to the game are encrypted (HTTPS and secure WebSocket). Passwords are hashed with a slow algorithm designed for this purpose. Access to the database is restricted to the operator. In the event of a data breach likely to harm you, you will be informed within the time limits set by the GDPR.
8. Minors
In France, a minor can consent alone to the processing of their data from the age of 15 (Article 45 of the French Data Protection Act, loi Informatique et Libertés). Under 15, creating an account requires the consent of a parent or legal guardian. If you are the parent of a child under 15 who created an account without your consent, write to us: we will delete it. Purchases by a minor require their parents’ permission (see the terms of sale).
9. Changes
This policy may change; the date at the top of the page is authoritative, and a significant change is announced in the game.