Voxelia — Privacy Policy

Version: 2026-10-28.1 · DRAFT · Last updated: 28 October 2026

This policy explains what personal data Voxelia ("the game", "we") collects, why, where it is stored, how long it is kept and what rights you have. Our principle is to collect as little as possible. Contact: playvoxelia@gmail.com.

1. What we collect

Google sign-in. If you sign in with Google, Google passes your e-mail address, your name and your profile photo to our authentication provider (Supabase), which stores them in your account record together with your Google account identifier. The game itself uses only an internal account identifier linked to that Google identity: it does not show, process or share your name or profile photo. Your e-mail address is used only to send you security notices (for example a sign-in from a new device) and to answer your requests.

Wallet sign-in. If you sign in with a wallet, the game stores your public EVM wallet address. A wallet address is public by nature. We never receive or store your private keys or recovery phrase.

Game data. Your characters (name, class, level, position, equipment, inventory, bank, skills, quests), in-game currencies and items, clan membership, in-game trades and the record of in-game actions. Currency and item movements are recorded in append-only ledgers so that duplication bugs and fraud can be detected.

Chat. Chat messages you send (all channels, including party, clan and whispers) are stored with your character and the time, to investigate scams, harassment and abuse.

Security and technical records. Session start and end times, rejected game commands and their reason, rate-limit violations and moderation actions. Your IP address is used to limit request rates (kept only in server memory) and appears in the game server's technical logs. An IP address is stored in the security log only when someone fails to access an internal server function.

Bug reports (optional). If you send a bug report, we receive the text you write and the diagnostic information shown to you before sending (game version, browser, screen size, frame rate, map and position, character name, level and class, recent combat and error lines). A screenshot is attached only if you choose to include it.

What we do not collect. Apart from the Google profile data described above, which stays in your account record at Supabase, we do not collect your phone number, location or contacts. The game uses no advertising or tracking cookies and no analytics or advertising scripts. We do not sell your data and do not share it with anyone except the service providers below, or when required by law.

2. Why we use it

To run the game and your account (contract), to keep the game fair and secure, to detect cheating, fraud and abuse and to moderate (legitimate interest), to fix bugs you report (legitimate interest) and to meet legal obligations.

3. Service providers

These providers process data on our behalf:

• Supabase — sign-in and the game database (Frankfurt, EU).
• Hetzner — the game server (Germany).
• Cloudflare — website delivery, DNS and network protection.
• Google — sign-in with Google.
• WalletConnect / Reown — connecting a wallet from your phone (QR code or link).
• Resend — delivery of security notices and bug reports by e-mail, when enabled. These e-mails are sent from noreply@voxelia.xyz.

4. Blockchain transactions

Transactions on a blockchain (for example deposits and withdrawals of VOX on Robinhood Chain) are public by design and cannot be changed or deleted by us or by anyone else, even if your account is deleted.

5. How long we keep it

• Game data: while your account exists, or until a game-wide reset announced in the game.
• Backups: our database provider (Supabase) keeps daily backups of the game database. We do not keep a separate backup on the game server. Data deleted from the game remains in these backups until the provider's backup period ends.
• Security logs: 12 months, then deleted automatically. This covers session times, rejected game commands, rate-limit violations, failed access attempts and acceptance of these terms.
• Moderation records: mutes, kicks and bans with their reason are kept for 24 months, then deleted automatically. A mute or ban that is still in effect is kept until it ends.
• Bug reports: 3 months, then deleted automatically.
• Chat logs: 30 days, then deleted automatically.
• Command log: the record of in-game actions and their result is kept for 90 days, then pruned automatically. The ledgers that record currency and item movements are not pruned (see section 7).
• Deleted-account login records: after an account is deleted we keep a one-way hash of its login identifiers, with the time of deletion, for 7 days so that an old login token cannot create a new account; then it is deleted automatically.
• Server logs: the game server's technical logs, which contain IP addresses, are kept for 14 days, then deleted automatically.

6. Your browser

The game stores your settings, window positions and last selected character in your browser's local storage, and short-lived sign-in state in session storage. The sign-in library stores your session in local storage; this session data is kept only in your browser. The wallet connection library stores its connection state in your browser. The game does not use cookies.

7. Your rights

Under the Turkish Personal Data Protection Law (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR), you may ask to access your data, get a copy, have it corrected or deleted, and object to its processing. Send requests to playvoxelia@gmail.com. We answer within 30 days.

Deleting your account. Send a deletion request to playvoxelia@gmail.com from the Google e-mail address linked to your account, or include your wallet address so that we can ask you to sign a message with that wallet; we need this to confirm that the account is yours. Your account is deleted within 30 days of a confirmed request. When we delete an account, your game data, chat messages, bug reports, sessions and sign-in links are deleted and your sign-in identity at our authentication provider is removed. Currency and item ledgers and trade records are kept in anonymised form, because they are needed to keep the in-game economy consistent and to detect fraud: the link to you is removed. Security logs, moderation records and backups that still refer to the account are deleted when their periods in section 5 end. Blockchain transactions cannot be deleted (section 4).

8. Children

The game is not intended for children. Players under 18 may not earn, deposit or withdraw tokens.

9. Changes

When this policy changes, its version and date change and you will be asked to accept it again before playing.