Privacy Notice

This notice explains what personal data Lanternvale keeps, why, and what you can do about it. We keep as little as we can.

Who is responsible

TinyTools, based in the Czech Republic, runs Lanternvale and is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact us about anything in this notice at [email protected].

What we keep

When you play (as a guest or with an account)

Your character's name and look, your progress (level, experience, items, tokens and errands), where your character is in the world, any land, house and lot title you own, and the in-game letters sent to you.

When you create an account

Your email address, your password, and whether you have confirmed your email. Passwords are stored only salted and hashed, so nobody, including us, can read them.

When you buy something

Paddle, our reseller, tells us a transaction reference, what you bought, the amount, the currency and whether the payment completed or was refunded. We do not receive your card or bank details.

Technical data

Our server sees your IP address and basic connection details when you connect. They may appear for a short time in server logs, which we use to keep the game secure and fix problems.

In your browser

We keep a login key in your browser's local storage so you stay signed in, and a few settings such as whether sound is on and your cookie choice. We use no advertising cookies, and analytics cookies only if you accept them (see Analytics below). The checkout page loads Paddle's script, which may set its own cookies to take your payment.

Why we use it

• To run the game and your account: saving your character, letting you log in on any device, delivering what you buy, and sending account emails such as email confirmation, password resets and in-game letters to your confirmed address. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
• To keep records of purchases for accounting and tax. Legal basis: legal obligation (Art. 6(1)(c)).
• To keep the game safe and fair: stopping cheating and abuse, and fixing problems. Legal basis: our legitimate interest in a working, fair game (Art. 6(1)(f)).
• To write the supporter slideshow: when a supporter's hero falls, we send the character's name and game statistics (never your email) to OpenAI to write the story. Legal basis: our contract with you, as part of the supporter pass.
• To see how Lanternvale is used, only if you accept analytics. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Analytics (only if you accept)

The first time you visit, we ask whether we may use Google Analytics, provided by Google Ireland Limited. If you click Accept analytics, it sets cookies named _ga and _ga_… in your browser and records the pages you visit, your browser and device type, your approximate location (country or city), and a few game moments: entering the game, creating an account, and buying something (with its price). We never send Google your name, your character's name or your email address, and Google Analytics does not store IP addresses. We keep this data for up to 14 months.

If you click Decline, Google Analytics is not loaded and nothing is sent to Google. You can change your mind at any time with Cookie settings at the bottom of every page and in the game's Account panel; withdrawing your consent also removes the cookies.

Who we share it with

• Other players see your character's name, look and position in the world, and the titles of lots you own.
• Paddle (Paddle.com Market Ltd and its group) is our reseller and the Merchant of Record for all purchases. It processes payments, tax and refunds as an independent controller under its own privacy notice.
• Resend delivers our emails. It receives your email address and the message.
• OpenAI writes the supporter slideshow text from your character's name and game statistics. Under OpenAI's API terms this data is not used to train its models by default.
• Google (Google Ireland Limited) receives analytics data, only if you accept analytics, under Google's privacy policy.
• Our hosting provider runs the servers and database the game lives on.

We do not sell your personal data, and we do not share it for advertising.

Paddle, Resend, OpenAI and Google may process data outside the European Economic Area, for example in the United States. Where they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account and character data: for as long as your account exists. Ask us and we will delete it.
• Guest characters: kept so you can come back to them; we may remove ones that have not been played for a long time.
• Email links: confirmation links expire after 24 hours and password reset links after 1 hour, and the links are removed from our records once the email has been sent.
• Purchase records: as long as Czech accounting and tax law requires.
• Analytics data (only if you accepted): up to 14 months in Google Analytics.
• Server logs: only briefly.

Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Write to [email protected] and we will answer within a month.

If you think we have not handled your data properly, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the data protection authority where you live.

Children

You need to be at least 15 years old to create an account. If you believe a younger child has given us personal data without a parent's permission, write to us and we will delete it.

Security

The game is served over an encrypted connection (HTTPS), passwords are stored only as salted hashes, and access to our servers and database is limited to those who run the game.

Changes

We will update this notice when what we do with data changes. The date at the top shows the latest version, and we will announce important changes in the game.

Contact

TinyTools, Czech Republic · [email protected]