Privacy Policy
1. Who we are
Journeysoft ("we", "us") publishes Secrets of the Ostari ("the Game"). This policy covers the Game, its online services and the website ostari.journeysoft.org. For anything about your data, write to support@journeysoft.org.
2. The short version
- Playing offline, your saves stay on your PC. The only thing the Game sends is a check for updates.
- Playing online, we keep what we need to run your account and your heroes.
- No ads, no third-party analytics, no tracking cookies. We do not sell or rent your data.
- You can ask us to see or delete your data at any time.
3. What we collect, and why
Your online account. Your email address, your username, and your password stored as a one-way hash (we never see or keep the password itself). We use them to sign you in, to tell accounts apart, and to answer you when you write to us.
Your game data online. Your heroes and everything about them (items, gold, progress), cosmetics you own, your Exchange listings, offers and trade history, promo codes you have used, and Colosseum ladder entries. Ladder entries show your username and results to other players. While you are online, other players can see that you are online, which game you are in and your public hero.
Chat. Messages you send in chat are shown to other players. The server keeps only the most recent messages (currently the last 80 lines of the world channel).
Connection data. Our account and game servers see your IP address and basic connection details when you connect. We use them to deliver the Game and to protect it against abuse. They may appear in server logs, which we keep only as long as we need them to run and secure the service.
Bug reports. Only when you choose to send one: what you write, the Game's log file, basic system information (operating system, graphics card, game version), your hero's class, level and location, and your username if you are signed in. Reports are posted to the #bug-reports channel of our community Discord server, where our developers and other members of that server can read them.
On your own PC. Single-player heroes, settings and the "Remember me" sign-in (a sign-in token, never your password) are stored on your PC and are not sent to us. Performance logs are recorded only if you turn them on, are saved on your PC, and are never sent automatically.
Update check. When it starts, the Game asks our website which version is current and may download the new version. Like any web request, this shows our server your IP address.
4. What we do not do
We do not show ads, use third-party analytics or tracking cookies, build advertising profiles, or sell, rent or trade your personal data.
5. Who else handles data
- OVHcloud hosts our servers and database (in the United States, Virginia).
- Discord receives the bug reports you choose to send. Discord's own privacy policy applies there.
- itch.io, if you download the Game there. Their privacy policy applies to their site.
- Google Fonts: our website loads its fonts from Google, which sees your IP address when you visit the site.
We may also disclose data if the law requires it.
6. Where it is kept, and for how long
Our servers are in the United States. If you play from elsewhere, your data is transferred there.
Account and game data are kept while your account exists. When you ask us to delete your account, we delete it within 30 days. Our database backups are kept for 30 days, so deleted data is gone from the backups within 30 days after that.
During the alpha, game data may also be reset when a new season starts. Bug reports stay on Discord unless you ask us to remove them.
7. Security
Passwords are stored only as bcrypt hashes. Sign-in and account traffic goes over HTTPS. Game traffic between you and a game server is not encrypted, but it carries no password. No system is perfectly secure, and we will tell affected players if we learn of a breach that puts their data at risk.
8. Your rights
You can ask us to show you, correct, export or delete your data, or to stop using it. Write to support@journeysoft.org from the email address on your account (or tell us your username), and we will answer within 30 days. We may need to check that the account is yours first.
If you are in the European Union, the EEA or the United Kingdom: we use your data because we need it to provide the Game you asked for (a contract), and for our legitimate interest in keeping the Game secure and fixing bugs. You have the rights above under the GDPR, and you may complain to your data protection authority.
If you are in California: we do not sell or share personal information for advertising. You have the right to know what we hold, to have it deleted, and not to be treated differently for asking.
9. Children
The Game is not meant for children under 13, and they may not make an account (in some countries the minimum age is higher). If we learn that a child under that age has an account, we will delete it. If you think this has happened, write to us.
10. Changes to this policy
When we change this policy we will update the version and date. If the change matters, the Game will ask you to accept the new version before you can play.
11. Contact
Journeysoft - support@journeysoft.org