This policy explains what personal data Primibia collects when you use the game, the client and primibia.com, why we need it, who helps us process it, and what your rights are. The controller of your data is Primibia. You can reach us at support@primibia.com.

1. What we collect

Data	Why	Legal basis
Account: e-mail address, account name, password (stored only as a secure hash), and the date you signed up and last logged in	To run your account and send you account e-mails (verification, password reset)	Contract
Social sign-in: if you sign in with Google, Discord or Twitch, the ID, e-mail address and name that service shares with us	To log you in. We do not post anything or read your contacts	Contract
Characters and game data: names, levels, skills, items, houses, guilds, deaths, highscores, and the settings you save in the client	To run the game. Character names, levels, deaths and guilds are public, as in Tibia	Contract
Technical data: IP address, browser type, login times, server logs	Security, preventing abuse and cheating, enforcing bans, fixing errors	Legitimate interest
Chat: recent statements are kept briefly in the game server's memory. A statement is only stored if a player reports it, together with the report	To handle reports of rule violations	Legitimate interest
Purchases: what you bought, the amount, currency, date and the payment's Stripe reference. Your card details go directly to Stripe and never reach us	To deliver what you bought, handle refunds and keep the records the tax authorities require	Contract, legal obligation
Journey: pictures and short clips the game records of your character's level-ups, deaths and big fights, and the comments, likes and follows you leave on Journey pages	To show your character's journal, and shorts on the website	Contract
Referrals: which account invited which	To give both players their referral reward	Contract
Analytics: pages visited, rough location, device and browser, only if you accept the cookie banner	To understand how visitors find and use the website	Consent

We do not sell your data, we do not use it for advertising, and we do not use it to train AI models.

2. Journey and what other players see

Journey pictures and clips show the game screen around your character: your character, other characters nearby and the chat on screen. In your account settings you choose who can see your character's Journey: Public (everyone, including the shorts feeds on the website), Journey only (on your character's Journey page, but not in public feeds) or Private (only you). Moments are recorded either way, so you can change your mind later.

3. Who helps us

We use these service providers. Each only gets the data it needs for its task.

Provider	What for	Where
OVHcloud	The game server and database	Canada (covered by an EU adequacy decision)
Cloudflare	Hosting the website, protecting against attacks, the anti-bot check at sign-up (Turnstile), storing backups	Worldwide network; EU Standard Contractual Clauses
Stripe	Processing payments	EU (Stripe Payments Europe, Ireland)
Resend	Sending account e-mails	United States; EU Standard Contractual Clauses
Google	Google Analytics (only with your consent), and Sign in with Google if you choose it	United States; EU-US Data Privacy Framework
Discord, Twitch	Sign-in, only if you choose it	United States

4. Cookies and local storage

• Necessary: a login cookie that keeps you signed in, and Cloudflare's security and anti-bot cookies. The client stores your settings and minimap in your browser's local storage. These do not need consent.
• Analytics: Google Analytics cookies are only set after you click "Accept" in the cookie banner. If you decline, Google Analytics is never loaded. You can change your choice at any time: cookie settings.

5. How long we keep it

• Account and game data: as long as your account exists. When you ask us to delete your account, we delete it and its characters.
• Backups: removed from our backups within 30 days.
• Purchase records: 7 years, as Dutch tax law requires, even if your account is deleted.
• Server logs and IP addresses: kept for a limited time for security; IP bans as long as the ban lasts.
• Reports and penalties on an account: as long as the account exists, because penalties grow with each offence.

6. Children

Primibia is not meant for children under 16 without permission from a parent or guardian. If you believe a child has given us personal data without that permission, contact us and we will delete it.

7. Your rights

You may ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent (analytics), you can withdraw it at any time. Write to support@primibia.com from the e-mail address of your account; we answer within one month. You also have the right to complain to a data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

8. Security

Passwords are stored only as secure hashes, connections to Primibia are encrypted, and access to the servers is limited to the team. No system is perfectly secure; if a data breach affects you, we will tell you as the law requires.

9. Changes

When this policy changes, we update the date at the top and announce important changes on the website.