Privacy Policy
1. Who we are
Seraphic is an independent game platform operated from Victoria, Australia. For anything about your data, email team@seraphics.app.
2. What we collect
| Data | Why | How long |
|---|---|---|
| Username and password (the password is stored only as a salted hash by our authentication provider — we can’t read it) | Your account and login | Until you ask us to delete the account |
| Email address (optional until you want to trade or use the market) | Verify your account for trading, account recovery, important notices | Until you delete it or the account |
| Account status, role, and sign-up approval decision | Hand-approving accounts during the alpha; moderation | Life of the account |
| Wallet, inventory, purchases, trades, market sales, gifts and daily rewards | Run the economy, stop duplication and fraud, keep records | Life of the account; financial records may be kept longer where the law requires |
| Friends list, friend requests, your profile picture (a small image you choose) | Social features | Until removed or the account is deleted |
| Security log: IP address, account name and event (for example sign-in, failed sign-in, connect, admin action) | Stop attacks, brute-forcing and abuse; investigate problems | Deleted automatically after 90 days |
| Live game data (your position, actions, avatar look, voice-chat signalling) sent to the server while you play | Show you to other players and run the match | Held in memory only while you’re connected; not saved |
| Chat: global chat is relayed live, and the most recent messages are kept in server memory only so new arrivals can see the conversation. Private messages are relayed and not saved (if the recipient is offline, the message is held in server memory until delivered or the server restarts). “Typing” signals are never stored. Your own device may keep a copy of your chats for you. | Deliver messages | Not written to disk; cleared when the server restarts |
| Anti-cheat counters (for example “moved impossibly fast”) — a count, not a recording | Fair play | While connected |
| Chat-filter reports: if our filter hides a message because it looks like personal information or unsafe contact, a report may be kept for moderators | Child safety and moderation | Reviewed and cleared by moderators; kept only as long as needed |
| Items you upload (clothes, accessories, games, images) and their review notes | Review, publish and display | Until you remove them or the account is deleted |
3. What we do not do
- No advertising, ad networks, analytics, session recording, tracking pixels or fingerprinting.
- No keystroke logging. The game reads your keys and mouse only to control the game on your device; key presses and mouse movement are never sent to or recorded by us. The only typing signal that leaves your device is the optional “is typing” indicator in chat, which says that you are typing, never what.
- No cookies. The site and game store your settings, saved look and login session in your browser’s local storage on your own device.
- No third-party fonts, scripts, or embedded content. Everything loads from Seraphic’s own server.
- We don’t sell or rent your personal information, and we don’t use it for profiling.
4. Who processes your data
We use a small number of service providers who handle data only to run Seraphic:
- Supabase — database and authentication. Data is stored in Tokyo, Japan.
- Fly.io — runs the game server and this website (Sydney, Australia).
- Cloudflare — domain name (DNS) services.
- An email delivery provider — only to send your verification code, if you ask for one.
- A payment provider — only if and when real-money purchases are introduced; we’ll update this policy first, and card details will go straight to the provider, never to us.
Because these providers are overseas, your information may be processed outside Australia. We may also disclose information if the law requires it or to protect someone’s safety.
5. Children
Seraphic is for people aged 13 and over. If you are under 18, please get a parent or guardian’s permission before creating an account. We don’t knowingly collect personal information from children under 13; if you think a child under 13 has an account, email us and we’ll delete it. We keep children’s data to the minimum above, never advertise to anyone, and hide personal information in chat. We’re preparing for Australia’s Children’s Online Privacy Code and will update this policy as it takes effect.
6. Your rights
You can ask us to give you a copy of your data, correct it, or delete your account and data, and you can complain if you think we’ve mishandled it. Email team@seraphics.app from the address on your account, or tell us your username. We’ll reply within 30 days. If you’re in Australia and unhappy with our response you can contact the Office of the Australian Information Commissioner (oaic.gov.au); if you’re in the UK or EU, you can contact your local data protection authority. Deleting an account removes its personal data; some anonymous or legally required records (for example that a trade happened) may remain.
7. Security
Connections use HTTPS. Passwords are hashed and we never see them. Money and items are checked on our server, not on your device. Administrator accounts are protected with two-factor authentication. No system is perfectly secure; if there is a breach likely to cause serious harm we’ll notify affected people and the regulator as the law requires.
8. Changes
If we change this policy in a way that matters, we’ll post it here and tell account holders in the app before it takes effect.
9. Contact
This policy was drafted for an early-stage project and should be reviewed by a lawyer before real-money features launch.