English
Polski
Türkçe
العربية
Español
Deutsch
简体中文
This Privacy Policy explains what personal data New Era Online collects when you use this website and play on our game server, why we need it, who else receives it, how long we keep it and what rights you have.
Version 1.2 - In force since 1 October 2026
1. Who we are
New Era Online is a private SRO game server run by the New Era Online Team ("we", "us"). The New Era Online Team is the controller of the personal data described in this policy. We do not publish the personal details of team members; every question and request, including data protection requests, goes to one address:
| Controller | New Era Online Team |
| Contact (support and data protection) | [email protected] |
2. Information we collect
| Category | What exactly | Where it comes from |
|---|---|---|
| Account data | Username, e-mail address, password (stored only as a hash, never in readable form), registration date, the IP address used for registration, whether and when you confirmed your e-mail address, and which version of our documents you accepted and when | You, when you register |
| Account security records | Failed login attempts, password and e-mail changes, password reset requests and voucher redemptions, with the time and the account involved | Created when these actions happen |
| Website technical data | IP address, browser type and version, the page requested and the time of the request; your session (login state and chosen language) | Your browser, on every visit |
| Game data | Characters, level, race, guild, items, gold, Silk, playing time and ranking results; records of in-game actions such as trades and item or gold movements; content you create in the game, such as chat messages, posts, comments, images and bug reports with screenshots | Created while you play |
| Game connection data | IP address, login and logout times, connection and session records | Automatically, when you connect to the game server |
| Anti-cheat data | A hardware identifier (HWID) derived from characteristics of your computer, results of client integrity checks, and records of detected cheating tools | The protection module of our game client |
| Support data | Your messages to us, the address you wrote from, and anything you choose to include | You, when you contact us |
We do not ask for your real name, postal address, date of birth, phone number, identity documents or payment details. We do not accept payments at the moment. If we ever introduce optional paid features, we will update this policy before they become available.
3. How we use it, and on what legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating your account, confirming your e-mail address, letting you log in and play | Account, game, connection | Performance of a contract - Art. 6(1)(b) |
| Service e-mails: address confirmation, password reset, security notices (for example when your e-mail address is changed) | Account | Performance of a contract - Art. 6(1)(b) |
| Protecting accounts and the Service against attacks, brute force, spam registrations and abuse | Account security records, website technical data, connection | Legitimate interest - Art. 6(1)(f): security of the Service and of your account |
| Keeping the game fair: detecting bots and cheats, limiting multiple clients, enforcing bans | Anti-cheat, connection, game | Legitimate interest - Art. 6(1)(f): a fair, playable server |
| Public rankings and history pages (character name, level, guild, results) | Game | Legitimate interest - Art. 6(1)(f): a competitive server, part of the service you signed up for |
| Answering support requests and ban appeals, investigating bugs | Support, account, game and the records relevant to the case | Contract - Art. 6(1)(b), and legitimate interest - Art. 6(1)(f) |
We do not use your data for advertising, we do not build advertising profiles and we do not send marketing e-mails. Where we rely on legitimate interest you may object (see section 7). We cannot run a fair, protected server without security, connection and anti-cheat data; if you object to that processing, the practical consequence is that you cannot play.
4. Anti-cheat in plain words
Our game client contains a protection module whose only purpose is to stop bots and cheats. It can:
- compute a hardware identifier (HWID) from characteristics of your computer, so that a banned player cannot simply come back on a new account, and so that the number of game clients per computer can be limited;
- check whether the game client has been modified and whether known cheating tools are running against it;
- record a detection together with the technical details needed to justify a decision and to answer an appeal.
It does not read your personal files, record your screen or log what you type outside the game. The HWID is not used for advertising. Automated detections can disconnect you from the game; bans are decided by our staff, and you can always ask for a human review at [email protected] (GDPR Art. 22).
5. Who we share information with
We do not sell your data and we do not share it for anyone else's marketing. Data reaches others only in these cases:
- Cloudflare - the website runs behind Cloudflare, which acts as a proxy and web application firewall. Every request to the website, including your IP address and browser details, passes through Cloudflare. Our registration, login and password reset forms use Cloudflare Turnstile to tell humans from bots; for this, the Turnstile script is loaded from Cloudflare and your IP address and browser signals are sent to Cloudflare.
- OVHcloud - hosts our website and game servers and therefore technically stores and processes the data described in this policy.
- An e-mail delivery provider - delivers our service e-mails (address confirmation, password reset, security notices) and therefore processes your e-mail address and the content of those messages.
- Discord and Facebook - the website only links to our community pages there; it does not embed their widgets or tracking. If you join them, their own privacy policies apply.
- Authorities - only where we are legally required to disclose data, or where it is necessary to establish, exercise or defend legal claims.
The website does not load fonts, scripts or styles from other providers; apart from Cloudflare Turnstile, all its files are served from our own server.
6. Cookies
We use only the cookies needed for the website to work. There are no advertising, analytics or tracking cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
Session cookie (name ending in _session) | Keeps you logged in and remembers your chosen language. Strictly necessary. | 2 hours of inactivity, or until you log out |
XSRF-TOKEN | Protects forms against cross-site request forgery. Strictly necessary. | 2 hours |
"Remember me" cookie (name starting with remember_) | Keeps you logged in between visits, only if you tick "Remember me". | Up to 400 days, or until you log out |
Cloudflare security cookies (for example __cf_bm or cf_clearance) | Set by Cloudflare, only when needed, to protect the website from bots and attacks. Strictly necessary. | Usually 30 minutes to a few hours |
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data, including the registration IP address, and account security records | As long as the account exists |
| Game data and content you created in the game | As long as the account exists, unless removed earlier by moderation or by a reset (wipe) of the game world |
| Technical logs of the website and the game servers (IP addresses, requests, connections) | Up to 12 months |
| Anti-cheat detections and the records behind a ban | As long as needed to handle an appeal, and for a permanent ban as long as the ban is in force (this includes the HWID) |
| Support messages and appeals | Up to 24 months after the case is closed |
| Public ranking and history entries | Until the account or the character is deleted, or the ranking is reset |
An account that has not been used for 24 months may be deleted together with its characters. When you ask us to delete your account, we delete your personal data within 30 days, except the minimum we need to keep a ban enforceable or to defend legal claims. Our databases may be copied for disaster recovery; deleted data can remain in such copies until they are overwritten.
8. Your rights
Under the GDPR you have the right to:
- access the data we hold about you and get a copy of it (Art. 15);
- correct data that is wrong or incomplete (Art. 16);
- have your data deleted, including your whole account (Art. 17);
- restrict processing while a dispute is being resolved (Art. 18);
- receive your data in a portable, machine-readable format (Art. 20);
- object to processing based on legitimate interest, including public rankings (Art. 21);
- ask for a human review of an automated decision (Art. 22);
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work (Art. 77).
To use any of these rights, including deleting your account, write to [email protected] from the e-mail address registered to your account. We answer within one month. We may ask a question that only the account owner can answer, so that we do not hand your data to someone else.
Deleting your account is permanent: characters, items and Silk are lost and cannot be restored.
9. Security
- Passwords are stored only as hashes. The game server keeps your game password in the older hash format that the game client requires, which is weaker than the one used by the website - use a password you do not use anywhere else.
- Access to our databases and administrative tools is restricted to the people and systems that need it, and administrative actions are logged.
- Logins and sensitive actions are rate-limited, the website runs behind Cloudflare, and the game server runs behind our own packet filter.
- We will never ask for your password - not by e-mail, not on Discord, not in the game.
No system is perfectly secure. If a breach puts your data at risk, we will inform affected players without undue delay, as the GDPR requires.
10. Children
You must be at least 16 years old to use the Service. Players aged 13 to 15 may use it only with the permission of a parent or legal guardian; children under 13 may not use it. If you believe a child has registered without permission, write to [email protected] and we will delete the account.
11. International transfers
Our website and game servers are hosted by OVHcloud in the European Union. Cloudflare and e-mail delivery providers operate worldwide and may process data outside the European Economic Area, including in the United States. Where that happens, the transfer relies on safeguards recognised by the GDPR, such as an adequacy decision (for example the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
12. Changes to this policy
We update this policy when the way we process data changes - for example when we add a feature or change a provider. The current version, with its number and date, is always published on this page, and important changes are announced on the website and on Discord before they take effect.
13. Contact
Questions about this policy or about the data we hold on you: [email protected].
See also our User Agreement.