This Privacy Notice (the “Notice”) explains how Sol, an individual based in the United States (the “Operator”, “we” or “us”), collects, uses, discloses and retains personal information when you use Underspire. It was last updated on 14 October 2026 and forms part of the Terms of Service at https://underspire.net/legal/terms/.
1. Scope and controller
1.1 In this Notice, “Service” means the Underspire online game and every connection to it (whether by a MUD client or by the web client), the website at https://underspire.net, the wiki, the game’s mail, messaging, ticket and request systems, and the Underspire Forums at https://agora.underspire.net. This Notice applies to the whole Service and to everyone who visits or uses it, whether or not they are signed in.
1.2 The Operator decides why and how personal information is processed in the Service and is the “controller” of that information under the laws that use that term. The Service is operated from the United States and is hosted on a rented server in Germany.
1.3 Questions, requests and complaints about personal information should be sent to archeonsolUS@gmail.com.
2. Information we collect
2.1 We collect the following information.
- Account information. Your handle; your password (stored only as a salted hash, never in readable form); your email address and whether it has been confirmed; the date your account was created and the date you last signed in; your roles, any mentor or approval status, and your preferences; and a record of the Terms you accepted and when.
- Characters and play. The characters you create and everything you or your characters do in the game, including names, descriptions, backgrounds, applications and their review, skills and progress, property, relationships, the poses, speech, emotes and actions you write, messages sent through the game’s handsets, mail and channels, and the notes you keep. Most of this can be seen in the game by the other players who are present or addressed.
- Requests and reports. What you send to staff through tickets, requests, bug reports, appeals and the report function, including the text you write, any evidence you attach and a snapshot of the character involved. Staff also write notes about accounts and characters when they review an application or handle a concern.
- Posts and uploads. What you write on the wiki and the Forums (posts, revisions, private messages, reports, drafts and preferences), profile pictures you upload, and links you post to pictures hosted elsewhere.
- Connection records. For every connection to the game, including one that does not sign in, we keep a record containing: the IP address and a keyed hash of it; the network it belongs to (the first 24 bits of an IPv4 address or the first 64 bits of an IPv6 address); the autonomous system, the organisation that operates it and the country, looked up in a database stored on our own server; whether the address belongs to a hosting provider or to the Tor network; the client you use, including its name, terminal type, encoding and screen size; the options your client negotiated, and their order and timing; for a browser, the user agent, a hash of which headers it sent and in what order, a hash of the parameters of its secure connection, and the session key; the times you connected and disconnected; and the device token described in section 3. We also record whether the connection came through a reverse proxy.
- Screening signals. When an account is created, we check whether another account uses an email address that reaches the same inbox once variations are removed (a “+tag” and, for Gmail-family addresses, dots), whether the address is on a list of disposable email domains, and whether its domain can receive mail at all. We also detect when many accounts are created, or connect, from the same network in a short time, and when a connection that has not signed in matches a restricted account in both network and client. These checks create a flag for staff to review. No check restricts an account by itself.
- Enforcement records. Flags, warnings, restrictions, suspensions and bans, with the reasons, the evidence and the staff member who decided, and the record of any appeal.
- Email. The messages we send you, and a record of their delivery, including any bounce or complaint.
- Technical logs. Our web server and game server write logs of requests and errors. These logs contain IP addresses and details of each request.
2.2 We do not intentionally collect information about you that the law treats as sensitive, such as health, ethnicity, religion, political opinions or sex life. Roleplay is fiction, and what a character is, does or suffers is not a statement of fact about you. If you include such information about yourself in a post, request or message, we treat it as part of that content. You should not include it.
2.3 We do not ask for your real name, your date of birth, your home address or any government identification, and you must not send them to us.
3. Cookies and similar technologies
3.1 The Service uses cookies and similar storage in your browser (local storage and IndexedDB). We use them to operate the Service and not for advertising. The cookies we set are strictly necessary to provide the Service you request or to keep it secure, so we do not ask for your consent to them.
| Name | Site | Purpose | Lifetime |
|---|---|---|---|
sessionid | Game site | Keeps you signed in to the website and the web client. | Up to 14 days |
csrftoken | Game site | Protects forms against forgery. | Up to one year |
device_id | Game site | The device token: a signed value, not a password. Moderators use it to tell whether a browser has visited before. The page also keeps copies in local storage and IndexedDB, and restores a deleted copy from the others. | Two years |
forum_sid | Forums | Keeps you signed in to the Forums. | Up to one day |
forum_csrf | Forums | Protects the forms of the Forums against forgery. | Up to one year |
forum_auth | Forums | Holds the state of a sign-in in progress between the game site and the Forums. | Five minutes |
forum_browser | Forums | Part of the sign-in between the game site and the Forums. | Up to 14 days |
| Page settings | Both | Local storage holds your choices, such as your effects setting, whether you have seen the entrance, the layout of the web client and your reading options. | Until you clear it |
| Saved scrollback | Web client | If enabled, the web client stores a copy of your recent game output in IndexedDB on your device so that it survives a reload. You can turn this off, and delete the stored copy, in the client’s settings. | Until deleted, or after seven days without use |
| Challenge storage | Registration | Cloudflare’s Turnstile may set or read its own cookies or storage when its challenge loads on the registration page. | Set by Cloudflare |
3.2 You can block or delete cookies and stored data in your browser settings, but you may then be unable to sign in. Deleting only the device token has little effect, because the page restores it from its other copies. The device token is not a credential, and the Service does not use it to decide what you are allowed to do.
3.3 We do not use third-party advertising or analytics cookies. We do not track you across other websites, and the Service therefore does not act on “do not track” signals.
4. Purposes and legal bases
4.1 We use personal information for the purposes below and, where the law requires a legal basis, on the basis shown for each.
| Purpose | Legal basis |
|---|---|
| To provide the Service: to create and secure your account, to operate the game, the wiki and the Forums, to let you play and take part with others, and to send you the messages the Service requires. | Performance of our agreement with you (the Terms) |
| To keep the Service safe and orderly: to detect and prevent abuse, ban evasion, multiple accounts, scraping and attacks, to enforce the Terms and the Code of Conduct, to moderate, to handle reports and appeals, and to protect people. | Our legitimate interests in operating and protecting a safe and orderly community; legal obligations (section 5.3) |
| To respond to your requests, tickets, reports and enquiries, and to review character applications. | Performance of our agreement with you; our legitimate interests |
| To send you the notices you have enabled, and notices about moderation of your account or content. | Your consent, where we ask for it; otherwise our legitimate interests |
| To maintain, debug and improve the Service, and to preserve the shared history of the game. | Our legitimate interests |
| To comply with the law and with legal process, and to establish, exercise or defend legal claims. | Compliance with a legal obligation; our legitimate interests |
4.2 We do not sell personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are used in the laws of California and other places. We do not use personal information for advertising or to build advertising profiles. We do not make automated decisions that have a legal or similarly significant effect on you: our systems raise flags, and a member of staff decides whether to restrict an account.
4.3 Where we rely on your consent, you may withdraw it at any time, without affecting anything done before you withdrew it. Where we rely on our legitimate interests, you may object, as described in section 10.
5. Who can see what
5.1 Other players and visitors. What your character says, does and is described as in a room can be seen by the characters present, and they may keep it in their logs. A character’s public description, the pages you publish, and your posts in a public forum or on the wiki can be seen by anyone, including people who are not signed in and search engines. Private messages and handset messages can be seen by the people they are sent to.
5.2 Staff. Staff, who are volunteers, may read what they need in order to run the Service and handle the matters before them: accounts, characters, applications, tickets and reports, notes, the content of reported messages, connection records and enforcement records. Access is limited by role. The most sensitive items, such as complete IP addresses and the full connection record, are limited to senior staff, and each time a full connection record is opened, that is recorded in an audit log. Staff must keep this information confidential and may not disclose one player’s personal information to another player.
5.3 Authorities and others. We may preserve and disclose information where we believe in good faith that the law requires it (for example, under a valid court order or other legal process), where it is necessary to protect the rights, property or safety of the Operator, our users or others, or to report apparent child sexual abuse material, as the law requires. We may also disclose information in connection with a change in who operates the Service.
6. Service providers and recipients
6.1 We use the service providers below. Each processes information for us under its own terms, and we give each only the information its task requires.
| Provider | Function | Information involved |
|---|---|---|
| Hetzner | Hosting, in Germany, of the game, the website and the Forums, including their databases, backups and logs | All information held by the Service |
| Twilio SendGrid | Delivery of email sent by the Service | Recipient addresses and the content of messages |
| Google (Gmail) | Receipt of messages sent to our contact address | The content of the messages you send us, and your email address |
| Cloudflare (Turnstile) | A challenge that distinguishes people from automated programs when you register | Connection and browser information your browser supplies to the challenge |
| MaxMind (GeoLite2) | Databases that give the country and network of an IP address. They are stored on our own server, and no address is sent to MaxMind. | None leaves our server |
| CrowdSec | Software on our web server that reads its access log and blocks addresses that attack the Service. Under its default arrangements it may report the addresses of attackers to its community and receive blocklists from it. | IP addresses of requests, and what they requested |
| Discord | The staff channels where tickets, requests and bug reports are discussed and, for players who choose to link an account, the Discord link | The text of a ticket or report, the handle and character involved and, for a linked account, the Discord identifier |
6.2 Content you post in public is available to everyone.
7. Pictures and third-party content
7.1 A post, description or page may link to a picture or other content hosted on another website. When your browser displays it, that website receives your connection information, including your IP address. To avoid those requests, you can turn off the display of post pictures in the Forums settings. We do not control other websites, and their own notices apply to them.
7.2 A profile picture you upload is decoded and re-encoded without its metadata, and moderators must approve it before it is shown. Uploaded files are not sent to any third-party scanning service.
8. International transfers
8.1 The Service is operated from the United States and hosted in Germany. Our service providers may process information in other countries, including the United States. People use the Service from many countries, so your information may be transferred to, and processed in, countries whose data-protection laws differ from those of the country where you live and may offer less protection.
8.2 Where the law of your country requires a safeguard for a transfer, we rely on the safeguards available for it, such as the standard contractual clauses our providers publish, and on the transfer being necessary to perform our agreement with you. A copy of the relevant safeguard is available on request.
9. Retention
9.1 We keep information for as long as we need it for the purposes in section 4, and for the periods below.
| Information | Retention period |
|---|---|
| Account information | For as long as the account exists. After deletion, only what section 9.3 allows is kept. |
| Characters and play | For as long as the account exists. A character is part of the shared history of the game (see section 5.7 of the Terms), and a record of an event that other people took part in may remain after the account that wrote it is deleted. |
| Tickets, requests and bug reports | A closed ticket is archived after 30 days, when its bulkier parts (such as a technical trace or a snapshot of the character) are deleted. An archived ticket is deleted after a further 365 days, and a report about conduct after a further two years. |
| Character applications | The record of each decision and its reasons is kept for as long as the character exists. |
| Connection records: IP address | Cleared after 90 days. |
| Connection records: other fields | The whole record, including the network, the client details and the hash of the address, is deleted after 365 days. |
| Flags, warnings, restrictions, suspensions, bans and appeals | Kept for as long as needed to apply and enforce them and to protect the Service from a person who returns after a ban, and for a reasonable period afterwards. |
| Posts and their edit history (Forums) | Kept with the discussion. The text of a deleted post is removed after 30 days. |
| Private messages (Forums) | Until all participants have left or been anonymised. |
| Drafts (Forums) | Deleted after 30 days without an update. |
| Alerts (Forums) | Read alerts are kept for 30 days and unread alerts for 180 days. |
| Reports (Forums) | Closed reports are kept for one year. |
| Forum warnings and restrictions | Kept for two years after they end or are withdrawn. |
| Keyed network digests on forum posts | Cleared after 365 days. |
| Profile pictures (Forums) | A picture that is shown is kept until it is replaced or removed. A picture awaiting approval expires after 30 days. The digest of a rejected picture is kept for one year. |
| Mail delivery records (Forums) | Kept for 90 days. |
| Moderator audit records | Kept, to preserve accountability. |
| Server logs | Web server access logs rotate after 14 days, and the game’s own logs after about a week. Signed unsubscribe addresses and query strings are excluded from the Forums’ logs. |
9.2 Backups are protected and held separately. Information deleted from the Service may remain in an earlier backup until that backup expires. If a backup is restored, deletion and suppression records are applied again before the Service reopens to the public.
9.3 When an account is deleted, we remove or unlink information that identifies you, as far as we can without damaging other people’s records. The Forums anonymise a member 30 days after the game account is deleted: the name, signature and picture are removed, and the posts remain without attribution. We keep enforcement records, and any information we are required by law to keep or need in order to defend a legal claim, for as long as the law allows or requires and as we need in order to enforce a restriction.
10. Your rights and choices
10.1 You can see and change much of your own information yourself. On your account page and in the game you can change your email address, password and preferences. In the Forums settings you can export your forum data, choose which email you receive, set your online visibility and change your profile picture. In the web client you can turn off and delete saved scrollback. You may edit your posts during the editing period available to your account.
10.2 Depending on where you live, you may have the right to ask us for access to your information, for a copy of it in a portable format, to have it corrected or erased, to restrict or object to how it is used, and to withdraw your consent. To exercise a right, write to archeonsolUS@gmail.com from the email address on your account. We may need to confirm that you are the person the account belongs to. We aim to respond within one month and will tell you if we need longer. We do not charge for a request unless it is clearly unfounded or excessive.
10.3 These rights are not absolute. We may refuse or limit a request where the law allows, for example where it would reveal information about another person or harm the safety or security of the Service (such as by revealing how a screening check works), or where we must or may keep the information (see sections 9.2 and 9.3).
10.4 If you live in the European Economic Area, the United Kingdom or Switzerland, you may complain to your local data-protection authority. If you live in California, you have the rights given by the California Consumer Privacy Act, to the extent it applies to us: to know what we hold, to delete it, to correct it, and not to be treated less favourably for exercising a right. We do not sell or share information as that Act defines those terms. If you live elsewhere, the law of your place may give you similar rights.
10.5 You may ask for your account to be deleted at any time. The effect of deletion is described in section 9.3.
11. Security
11.1 We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure and loss. Passwords are stored only as salted hashes. Connections to the Service are encrypted. IP addresses are kept out of ordinary staff view by hashing and by limiting how long they are stored. Access is limited by role, and the most sensitive access is audited. The Forums run separately from the game, with their own accounts and databases. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.
11.2 If a breach of personal information occurs, we will notify the affected people and the authorities as the law requires, within the time it requires.
12. Age requirement
12.1 The Service is for people who are 18 or older, and no one under 18 may use it. We do not knowingly collect personal information from anyone under 18. Explicit material is prohibited in any space that a guest can read. Adult spaces require a confirmed, signed-in account and are excluded from public search indexing.
12.2 If you believe that a person under 18 has used the Service, please tell us through the report function or at archeonsolUS@gmail.com. When we learn that a person under 18 has used the Service, we will end that person’s access and take steps to delete their information.
13. Changes to this Notice
13.1 We may revise this Notice from time to time. The date of the latest revision is shown at the top. For a material change, we will give notice on the Site or in the Service, and by email where an address is on file, before the change takes effect. Where the law requires it, we will ask for your consent again.
14. Contact
14.1 The controller is Sol, United States. Enquiries about privacy, abuse, moderation or legal matters should be sent to archeonsolUS@gmail.com.
Privacy Notice, last updated 14 October 2026.