Privacy Policy

Russet Studio ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data when you use our websites, games, and services (collectively, the "Services").

By using the Services you acknowledge the data practices described in this Policy. We encourage you to read it in full. If you have questions, please contact us.

We collect information in the following ways:

Information You Provide

• Account registration details (name, email address, username, password)
• Purchase and billing information (processed via PCI-DSS-compliant payment processors; we do not store raw card details)
• Communications you send us (support tickets, feedback, contact forms)
• Newsletter subscriptions and marketing preferences
• Profile information you choose to provide (display name, avatar, biography)

Information Collected Automatically

• Log data: IP address, browser type, pages visited, referring URL, timestamps
• Device information: operating system, hardware model, unique device identifiers
• Game telemetry: gameplay statistics, feature usage, session length, crash reports
• Cookies and similar tracking technologies (see Section 9)

Information from Third Parties

• If you connect a third-party account (e.g. Discord, Steam), we may receive basic profile information from that platform
• Analytics and advertising partners may provide aggregate usage data

When you create an account and play our games, we store and process additional data to deliver the core service experience, including:

• Account profile: username, display name, avatar, join date, account status
• Game progression: character data, level, achievements, quests, statistics
• Inventory and Virtual Goods: owned items, currencies, cosmetics, entitlements
• Saved settings and preferences: graphics, audio, keybindings, UI configurations
• Purchase history: transaction records, receipts, entitlement records
• Login and session records: timestamps, IP addresses, device fingerprints for security purposes

Game progression and account data are stored for the duration of your account. Some data may be retained after account closure for legal, fraud prevention, or dispute resolution purposes.

Our games and Services may include social and multiplayer features. When you use these features, additional data is processed:

• Chat & Messaging: In-game chat and direct messages may be logged for moderation and safety purposes. Do not share sensitive personal information through in-game chat.
• Guilds & Groups: Guild membership, roles, and activity may be visible to other guild members.
• Community Profiles: Public profile information (username, avatar, recent activity) may be visible to other players.
• Forums & Posts: Content you post in public areas is visible to other users and may be indexed by search engines.
• User-Generated Content: Screenshots, videos, and community creations you share through the Services.

We may review community content and communications to enforce our Community Standards and investigate reports of abuse or violations.

We use the information we collect to:

• Provide, operate, maintain, and improve the Services
• Create and manage your account and game progress
• Process transactions and send receipts, order updates, and purchase confirmations
• Deliver Virtual Goods and game entitlements
• Send service notifications, security alerts, and account-related communications
• Send newsletters, promotions, and updates you have opted into
• Respond to your support requests, questions, and feedback
• Monitor and analyse usage to improve user experience and game balance
• Detect, investigate, and prevent fraud, cheating, and security incidents
• Enforce our Terms of Use and Community Standards
• Comply with legal obligations and respond to lawful requests

We will not sell your personal information to third parties. We do not use your data for fully automated decisions that produce legal or similarly significant effects without human review.

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data protection laws, we process your personal data on the following legal bases:

• Consent: Where you have given us clear consent to process your data for a specific purpose, such as subscribing to our newsletter or accepting non-essential cookies.
• Contractual Necessity: Where processing is necessary to perform the contract between you and Russet Studio — for example, to create and manage your account, deliver game content you have purchased, or process a transaction.
• Legal Obligation: Where processing is required for us to comply with a legal obligation, such as tax reporting or responding to a lawful court order.
• Legitimate Interests: Where processing is necessary for our legitimate business interests — such as fraud prevention, security monitoring, improving our services, and enforcing our Terms — provided these interests are not overridden by your rights.

You may withdraw consent at any time where processing is consent-based. This does not affect the lawfulness of processing prior to withdrawal.

We may share your information with:

• Service Providers: Third parties who assist us in operating the Services — including payment processors, cloud hosting providers, email delivery services, analytics platforms, and customer support tools. These parties are contractually bound to protect your data and may only use it for the purpose we specify.
• Legal Requirements: When disclosure is required by law, court order, or a request from a governmental or regulatory authority with proper jurisdiction.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset. We will notify you before your data becomes subject to a materially different privacy policy.
• Safety & Enforcement: When necessary to protect the rights, safety, or property of Russet Studio, our users, or the public — including investigating fraud or cheating.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We use third-party analytics services to help us understand how users interact with the Services. These providers may include, but are not limited to:

• Google Analytics: Tracks page views, session data, and user behaviour. Data is subject to Google's Privacy Policy. You can opt out via the Google Analytics Opt-out Browser Add-on.
• Vercel Analytics: Privacy-focused analytics integrated with our hosting provider. Minimal data collection with no cross-site tracking.
• Plausible Analytics: A privacy-friendly, cookieless analytics tool that does not collect personal data or use cookies.

Analytics data is used in aggregate form to improve the Services. We will update this section if additional analytics providers are added. You can manage analytics preferences through your browser settings or our cookie controls.

We use cookies and similar technologies (local storage, pixel tags, session tokens) to operate the Services, remember your preferences, and analyse traffic. For a full explanation of the cookies we use and how to manage them, please see our Cookie Policy.

Where required by law, we will obtain your consent before placing non-essential cookies. You can withdraw consent or update your preferences at any time through your browser settings or our cookie preference centre.

We retain your personal information for as long as necessary to provide the Services and fulfil the purposes described in this Policy, unless a longer retention period is required by law. Account data is retained until you request deletion or your account is closed. Purchase and transaction records are retained for a minimum of seven years for tax, accounting, and fraud prevention purposes. Game telemetry and analytics data may be retained in anonymised or aggregated form indefinitely. You may request deletion of your account data at any time (see Section 15).

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption: Data is encrypted in transit using TLS/HTTPS. Sensitive data at rest is encrypted using industry-standard algorithms.
• Access Controls: Access to personal data is restricted on a need-to-know basis. Staff access is subject to role-based permissions and regular review.
• Authentication: Account passwords are hashed using secure algorithms. We support and encourage the use of strong passwords and two-factor authentication where available.
• Payment Security: Payment data is processed exclusively through PCI-DSS-compliant third-party processors. We never store raw card numbers on our servers.
• Security Monitoring: We monitor our systems for anomalous activity, unauthorised access attempts, and potential breaches.

While we take reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. If you suspect a security incident involving your account, contact us immediately at support@russetstudio.com.

Depending on your location, you may have the following rights regarding your personal information. To exercise any of these rights, see Section 15.

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate or incomplete data be corrected.
• Deletion: Request that your personal data be deleted, subject to legal retention obligations.
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request that we limit how we process your data in certain circumstances.
• Objection: Object to processing based on legitimate interests, including direct marketing.
• Withdrawal of Consent: Withdraw consent at any time where processing is consent-based, without affecting prior processing.

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information as defined under California law. We do not share personal information for cross-context behavioural advertising.
• Right to Limit Use of Sensitive Personal Information: Where applicable, you may request limitations on how we use sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your California privacy rights.

To exercise your California rights, please submit a verifiable consumer request to privacy@russetstudio.com. We will respond within 45 days as required by law, with a possible 45-day extension where reasonably necessary.

The Services are not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children under 13.

For users between the ages of 13 and 18 (or the applicable age of majority in your jurisdiction), we recommend parental supervision when using the Services, particularly online multiplayer features, community areas, and in-game purchases.

In compliance with the Children's Online Privacy Protection Act (COPPA), if we discover that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information as promptly as possible. If you believe we may have collected information from a child under 13, please contact us immediately at privacy@russetstudio.com.

To exercise your data rights — including access, correction, deletion, or portability — please submit a request to privacy@russetstudio.com.

To protect your privacy and security, we must verify your identity before processing most requests. Verification may include:

• Confirming the email address associated with your account
• Responding to security questions you set during registration
• Providing additional identifying information consistent with what we hold on file

We will acknowledge receipt of your request within 5 business days. For EEA users, we aim to fulfil requests within 30 days; for California residents, within 45 days. In complex cases, we may extend these timelines as permitted by law and will notify you of any extension.

We will not fulfil requests where doing so would compromise the security or privacy of other users, or where retention is required by law.

Your information may be transferred to and processed in countries other than your own. Where we transfer data outside of the EEA, United Kingdom, or other regulated regions, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other legally recognised transfer mechanisms — to ensure your information is protected in accordance with this Policy and applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. We will notify you of material changes by posting the updated Policy on this page and updating the Last Updated date. For significant changes, we may also send a notice to the email address associated with your account. We encourage you to review this Policy periodically. Continued use of the Services after a policy update constitutes your acknowledgement of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach us through one of the following channels:

• Privacy & data requests: privacy@russetstudio.com
• Legal matters: legal@russetstudio.com
• Account & support issues: support@russetstudio.com
• Contact page

Related documents: Terms of Use · Cookie Policy · Refund Policy · DMCA Policy