Privacy Policy

1. Who we are

Inventery is a multiplayer block-building game. You can play it on the web at inventery.io and in the Inventery app for iPhone. It is run by System 3, Inc., a corporation formed in [STATE/COUNTRY OF FORMATION], [POSTAL ADDRESS] ("System 3", "the company", "we", "us"). Under the GDPR, we are the controller of the personal data described here.

2. What we collect

When you start playing (everyone)

• A player ID and token. We create a random player ID for you and a sign-in token tied to it. Your browser or the app keeps the token so you stay the same player.
• A display name. We give you a randomly generated name, and you can change it. You can also pick a unique username (an @handle).
• The date your player was created.

While you play

• Game progress. This covers your inventory and armour, health and food, experience, achievements, where you are in each world, your bed or spawn point, and similar game state. It also covers any saves and leaderboard scores a game stores for you.
• What you build. This includes the blocks you place and break, chest contents, signs you write (kept with your display name), land you claim and the plot names you choose. We record who changed which blocks, so that griefing can be undone.
• Portals you make. These have a name, a title and a description, and are kept with your player ID and display name. Pictures are made from them: a rendered title picture, and a screenshot of the in-game view at the portal, taken by the game itself.
• Portal activity. We record which portals you look at, walk up to and go through, and when. We use this to choose what the portal feed shows you, and to see which portals players enjoy.
• Uploaded skins. If you upload a skin, we keep the picture (stripped of any text or metadata in the file) and which skin you wear, with your player ID. Every player who sees you in game sees it. A player can report it, and moderators can remove it. It is deleted with your player, unless another player has uploaded the same picture.
• Comments you post on portals, with your player ID, your display name at the time, and when you posted.
• Chat. Messages you type, including private messages to another player, are passed through our chat filter and sent to the players in your world as you type them. We do not store chat, except when a player reports it (Section 5). The server keeps your last few lines in memory for a few minutes, to spot spam and repeats, and each world keeps its last 100 lines in memory so that a report can include them. Announcements by game staff are stored.
• Reports, mutes and blocks. If you report a player, or someone reports you, we keep the report (Section 5). If you mute or block a player, we keep that list with your player.
• Technical and performance data. This includes connection quality (round-trip time, dropped connections and reconnects), frame rate and frame times, screen size, whether you use touch, graphics settings, the game build, and when the page loaded and rejoined. Some of these reports are kept with your display name; others only with a random per-visit ID. We do not collect your device model, operating system version, advertising ID or any device identifier.
• Moderation records. If you are kicked or banned, we keep your player ID or name, who issued it, when, and for how long.

If you save your player to an account

Signing in is optional. [At launch this is turned off; update this section when it ships.] When it is on, you can link one or more of these:

• Sign in with Apple. We receive Apple's ID for you. We ask Apple for no name and no email. We also keep an encrypted token from Apple, so that we can revoke the link when you delete your account.
• Google. We receive Google's ID for you (the openid scope only: no name, email or photo).
• Discord. We receive your Discord user ID and username (the identify scope).
• Phone number. Your number goes to our SMS provider, Twilio, which texts you a code. We do not store your number. We store a one-way keyed hash of it, so we can recognise it next time, and its last two digits, so Settings can show "•••• 42".
• Sessions. We store a hash of each sign-in session's refresh token, plus when it was created and last used.

IP addresses and server logs

Your IP address reaches our hosting providers whenever you connect, as with any website. Our own code does not record it, with one exception: when you ask for a phone sign-in code, we count requests per IP address to stop abuse. Our servers also keep operational logs, such as errors and portal trips, which can include your display name or player ID. Our hosting providers (Section 6) also keep their own request logs.

What we do not collect

We do not collect your email address, real name, contacts, photos, location or microphone. We use no cookies, no advertising or analytics SDKs and no cross-site tracking. We do not use your data to train AI models. [Confirm before publishing.]

3. Why we use it (and our legal bases)

Where we rely on legitimate interests, you can object (Section 10). We do not make decisions about you that have legal or similarly significant effects by automated means alone. The chat filter does hide messages and can briefly mute someone who keeps tripping it. Game staff can lift bans.

4. What other players (and the public) can see

• Your display name and username, and your character and nametag in the world.
• Your chat messages, sent live to the players in your world. Private messages go only to their recipient.
• Portals you make (name, title, description, pictures, your display name), comments you post, signs, plots you claim and what you build.
• While you are online, the Explore map shows you to other players: your display name and where you are in the world. The map's data can be read publicly, without signing in. When you leave, you are no longer shown.
• Leaderboard scores, in games that have them.

Please don't put personal information such as your real name, age, school, address or phone number in your display name, chat, comments, signs or portals.

5. Your content and moderation

Everything you type in the game goes through an automated filter: chat, private messages, comments, display names, usernames, signs, and portal names, titles and descriptions. The filter blocks or censors swearing, hides suggestive lines, and limits repeats and spam. If a message looks like it is about self-harm, the sender is privately shown a supportive message. Game staff can kick and ban players and undo their builds. Other players can vote to briefly kick someone.

Reporting. A signed-in player can report another player, for example for harassment, hate, sexual content, spam or cheating. A report keeps the reporter's and the reported player's player IDs and display names, the reason, any note the reporter adds, the world it came from and when. If it is about chat, it also keeps the reported line and up to 20 lines of chat around it, taken from the world's own record rather than the reporter's screen. Those lines can include other players' messages, with their names. Private messages are included only if they were to or from the reporter. Reports are read by [WHO REVIEWS REPORTS, e.g. "System 3's moderators"].

Muting and blocking. You can mute or block another player. We keep that list with your player, so it follows you across devices, and delete it when you delete your player.

6. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with service providers that run Inventery for us, under their terms. They process it on our behalf:

• Cloudflare runs our play server and database (Cloudflare Workers, D1 and Durable Objects). Accounts, comments, saves and the shared world data are stored there.
• Fly.io runs our game world servers and serves the web game.
• Vercel provides DNS for our domain. It sees DNS lookups, not your game data.
• Twilio sends phone sign-in codes. It is used only if you sign in with a phone number.
• Apple, Google and Discord handle sign-in. They are used only if you choose them, and each one's own privacy policy applies.

We may also disclose information if the law requires it, to protect players' safety, or as part of a sale or reorganisation of the service. If that happens, we will tell you. The iPhone app's feed can also link to games made by others, such as castle.xyz. Those run on their own servers under their own privacy policies.

7. What is stored on your device

The web game uses your browser's local storage and IndexedDB. These hold your player token, your settings, the tutorial's progress, and caches of the world, the map and game files, so the game loads quickly. The iPhone app keeps the same things in its own storage, and keeps your sign-in session in the iOS Keychain. None of this is used for advertising or tracking. Clearing your browser's site data, or deleting the app, removes it. If you clear it as a guest, you lose access to that guest player.

8. How long we keep it

• Your player, progress, builds, portals and comments: for as long as the game runs, or until you delete them (Section 9). There is no automatic expiry today. [DECISION: e.g. delete guest players inactive for N months.]
• Chat: not stored. Recent lines stay in server memory for a few minutes, or until they are pushed out by newer ones.
• Reports (including the reported chat line and the up to 20 lines around it): there is no automatic deletion today. [DECISION: e.g. 1 year after the report is closed, or longer while it is needed for a ban.]
• Portal activity: the most recent entries only. Older entries are dropped as new ones arrive (up to the last 60 portal visits per player, and the last few thousand feed events overall).
• Technical and performance data and server logs: [DECISION: e.g. 90 days. These are not deleted automatically today.] Our hosting providers' own logs are kept for the periods they set.
• Sign-in sessions: until you sign out or delete your account. The app's tokens expire and are renewed (after 7 to 30 days); a web guest's token does not expire, because it is the guest's only key.
• Phone-code rate limits: short counting windows (up to a day), but the counters are not deleted afterwards. [DECISION]
• Moderation records: while the ban lasts, and longer where needed to keep a banned player from coming back. [DECISION]
• After deletion: we keep a record that your player ID was deleted, with no other data, so the ID is never reused or mistaken for a live player.

9. Deleting your data

In the game, open Settings › Data & Privacy and choose Delete my data, or Delete account if your player is saved to an account. In the iPhone app this is also under Profile › Account. Deletion is immediate and cannot be undone. It removes:

• your player record (display name and username);
• your linked sign-ins and sessions; we also ask Apple to revoke Sign in with Apple;
• your saves and leaderboard scores;
• your uploaded skin;
• your portal comments.

All of your existing tokens stop working, and your browser or app starts again as a new guest.

Not yet removed automatically: your in-world character record (inventory and positions), your portal activity, and things in the shared worlds that carry your player ID or display name: portals and their pictures, plots, signs, block-change history, moderation records, reports you filed or that were filed about you, and technical reports. Things you built stay in the shared world for other players. To have the rest removed, or to delete a player you can no longer open, contact us (Section 15) with your display name. [Remove this paragraph once deletion covers the world data.]

A guest player on a device you no longer have cannot be proven to be yours, so we may not be able to delete it on request unless you can show it's yours.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy in a portable format;
• correct it (you can change your display name and username yourself);
• delete it (Section 9);
• object to, or ask us to restrict, processing based on legitimate interests;
• withdraw consent where we rely on it;
• complain to your data protection authority. In the EU or UK, this is the authority where you live.

California residents (CCPA/CPRA): in the past 12 months we have collected these categories: identifiers (player ID, display name, username, linked sign-in IDs, IP address for phone-code limits), internet or other electronic network activity (gameplay, portal activity, performance data), and the content you post. We collect them for the purposes in Section 3. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. You have the right to know, delete and correct your information, and not to be discriminated against for using these rights. An authorised agent may make a request for you.

To use any of these rights, contact us (Section 15). We will answer within one month (GDPR) or 45 days (CCPA). We may need to confirm the player is yours, for example by asking you to make the request from the game while signed in as that player.

11. Children

[DECISION: choose a stance; the text below is a placeholder for the "general audience, not for under-13s" option.]

Inventery is meant for a general audience and is not directed to children under 13. We do not ask for anyone's age. You can play without giving us any contact details, and we do not knowingly collect personal information from children under 13 (or under the age of digital consent where you live, up to 16 in parts of the EU). Players can still type things into chat, comments, names and portals. Our filter tries to stop that, but it cannot catch everything.

If you are a parent or guardian and believe your child has given us personal information, contact us (Section 15). We will delete that player and its data. Parents can also delete a player from Settings › Data & Privacy on the child's device.

12. Security

All traffic to our servers is encrypted (HTTPS and secure WebSockets). Tokens are signed. We store only hashes of sign-in session secrets and phone numbers, and keep Apple's token encrypted. No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.

13. International transfers

Our providers run servers in several countries, including the United States. [Confirm the D1 database's and Fly.io's regions.] When we transfer personal data out of the EU, the UK or Switzerland, we rely on our providers' data processing terms and the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.

14. Changes to this policy

We will update this page when what we collect or how we use it changes, and change the "last updated" date at the top. If a change is significant, we will tell you in the game before it takes effect.

15. Contact

For privacy questions, deletion requests or to use your rights, email [PRIVACY CONTACT EMAIL] or write to System 3, Inc., [POSTAL ADDRESS]. [If required: EU/UK representative, and the Data Protection Officer if one is appointed.]

Include your display name (and username, if you have one) so we can find your player.