Privacy Policy

Effective October 14, 2026

1. Who we are

Dorenvar is made and operated by Joshua Deason-Schroeder, an individual doing business as Dorenvar ("we", "us"). This policy covers the Dorenvar game at play.dorenvar.com, including the installable app version, and the website at dorenvar.com. Contact us about privacy at [email protected].

2. What we collect

Your account

• Your username and, if you give it, your email address.
• Your password, stored only as a salted scrypt hash. We never store or see the password itself.
• When the account was created and its role (player, or staff for moderators).

Your characters and play

• Character names, appearance and class, plus progress: level, items, quests, location in the world and when you last played.
• Your Embers balance, unlocks, and a record of each purchase, spend, refund and adjustment.
• Chat is sent live to the players who can see it. We don't store chat on our servers.

Purchases

• Embers are sold through Link, Stripe's merchant of record. Link collects your payment details, email and billing address under Link's privacy policy and Stripe's privacy policy.
• We never receive your card details. We receive and keep a purchase record: the checkout and payment reference, the pack you bought, the amount and currency, and refunds or disputes.
• Each checkout sends Stripe your Dorenvar account ID and username, so a purchase can always be matched to your account.

Technical information

• Your IP address, used briefly to limit repeated sign-in attempts and kept in our hosting provider's short-term server logs.
• Basic browser and device information that browsers send with every request.
• If you turn on update notifications, a push subscription address from your browser's push service.

Analytics (Google Analytics)

• We use Google Analytics 4 to understand how players find and use Dorenvar. For example, which screens are visited, how long sessions last, and which features are used.
• Google Analytics uses cookies and similar identifiers to collect:
  • pages and screens viewed, and in-game events we choose to measure;
  • device, browser and operating system;
  • the site that referred you;
  • approximate location: country, region or city, worked out from your IP address. Google Analytics 4 does not log or store IP addresses.
• We don't send your username, email or any other directly identifying information to Google Analytics. When you're signed in, we send a random-looking ID derived from your account, so we can count your sessions and devices as one player. It can't be turned back into your username or email. Google signals and ads personalization are turned off.
• Google Analytics data is kept for 14 months.
• In the EU and EEA, the UK, Switzerland and Canada, Google Analytics runs only after you agree. Elsewhere it runs by default, and a Global Privacy Control signal from your browser turns it off. Wherever you are, you can change your choice at any time: in the game under Install & app settings → Privacy, or on dorenvar.com with Cookie settings at the bottom of the page.
• You can also opt out with Google's opt-out browser add-on.
• See how Google uses this data at policies.google.com/technologies/partner-sites.

The Dorenvar Chronicle newsletter

• If you join the Chronicle on dorenvar.com, we collect your email address, your first name (optional), your consent choice, and basic technical information used to stop automated or abusive signups.
• Signup uses double opt-in: you're subscribed only after you confirm your address.
• We use it to send development news, world lore, playtest announcements and related updates.
• Every issue has an unsubscribe link. For access, correction or deletion of newsletter data, email [email protected].
• We keep this information while you're subscribed, and as needed to honour an unsubscribe and meet legal obligations.

3. AI companions

Dorenvar may have AI-controlled companion characters in the world. They say they are AI if asked.

• If you chat with an AI companion, or in a channel it reads, your message and a short summary of the game situation are sent to an AI model to write its reply. That model is OpenAI's API or a model we host ourselves.
• Under OpenAI's API data policy, OpenAI does not use API data to train its models by default.
• A companion may keep short notes about its conversations and adventures on our systems so it can remember them.
• Please don't share personal information in chat.

4. Cookies and storage on your device

• Sign-in cookie (dv_session): essential. It keeps you signed in for up to 30 days. It's a random token that can't be read by page scripts.
• Google Analytics cookies (_ga, _ga_*): analytics. They last up to 2 years, and are set only with your consent where the law requires it, and only when analytics is on.
• Browser storage: your game settings (graphics, sound, map and controls), your last-played character, and downloaded game files for faster loading. This stays on your device; you can clear it in your browser.

5. How we use information

• To run your account, save your characters and progress, and deliver what you buy.
• To keep Dorenvar secure and fair: preventing abuse, cheating and fraud, and investigating reports. Staff accounts can observe characters in the live world for moderation and testing; they cannot see passwords or payment details.
• To answer support requests and send update notifications you've asked for.
• To understand and improve the game, through analytics.

We don't sell your personal information, don't share it for cross-context behavioral advertising, and don't show ads.

6. Who we share it with

We use these service providers, each only for the job described:

• DigitalOcean: hosting and database, in the United States.
• Stripe and Link: payments, as merchant of record.
• Google: Analytics, and fonts. Loading our fonts sends your IP address to Google Fonts.
• OpenAI: AI companion replies.
• EmailOctopus: newsletter signups and delivery, under EmailOctopus's privacy policy.
• Your browser's push service: notifications you turn on.
• Our email providers: messages you send to support.

We may also disclose information when the law requires it, to protect players or the game, or as part of a sale or transfer of Dorenvar.

7. How long we keep it

• Account, character and Embers data are kept while your account exists.
• If you ask us to delete your account, we delete it within 30 days.
• Purchase records are kept as long as tax and accounting law requires, typically 7 years.
• Server logs are short-lived.

8. Your choices and rights

• Depending on where you live, including under the GDPR, UK GDPR and the California Consumer Privacy Act, you can ask to access, correct, delete or receive a copy of your personal information, and to object to or restrict some uses.
• Email [email protected] from the address on your account, or include your username. We will not treat you differently for using these rights.
• If you're in the EU or UK, you can also complain to your data protection authority.

9. Children

• Dorenvar is not directed to children under 13, or under 16 in the EU and UK.
• We don't knowingly collect personal information from them.
• If you believe a child has given us information, contact us and we will delete it.

10. Security and international transfers

• Security: passwords are hashed, connections use HTTPS, sign-in tokens are stored only in hashed form, and service keys are kept encrypted. No system is perfectly secure.
• Where data is stored: our servers are in the United States. If you play from elsewhere, your information is processed there, with the safeguards our providers offer, such as standard contractual clauses.

11. Changes

We will post changes here and update the effective date. We will announce significant changes in the game.