Privacy notice

NEONDREAMS — PRIVACY NOTICE
Operator draft: complete before public launch.
Controller and contact: [ENTER YOUR OPERATOR DETAILS AND PRIVACY CONTACT]
Last updated: [ENTER DATE]

The game stores your username, password hash, display name, optional profile text, game progress, inventory, balances, transactions, combat and messageboard records, Terms of Service acceptances and necessary security logs. It uses a session cookie to keep you signed in and protect actions, and local browser storage for unconfirmed game requests and checkout references. The application does not load advertising or analytics trackers by default.

Public profiles and leaderboards show the game information described on those pages. Do not post sensitive information in public profiles or messages. Password hashes and session credentials are not included in public profiles. Administrators can inspect game records to operate and support the service.

If you buy credits, PayPal handles the payment. The game records the order/capture reference, account, package, amount, currency and delivery/review status; it does not ask you to enter bank or card details into the game. PayPal also processes information under its own privacy notice.

The operator must complete and maintain the following information for the actual service:
- Purposes and applicable legal bases for account, security, gameplay and purchase processing.
- Hosting and payment processors and any applicable international data transfers.
- Retention periods and deletion/archive procedures, including backups, security logs and financial records.
- How to request access, correction, restriction, deletion or other applicable rights, and how to raise a complaint.
- Contact details and the policy for the intended player age group.

Operational notes: account/session/game records and financial journals are not automatically erased by this release. Security attempt cleanup removes attempts older than24hours when the maintenance task runs. Webserver/Plesk logs and PayPal records are managed separately. The operator must choose and implement the remaining retention procedures; do not promise automatic deletion that has not been implemented.