Privacy Policy - Old District

Last updated: [[LAST_UPDATED]]. This Privacy Policy explains how Old District (olddistrict.com, operated by [[OPERATOR_NAME]], “we”, “us”, “our”) collects, uses, shares and protects your personal data when you create an account and play the game. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR). Our use of cookies is described separately in our Cookie Policy.

1. Who is responsible for your data
2. What data we collect
3. How and why we use it
4. Legal bases
5. Who we share it with
6. International transfers
7. How long we keep it
8. Your rights
9. How we protect it
10. Children and age limit
11. Changes and contact

1. Who is responsible for your data

The data controller for Old District is [[OPERATOR_NAME]], [[OPERATOR_ADDRESS]]. You can reach us about any privacy matter at [email protected].

2. What data we collect

We collect only the data we need to run the game, keep accounts secure and process payments.

Category	What it includes	Source
Account data	Your username, e-mail address, password (stored only as a secure hash, never in plain text), and the character choices you make at sign-up (class, city, sex, avatar, referral), plus your registration date.	Provided by you when you register or update your settings.
Technical & security data	Your IP address (recorded at sign-up and per session), session data, “remember me” tokens (stored hashed), login-throttling records, and a security log of certain form submissions (time, username, IP, forwarded-for header, the page hit and the submitted data).	Collected automatically as you use the site.
Gameplay data	Your in-game statistics and economy, actions you take in the game, the content of chat messages and private messages you send, and moderation records (reports, appeals, fines, jail history).	Generated as you play.
Payment data	When you buy premium credits: an order/invoice reference, your username, the package, the amount and currency, the credits due and the payment status. We do not receive or store your card details - those are handled entirely by PayPal.	Generated when you make a purchase; the payment itself is processed by PayPal.
Cookies	A strictly-necessary session cookie and an optional “remember me” cookie.	See the Cookie Policy.

We do not ask for a date of birth at sign-up. Instead, by registering you confirm that you meet the minimum age requirement (see section 10). We do not use analytics or advertising trackers.

3. How and why we use it

to create and manage your account and let you play the game;
to keep the game and your account secure - detecting and preventing cheating, fraud, brute-force attacks and abuse;
to operate in-game features such as messaging, families/organizations and the economy;
to process purchases of premium credits and keep the required accounting records;
to moderate conduct and enforce our Terms of Service and EULA;
to respond to your requests and to comply with our legal obligations.

4. Legal bases (GDPR Article 6)

Performance of a contract - creating your account and providing the game and purchased credits.
Legitimate interests - securing the service, preventing fraud and abuse, moderating conduct and keeping the game fair. We balance these against your rights.
Consent - the optional “remember me” cookie, and any optional communications; you may withdraw consent at any time.
Legal obligation - keeping accounting records for payments and responding to lawful requests.

We do not sell your personal data. We share it only with:

PayPal - to process payments (it acts as an independent controller for the payment);
our hosting provider ([[HOSTING_PROVIDER]]) - which stores the data on our behalf as a processor;
content-delivery and font providers (Cloudflare/cdnjs, jsDelivr, the Tailwind CDN and Google Fonts) - which may receive your IP address purely to deliver page resources;
authorities or advisers - where we are legally required to disclose data, or to establish, exercise or defend legal claims.

6. International transfers

Some of the providers above (for example Google, Cloudflare and PayPal) may process data outside the European Economic Area. Where that happens, the transfer is covered by an appropriate safeguard such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

Account data - for as long as your account exists. If you delete your account, we remove or anonymise it, except where we must keep certain records for legal reasons.
“Remember me” tokens - up to 30 days, then deleted automatically.
Login-throttling records - short-lived; cleared on a successful login and as blocks expire.
Security logs (omnilog) - [[LOG_RETENTION]], then deleted.
Payment/accounting records - [[PAYMENT_RETENTION]], as required by tax and accounting law.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased (“right to be forgotten”), where applicable;
restrict or object to certain processing;
receive your data in a portable format;
withdraw any consent you have given, without affecting past processing;
lodge a complaint with your data-protection authority ([[SUPERVISORY_AUTH]]).

To exercise any of these rights, e-mail [email protected]. We may need to verify your identity before we act on a request.

9. How we protect it

We apply reasonable technical and organisational measures: passwords are stored as secure hashes and never in plain text; traffic is served over HTTPS; session and “remember me” cookies are marked HttpOnly, Secure and SameSite=Lax; and we throttle repeated failed logins to resist brute-force attacks. No online service can be completely secure, so we cannot guarantee absolute security.

10. Children and age limit

Old District is not intended for and may not be used by anyone under the age of 14. We do not knowingly collect personal data from children under 14. If you believe a child under 14 has provided us with data, contact [email protected] and we will delete it. Full details are in our Age & Consent Policy.

11. Changes and contact

We may update this policy from time to time; material changes will be shown by a new “Last updated” date above. For any question about your data, contact [email protected].

Contents