Privacy policy

1. Who we are and how to reach us

SkillAge Online is run by King IT Solutions, a business in the Netherlands. SkillAge is a trade name of King IT Solutions (KvK 82130302). We decide what happens to the data on this page, which makes us its “controller” under the EU’s General Data Protection Regulation (GDPR).

For any question about your data, or to use one of your rights, write to support@skillage.app. Please write from the email address on your account if you have one.

2. What we collect, and why

Your account

You sign in with Firebase Authentication, a Google service. There are three ways in:

• As a guest. No email and no name: just an account ID that this browser keeps. Your character is saved on our servers, but only this browser can reach it until you connect a login.
• With Google. Firebase receives your Google account’s email address, name and picture. The game uses only the email address, which only you see, in Settings.
• With an email address and password. Firebase keeps the address and a secure hash of the password. We never see the password itself.

Firebase also records when the account was made and when it last signed in. To confirm an email address, and when you ask to reset your password, Firebase sends you an email. We send no other email.

When you make a full account, with Google or an email address, you tick two boxes: that you accept the Terms of service and this policy, and that you are 16 or older or have a parent’s or guardian’s consent. We record which version of each you accepted, when, and that you confirmed. When one of them changes in a way you need to accept, the game asks you again. Guests tick nothing.

The game never asks your age, birthday, country or real name.

Your character and play

Your character and everything that belongs to it are stored in Google Cloud Firestore, in Google’s Frankfurt region (europe-west3):

• its name, people (Human, Elf, Dwarf, Dryad or Nyx), appearance and portrait, and the city it started in;
• its public ID: a random code of 16 letters that other players’ games use to tell characters apart (see below);
• skills and experience, attributes, items, gear and gold, what you’re doing now and what waits in your queue, quests and story, and your Camp;
• your guild and how far you’ve read its chat, and as its leader or an officer which applications you’ve seen (so the game can count what’s new for you), your Market orders and trades, and your Premium status (when it started and ended);
• your profile settings and the arrangement of your dashboard;
• when your character was created and when you were last active, so the game can work out what happened while you were away;
• a random ID made for this browser, saved with what you’re doing so the game can tell your devices apart;
• a record of each action you take and of each change to your character, gold and items. They keep your save safe, let a request lost on a bad connection be retried without being counted twice, and help us look into bugs and cheating.

We use all of this to run the game for you. We don’t use it to profile you or to show you ads.

What other players see

SkillAge is an online game, so some of your character is shown to other players. Only signed-in players see it, guests included.

• Your profile. Any player can open it from your name. It always shows your character’s name, people and portrait, total level and rank, the title, motto and skill you chose to feature, and the Premium mark. It also shows your skills, gear, guild, homeland, lifetime records (including the day your character started), milestones, story progress and Camp: you can hide each of these in Settings → Profile. All are shown until you hide them.
• Leaderboards. Characters are ranked by levels and experience, with their name, people, portrait and Premium mark. You can take your character off them for good in Settings → Profile. That can’t be undone: once hidden, it never shows on the leaderboards again. Your profile stays as it is. A suspended account is removed from them.
• Guilds. Every player can see a guild’s name, crest, description and size. Its members see the member list (names, people, portraits, roles, levels, what each has given) and the hall’s log of who joined, left and gave what. The leader and officers also see who applied.
• Guild chat. Only members of your guild read it. Each message shows your name and the time. The chat keeps the latest 50 messages, none older than 30 days; you can remove your own, and the leader and officers can remove any.
• The Market. Only players with a connected, verified account trade there. Other players see prices and amounts, never who placed an order or who traded with whom. We store who placed each order and both sides of each trade for 90 days after the order closes or the trade happens, to run the Market and settle trades.

Behind the scenes, other players’ games receive your character’s public ID beside its name, to open your profile for example. They never receive your account ID or your email address. The lists of character names and profiles can’t be read directly: our servers show them only to signed-in players, through the game.

Reports and moderation

Any player can report a guild chat message, or a character’s name or motto, with Report. For each report we keep what was reported (the message’s words, or the name or motto), the reason and note the reporter gave, the reported character’s public ID and name, the guild it was in, the reporter’s account and the times. The reporter’s account lets us stop the same report being sent twice and tell the reporter our decision. A person on our team reviews each report. Only they see it, and the reported player is never told who reported them.

When we decide, the game tells the reporter the outcome in a notice, without naming anyone. If we act on what a player posted (remove a message, reset a name or clear a motto), the game sends that player a notice too. It says what it was about, what we did, which Game rule it broke, that a person decided it, and how to appeal.

A name we reset stays blocked, so no one can take it again; the blocked name isn’t linked to any account. Your account keeps a note of the names you had before a reset, so that our records stay straight.

Our staff and fair play

Our staff, the administrator and the moderators we appoint, may look at any player’s game data and the records of their actions, to keep play fair and to handle reports. Every time they open a player’s records or act on an account, that is logged.

• The records of your actions are kept 90 days. The log of what staff looked at and did is kept about a year.
• The random browser ID saved with what you do helps us spot accounts that are shared or that belong to the same person.
• For the same reason, the records of your actions also keep a hashed form of your network address (your IP address, scrambled with a secret key so it can’t be read back). It stays with those records for 90 days and goes with them. We never keep the address itself.
• An automatic daily check looks through the records for signs of cheating, such as bots or a second account. It only flags them: a person reviews each one, and nothing happens to an account unless they decide so.
• If we warn, mute, suspend or ban an account, the game tells its player what we did and why. To appeal, write to support@skillage.app.

The notice board

The notice board in the game shows the posts in the bug report and suggestion forums of the SkillAge Discord server. Our bot, Sage, copies each post’s title and up to 12 of its messages (the post and the replies), with each writer’s Discord display name and the time. It doesn’t copy Discord user IDs, profile pictures or attachments. Signed-in players can read the board. If you edited or deleted a post on Discord, the card may not change by itself: write to us to have it updated or removed.

Keeping the game safe

Firebase App Check, with Google reCAPTCHA Enterprise, checks that requests to our servers come from the real game and not from a script. It works from signals about your browser and how it is used. It runs only once you enter the game: when you play as a guest, sign in or make an account, or when the game opens for a player who is already signed in. The front page and the legal pages, this one included, don’t load it. Google may set its own cookies for it. We also limit how often each account can act, and keep the action records described above, to stop cheating and abuse.

Server logs

When your browser talks to our servers, Google Cloud logs each request: the time, your IP address, your browser’s description and any error. We use these logs to keep the game running and to find faults. Our own code logs no IP addresses, emails or chat.

Your browser’s storage

The game keeps a few things in your browser’s own storage, never in cookies of its own:

• your sign-in session (kept by Firebase), so you stay signed in;
• a note that someone signed in on this browser, so the next visit opens the game straight away (removed when you sign out);
• the random browser ID described above;
• your theme and small preferences: the order of your pack, combat animation, the recipe tiers you’ve seen, your pinned quest, whether tutorial hints are on and which of them you’ve read, which skill groups are open, and your dashboard’s arrangement.

There is no analytics, no advertising and no tracking in the game, and we don’t share your data with advertisers.

Payments

None today. Premium is free during the beta, and the game takes no payment details. When paid Premium opens it will go through Stripe, and this policy will say so, and what Stripe receives, before it does.

3. Why we may use it

The GDPR lets us use your data only on a legal basis. Ours are:

• Our agreement with you (the contract): your account, your character, saving your progress, the parts of the game other players see, and the emails that confirm your address or reset your password. See the Terms of service.
• Our legitimate interests: keeping the game secure, preventing cheating and abuse, handling reports, finding and fixing faults, and showing the community’s bug reports and suggestions on the notice board. You may object to these: see your rights.
• A legal obligation, where one applies: the EU’s Digital Services Act asks us to handle reports of content and to explain our decisions, and the law may require us to keep records or to answer a lawful request from an authority. Recording that you accepted our terms also lets us show that you did.

4. Who handles data for us

• Google runs our servers and database: Firebase Authentication, Firebase Hosting, Cloud Run and Cloud Functions, Cloud Firestore, Cloud Logging and reCAPTCHA Enterprise. Google acts for us under its data processing terms. Our servers and database are in its Frankfurt region (europe-west3).
• Discord hosts the SkillAge community server, where the notice board’s posts are written. What you post on Discord falls under Discord’s own privacy policy. Our bot Sage runs on Google Cloud in Frankfurt.

Outside the EU. Some of Google’s services work worldwide, such as sign-in, reCAPTCHA and the network that delivers the site’s pages, so your data may also be handled outside the EU. Google protects those transfers with the European Commission’s Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework. Discord may handle data in the United States under its own safeguards.

We don’t sell your data, and we share it with no one else unless the law requires us to.

5. How long we keep it

• Your account and character: for as long as your account exists. So do your public ID, the record of the terms you accepted, and the names you had before a reset.
• Your Market orders and trades: kept with your account for 90 days after an order closes or a trade happens. After that the prices and amounts stay, but nothing links them to you. An order still on the Market stays yours until it closes, and goods or gold waiting for you stay until you collect them.
• The records of your actions and changes, and the actions you’ve finished: 90 days, then they are deleted.
• Guest accounts not played for 180 days are deleted, with everything in them. Settings → Account says so on a guest. An account connected to Google or an email address never expires this way.
• Deleting your account. You can do it yourself: Settings → Account → Delete account, as a guest too. It waits seven days. Until then you can play on and cancel it, and for an account connected to Google or an email address, signing in again cancels it as well. After the seven days we delete it in our next daily clean-up, usually within a day. That includes your sign-in, your character, everything kept with it, your public ID, your place and messages in a guild, and every report you filed or that was filed about you. Where a record also belongs to another player, such as a finished trade, we remove what links it to you. You can also ask by writing to support@skillage.app from your account’s email address. For a guest, tell us your character’s name, and we may ask you to prove it’s yours, for example by setting a word we give you as your profile motto.
• Guild chat keeps the latest 50 messages, none older than 30 days. A message you remove leaves the chat at once. Our records don’t keep the words of your messages.
• Reports stay until we decide them, then 90 days. A report goes sooner if the account that filed it, or the one it is about, is deleted.
• Moderation: our staff’s notes on an account, the cheating checks’ flags about it and the history of our decisions stay as long as the account, and go when it is deleted. The log of what staff looked at and did is kept about a year; when an account is deleted, its entries no longer say whose account it was.
• The game’s notices (Market messages, and the outcome of a report or a decision about you) stay until you put them away, then 90 days.
• Blocked names: a name we reset stays blocked for good. It isn’t linked to any account.
• Suspensions: if we suspend an account, we keep that note on it, even through a character reset, so that the suspension holds.
• Notice board cards: for as long as the board exists, or until you ask us to remove yours.
• Server logs: 30 days, Google Cloud Logging’s standard period.
• Your browser’s storage: until you clear it. Signing out ends the session.

6. Your rights

Under the GDPR you can ask us:

• for a copy of the data we keep about you (access);
• to correct data that is wrong (rectification);
• to delete your data (erasure);
• to use your data only in limited ways while a question is settled (restriction);
• for your data in a common, machine-readable format, to take elsewhere (portability);
• to stop using your data where we rely on our legitimate interests (objection).

You can delete your account yourself in Settings → Account, and hide your character from the leaderboards in Settings → Profile. For anything else, write to support@skillage.app. We answer within one month, and it costs nothing. We may ask you to show the account is yours first.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live. We’d be glad to hear from you first.

7. Children

SkillAge Online isn’t meant for children under 16 without the consent of a parent or guardian. Sixteen is the age of digital consent in the Netherlands. If you are under 16, please ask a parent or guardian before you play. When you make a full account, you confirm that you are 16 or older or have that consent.

If you think a child under 16 is playing without that consent, write to us and we’ll delete the account.

8. Changes to this policy

When the game changes what it keeps or how, we update this page and the date at the top. Before an important change takes effect, we tell players in the game or on the Discord server. When a change is one you need to accept, the game asks you to accept the new version before you play on.