Privacy Policy

This policy explains what VintageKo stores about you, why, how long we keep it, and how to get a copy or have it deleted. It covers the game server, this website and the forum.

1. What we collect

Account data

The account name you chose, a salted hash of your password (never the password itself), the email address you registered with, and the date the account was created.

Game data

Characters, levels, items, inventory, clan membership, national points, rankings and purchase history. This lives in the game database and exists because the game cannot work without it.

Technical data

IP addresses and timestamps for logins, and the browser user agent of panel sessions. We keep these to investigate account theft, ban evasion and payment fraud.

Support and forum data

Ticket messages, forum posts, and anything you choose to put in a profile, signature or avatar.

Payment data

None. Card numbers and billing addresses are handled by the payment provider and never reach our servers. We receive a transaction reference, an amount, and a success or failure result.

2. Why we collect it

• To run the game and keep your progress.
• To authenticate you, and to recover an account you have lost.
• To detect botting, multi-client abuse, exploits and payment fraud, and to

enforce the server rules.

• To answer support tickets.
• To publish rankings. Character names, levels, classes, clans and national

points are public by design — that is what a leaderboard is.

We do not sell your data, we do not hand it to advertisers, and we do not build advertising profiles.

3. Cookies

The site sets one session cookie when you log in and one language cookie that remembers the language you picked, and remembers your rankings filter in your own browser. There are no analytics cookies, no tracking pixels and no third-party advertising scripts — which is why you are not reading a cookie banner.

4. How long we keep it

• Account and character data — while the account exists.
• Login IP and session records — 180 days.
• Support tickets — 24 months after the ticket is closed.
• Audit log of staff actions — 36 months.
• Transaction references — up to 10 years, where tax law requires it.

An account with no login for 24 months is anonymised: the email address is removed and its characters are retired from the public rankings.

5. Who else sees it

• The hosting provider that runs our servers, as a processor.
• The payment provider, for a transaction you started.
• Game masters and moderators, limited to what their role needs. Every staff

lookup of a player record is written to an audit log.

• A law-enforcement authority, where we are legally required to respond.

6. Your rights

You can ask us to give you a copy of your data, correct a detail that is wrong, delete your account and the personal data attached to it, or stop a specific use of your data. Write to [email protected] from the address your account is registered with, or open a ticket on the support page. We answer within 30 days.

Deletion removes the account, the email address, the profile and the forum author link. It does not remove a ban record, an audit-log entry or a transaction reference we are required to keep — those are retained in a minimised form so a banned account cannot simply be recreated.

7. Children

The service is not intended for children under 16. If we learn that an account belongs to a child under 16 without guardian consent, we delete it.

8. Security

Passwords are stored as salted hashes. Panel sessions expire and can be revoked. Database access is limited to the operators who need it, and every administrative action is logged. No system is perfect: if a breach ever affects your data we will publish it on the news page and email affected accounts within 72 hours of confirming it.

9. Changes

Changes to this policy are announced on the news page. The version you are reading is the one that applies today.