GHOST SYSTEM / 157-legal-1
Privacy policy
Revised:
1. Controller and contact
The controller of personal data in CHAOS — Cyber Hacking Adventure Of Senses — is Michał Cezary Jankiewicz, operating the game as a private individual. Address: ul. Relaksowa 5 lok. 1, 27-400 Ostrowiec Świętokrzyski, Poland. Contact for account matters, privacy and data rights: year2108@chaos.re. This policy covers chaos.re and its installable web application (PWA).
2. Account and gameplay data
CHAOS processes account identifiers, login or nickname, email address, selected clan, profession, avatar, progress, gameplay actions and player-submitted content. Nicknames, profiles, publications and shared-world actions may be visible to other players. Do not publish information you do not want to share.
3. Sign-in and external providers
You can use a local account or available Google, GitHub, Discord and Steam methods. External sign-in provides a provider identifier and, where available, an email address and its verification status. CHAOS does not receive your provider password. Local passwords are stored as cryptographic hashes. A matching email address alone does not automatically link accounts.
4. Google: data scope and use
Google sign-in is optional. Choosing it takes you to Google; CHAOS requests only the openid and email scopes. From a signed token we read your Google account identifier (sub), email address and verification status (email_verified). We store these details and linking/use timestamps in the CHAOS account database. They support account creation, sign-in and linking Google to an existing account at your request. A verified email may become your account security address for codes and confirmations. A matching email alone does not automatically merge accounts. We do not receive your Google password, retrieve your profile photo or request access to Gmail, Drive, Contacts or Calendar.
5. Google: safeguards and recipients
The server exchanges the sign-in code and validates the signed token over HTTPS. Access and refresh tokens are not stored in Identity Gateway tables. Your Google link is not a public part of your player profile. Account data is processed on CHAOS server infrastructure; security-message recipient addresses and message content pass through cyber_Folks mail services and the recipient’s mail provider during delivery. Google handles its part of sign-in and receives the data needed for authorisation. Use of Google’s pages is also governed by Google’s privacy policy. Infrastructure access, locations and any international transfers are addressed in the recipients section.
6. Disconnecting Google and deleting data
In the game, open Settings → Account → Identity Gateway. Disconnecting Google removes the current provider link; another sign-in method must remain. This does not delete your CHAOS account or an email stored separately as its security address. You can also revoke app access in your Google Account’s third-party connections settings; revocation alone does not delete data already stored in CHAOS. Account deletion in Identity Gateway requires reauthentication and removes current links and the security data described below. You can request access to or erasure of remaining data at year2108@chaos.re. Do not include passwords, tokens or sign-in codes in your request.
7. Discord, GitHub and Steam
Discord uses identify and email: /users/@me provides an identifier, email and verified status. GitHub uses read:user and user:email: /user and /user/emails provide an identifier and primary verified email. Provider APIs may return additional profile fields; the adapter persists only the specified identity data. Steam OpenID confirms a SteamID and does not provide an email, so the address requires separate verification in CHAOS. External sign-in is optional. Providers operate their own sign-in pages under their policies. Disconnecting a method in settings removes its current link; at least one sign-in method must remain.
8. Minimum age and acceptance records
This update does not establish a new age threshold. The 16+ rules remain a planned, separate change. The mechanism requiring a new 16+ declaration has not yet been enabled in production. Once enabled, records will include the user ID, Terms version, acceptance time, and the fact and version of the age declaration. Historical declarations remain separate and are not automatically converted. We do not collect dates of birth, identity documents or Google age confirmation for this purpose. Google sign-in does not verify age. Introducing the policy and restrictions requires a separate announcement; publishing this document neither activates them nor changes existing accounts.
9. Sessions and device storage
Cookies and browser storage support sign-in, security, language and interface preferences. Persistent sessions have a 30-day inactivity limit and a 90-day limit from sign-in; a new sign-in invalidates the previous session. Signing out ends access through that session. PWA installation is optional and may use separate storage, requiring another sign-in.
10. Technical data and map
Connection handling and security involve technical data such as IP addresses, browser information, request times and sign-in events. Registration selects a starting city randomly from the game list, without sending an IP to ip-api.com or using GPS. Maps may fetch OpenStreetMap or OpenTopoMap tiles, an OpenStreetMap embed and Leaflet libraries from unpkg.com. Providers then receive the IP and request details; tile URLs identify the map area. Scanners send server-side Overpass queries for objects in a selected area; the service receives query coordinates and the server IP. Character position is game data, not a statement of the player’s real location.
11. Pseudonymity, analytics and advertising
You may use a nickname; a public real name is not required. Pseudonymity towards players does not mean anonymity towards the operator: an account may be linked to an email, sign-in identifier and technical events. The game interface contains no advertising integrations or external behavioural analytics tools. Technical log data supports operation and security of the service.
12. Purposes and legal bases
Data needed for the account, chosen sign-in method, communication and gameplay is processed to provide the service under GDPR Article 6(1)(b). Account protection, abuse prevention, reports and defence of claims rely on the operator’s legitimate interests under Article 6(1)(f). Where a specific legal obligation applies, point (c) is the basis. Without required data a feature may be unavailable. Choosing Google is voluntary and does not authorise unrelated uses of data. Reading this policy is not marketing consent.
13. Recipients and external services
CHAOS uses cyber_Folks for VPS hosting, DNS and email. The operator confirms that the VPS is located in Poland and stores account and gameplay data. Transactional mail includes recipient addresses, security codes and confirmations. Available sign-in providers are Google, GitHub, Discord and Steam. Map-service flows are described above, and restrictions on sending narrative to Mistral in the AI section. A VPS located in Poland does not mean all external services process data in Poland or the EEA.
14. Narrative and AI systems
CHAOS generates narrative and publications from game events. The package includes instructions, language, medium, fact descriptions, entity names, locations and audience context; depending on the task, it may contain a nickname, owner or clan label. We do not automatically treat this data as anonymous. Previously, the Mistral integration sent the package over HTTPS to api.mistral.ai. Narrative transmission to Mistral is suspended pending separate approval to resume it. It does not erase data previously transmitted. The alternative Ollama adapter enforces a local 127.0.0.1 endpoint and does not send the package to an external API. A package is not an automatic copy of all Cyberner history or the account database; the narrative adapter does not obtain Google-link data as AI input. AI output may be wrong and is game content, not reliable information about real people. The operator confirmed a paid API plan, the mistral-small-latest model, and that API data use for model training and Labs models are disabled in the Mistral dashboard. Zero Data Retention (ZDR) has not been confirmed: we do not assume it is enabled or that no data is stored. Mistral documentation describes a default EU data location with certain possible transfers outside the EU; we do not guarantee processing exclusively in the EEA. Disabling training does not disable retention. Narrative data is limited to the needs of the task; pending a separate release of the integration, the safeguard stops the entire package rather than treating nicknames and free text as anonymous.
15. Identity data lifecycle
An authorisation attempt is valid for 10 minutes, registration completion for 30 minutes, and permission to change security settings after reauthentication for 5 minutes. Starting another authorisation flow triggers cleanup of expired records and Identity security events older than 90 days. This does not guarantee deletion at the exact expiry time: a record may remain until cleanup runs again. Session validity does not determine backup or server-log retention. The operator-confirmed 28-day backup retention and monthly log clearing are described separately.
16. Server logs and backups
Backups are retained for 28 days. They support recovery after a failure and may contain data already deleted from the active database until that period ends. Logs are cleared monthly. This frequency is not an exact 30-day limit for every entry or the retention period of Identity security events in the database.
17. What account deletion removes
Account deletion requires fresh identity confirmation. It removes current provider links, account security settings, acceptance records, related attempts and codes, and personal copies of selected player data. It retains security hashes of retired provider identifiers and a username-reuse tombstone, along with references in world history, receipts and other players’ message copies. Send requests about remaining data to year2108@chaos.re.
18. Data remaining after account closure
Account data supports the active profile. After deletion, a retired provider identifier hash, a username-reuse block and references in shared history and other players’ messages may remain. They currently have no uniform automatic deletion deadline; hashing is not complete anonymisation. The operator manually assesses the necessity of remaining data and considers erasure or restriction, including personal data in message copies and world history. Preserving game mechanics alone does not justify retaining all data. When restoring a backup, completed erasures are reapplied before the service is made available. Requests about this data can be sent to year2108@chaos.re. We do not claim that disconnecting a provider or deleting an account immediately erases all copies, or that world history provides an indefinite legal basis for retaining personal data.
19. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, and object to processing. Where consent is the basis, you may withdraw it without affecting earlier lawful processing. You may complain to the Polish UODO or the competent supervisory authority. Identity verification may be needed to fulfil a request securely.
20. How to submit a data request
Email year2108@chaos.re with the account, the scope of your request and a contact method. You do not need to send a copy of an identity document. Where there are reasonable doubts, proportionate confirmation that you control the account may be required. Under the GDPR, information on action taken must be provided without undue delay, normally within one month of receipt. An extension of up to two further months, where permitted, requires notice within the first month explaining the reasons. A refusal must explain its grounds and the right to complain and seek a judicial remedy.
21. Reports and policy changes
Reports can be sent to year2108@chaos.re; their content and correspondence may contain personal data. The prepared communication-protection module has not yet been activated and is not described as active. Policy updates will identify actual processing changes and their date. The document alone does not activate new features.