Privacy policy
Torchdelve is a small browser game. We keep only what the game needs to run, keep it safe, and stop cheating and abuse. There are no ads, no tracking cookies and no third-party analytics.
Who is responsible
The controller of your personal data is Jonaz Thern, a sole trader registered in Sweden, organisation number 781229-2733. Contact: info@thern.io. This page covers the game. The general Thern privacy policy (in Swedish) covers the rest of thern.io.
What we store and why
| Data | Why | Legal basis |
|---|---|---|
| Hero name, e-mail address and password (stored only as a one-way hash) | Your account: logging in, verifying the e-mail, resetting the password | Contract (providing the game) |
| Game data: level, gold, gear, quests, runs, raids, scores | Playing the game | Contract |
| When you were last active | Showing who is online and keeping the game fair | Legitimate interest |
| IP address of failed and rate-limited attempts (logins, sign-ups, codes) | Stopping password guessing and spam | Legitimate interest (security) |
| Page visits, counted with a keyed one-way hash of IP address and browser, never the address itself | Counting visitors without cookies | Legitimate interest |
| Reports you send with "Bugs & Feedback", with your hero name, e-mail and device type | Fixing bugs and answering you | Legitimate interest |
| Purchases, if you support the game: what you bought, the amount, the date and the order number from the payment provider (never card details) | Giving you what you bought, and the bookkeeping | Contract and legal obligation (Bokföringslagen) |
| Whether you want to be shown on the list of supporters | Showing your hero on it, only if you tick the box | Consent |
| Moderation notes, if an account is paused or banned | Enforcing the rules | Contract and legitimate interest |
We do not sell your data, build profiles or send marketing e-mail. The only e-mails you get are codes and account notices.
What other players see
Your hero name, level, score and achievements are shown on the leaderboard to other players. Logged-in players can open your hero from the leaderboard and see how it looks, the gear it wears, its stats and its duel record. When you duel another player, both of you see the fight, with each hero's name, level, DPS and health. Your e-mail address, gold, backpack and account details are never shown.
Cookies and storage in your browser
therpg: keeps you logged in while the browser is open. Needed for the game to work.td_keep: only if you tick "Keep me logged in". Lasts up to 400 days, and is removed when you log out.- Local storage: your own display choices (which stats you picked, leaderboard sorting, background). They never leave your device.
All of these are strictly necessary for a service you asked for, so under Swedish law (LEK 9 ch. 28 §) no consent banner is needed. You can clear them in your browser at any time; you will then be logged out.
Who else handles the data
- Inleed AB (Sweden) hosts the game and its database.
- Cloudflare, Inc. runs Turnstile, the robot check on sign-up and after several failed logins. It processes your IP address and technical browser signals during the check. Cloudflare is certified under the EU–US Data Privacy Framework.
- Thern's own mail server sends the codes and notices.
- Lemon Squeezy (Lemon Squeezy, LLC, part of Stripe) sells supporter packs, looks and hourglasses as reseller. When you buy, you give your name, e-mail and payment details to them, not to us; they handle them under their own privacy policy. We get back only what you bought, the amount and an order number.
- Feedback reports are forwarded to Thern's support system at www.thern.io, where they are handled under the Thern privacy policy.
How long we keep it
- Your account and game data: as long as the account exists. Delete it yourself at any time (see below).
- Sign-ups that are never verified: deleted automatically after 48 hours.
- Codes sent by e-mail: valid for 15 minutes.
- IP addresses of failed attempts: 24 hours.
- Hashed page visits: 90 days.
- The keyed hash of each address that has visited, with the day it was first seen (no times, no browser), to count unique visitors over time: as long as the game runs.
- Session on the server: at most 7 days after your last visit.
- Feedback reports: until they are resolved and no longer needed.
- Purchase records: 7 years, as the bookkeeping law requires. If you delete your hero, they are kept without the link to it.
Your rights
You can get a copy of your data, have it corrected, have it deleted, object to processing based on legitimate interest, and take your data elsewhere. Two of these are built into the game, under Account:
- Download my data gives you everything stored about your hero as a file.
- Delete my hero removes your hero, gear, progress, e-mail and sign-in data for good.
For anything else, write to info@thern.io. We answer within a month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, IMY.
Children
You need to be at least 13 years old to create a hero. If you are a parent and your younger child has signed up, write to us and we delete the account.
Security
All traffic is encrypted (HTTPS). Passwords are stored only as strong one-way hashes, codes and "keep me logged in" tokens only as hashes, and the game's code and database sit outside the public web folder. If a breach ever puts your data at risk, we report it to IMY within 72 hours and tell you when the law requires it.
Changes
If this policy changes in a way that matters, we say so in the game. The date at the top shows the latest version.