Privacy Policy

Last updated October 9, 2026

Elysseus Online is an independent game in early access. This policy says, in plain words, what we collect, why we collect it, and how to have it removed. It covers elysseus.com, app.elysseus.com and the game itself.

The short version

We collect the smallest amount the game needs: an email if you join the waitlist, and your game progress if you play signed in.
Your account starts anonymous. A credential created on your device is the account; our server stores only a hash of it, never the credential itself.
No advertising, no third-party analytics, no tracking cookies, and we never sell data.

What we collect

The waitlist. If you join the waitlist we store your email address, and nothing else. It is used to send your early-access invite. Joining the list is not an account and gives no access to the game.
Your game progress, when you play signed in. Your hero's name and game state (character, gear, skills, roster) sync to our server so you can pick up where you left off. The account row alongside it holds a hash of your device credential, a hash of your session token, and the times the account was last seen.
If you link an account (Google, or an email address with a password): the Google account id or the email address, and, only if you set one, your password. Passwords are stored as a salted PBKDF2 hash; nobody, including us, can read them.
Purchases, when you buy something. We store the store's transaction receipt and what it granted you. We never see your card or payment details; Apple or Google handles the payment.
The shared world. While you are on a map, other players can see your hero: its name, where it stands and what it is doing. That live presence is temporary and is deleted when you leave.

We set no cookies. Your local progress and your session live in your browser's own storage, and the game contacts the server only when it needs to sync.

What we do not do

No advertising and no ad networks.
No third-party analytics or tracking scripts.
No selling, renting or trading of personal data.
No reading your password; we only ever compare hashes.

Where your data lives

Data is processed on our hosting providers' infrastructure (Vercel for the site and API, and a managed PostgreSQL database), protected in transit with TLS. Our providers may process data in data centres outside your country.

How long we keep it, and how to remove it

Waitlist emails: kept until you ask to be removed, or until the list has served its purpose.
Account and game data: kept while your account exists.
You can ask us to delete your data at any time and we will remove it, except where the law requires us to keep a record (for example a purchase or tax record). Write to legoguy@elysseus.com from the address you used, or include your recovery code so we can find the right account.

Your rights

Depending on where you live, you may have the right to see, correct, delete, restrict or port your personal data, and to object to some processing. We honour these requests for everyone, wherever you live: write to legoguy@elysseus.com.

Children

Elysseus Online is not directed at children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.

Changes to this policy

If our practices change we will update this page and its date. Substantial changes will be announced on the site, and if you have an account we may tell you when you next play.

Contact

Questions, requests and complaints: legoguy@elysseus.com. We are a small independent team and we answer.