Legal
Privacy Policy
What we collect, why, where it lives, and what you can ask us to do with it.
Last updated
Who we are: Sundermarch, an independent game project, based in Australia. We run the Sundermarch website at https://sundermarch.gg and the Sundermarch game, which is in development.
Contact for anything about your information: contact@sundermarch.gg
This policy describes exactly what the website collects today. If we ever collect more (for example if the game or launcher reports your PC specs, or if we add a newsletter), we will update this policy first and tell you.
1. The short version
- We collect the minimum needed to run accounts and organise game testing: your email address, a display name, a password (stored only as a scrambled hash we can't read), and, if you apply to test, your region and an optional message.
- Your information is stored in Sydney, Australia.
- We use only essential cookies (to keep you signed in). No analytics, no advertising, no tracking.
- We never sell your information and never share it for marketing.
- You can see, change, download and delete your information from your account page or by emailing contact@sundermarch.gg.
- You must be 16 or older to have an account and 18 or older to test the game.
2. What we collect, why, and how long we keep it
2.1 Your account
| What | Why | Kept until |
|---|---|---|
| Email address | To create your account, confirm it's yours, let you sign in and reset your password, and send you account emails (confirmation links, password resets, tester invitations, staff sign-in codes). We don't send marketing email. | You delete your account |
| Display name | Shown to you on your account page and, later, in the game and tester areas | You delete your account |
| Password | To sign you in. We store only a one-way scrambled version (a "hash"); we cannot see your password | You delete your account |
| Confirmation that you are 16 or older | Because accounts are for people 16 and over. We do not collect your date of birth | You delete your account |
| Which version of the Terms of Use you agreed to, and when | So we both know what was agreed | You delete your account |
| When your account was created and last changed | Record-keeping | You delete your account |
2.2 Sign-ins (sessions)
| What | Why | Kept until |
|---|---|---|
| A sign-in record for each device you sign in on, including the IP address and browser type at the time | Security: so you can see and end sign-ins on other devices, and so we can spot suspicious activity | The sign-in expires (30 days), you sign out, or you delete your account |
| Short-lived confirmation and reset codes (for email confirmation, password reset and staff sign-in codes) | To make those links and codes work once, for a short time | They expire (minutes to 24 hours) and are then deleted |
2.3 Tester application (only if you apply)
| What | Why | Kept until |
|---|---|---|
| Your region (a broad choice such as "Oceania" or "Europe") | To plan server locations and invite a good spread of players to each test wave | See below |
| Confirmation that you are 18 or older | Because testing involves an agreement (the Tester Terms) | See below |
| Which version of the Tester Terms you accepted, and when | So we both know what was agreed | See below |
| An optional message ("anything you'd like to tell us", up to 500 characters) | Whatever you choose to tell us; you can leave it blank | See below |
| Your application's status (received, under review, invited to a wave, not selected, access ended), and which wave you were invited to | To organise testing | See below |
How long we keep applications: your application is deleted when you withdraw it (from your account page), when you delete your account, or, if you are never invited, 12 months after you sent it. If you are invited, your tester access record stays while you're a tester and is removed when access ends or your account is deleted.
We do not ask for your PC specifications, real name, address, phone number, date of birth, payment details or play habits.
2.4 Staff actions (audit log)
If you are a staff member, every action you take in the admin area (sending or entering a sign-in code, reviewing or inviting applicants, ending tester access, running the clean-up) is recorded with your email address, the action, and the time. Entries about a player's application refer to it by an internal ID, not by name. This log exists so that decisions about testers can be checked. It is kept for 2 years.
2.5 Technical logs
Our hosting provider (Vercel) briefly keeps standard server logs of requests to the site, which include IP addresses and the pages requested, for security and to diagnose faults. These are kept for a short time set by the provider (days, not months). We do not use them to profile you.
2.6 What we do NOT do
- No analytics or statistics tools, no advertising or marketing tools, no social-media pixels, no "fingerprinting".
- No newsletter or marketing email. If we ever add one, it will be a separate, unticked opt-in you can leave off, with an unsubscribe link in every email.
- No selling, renting or trading of your information, ever.
- No automated decisions about you with legal or similarly significant effects. Tester invitations are decided by staff.
3. Cookies
We use only essential cookies: a sign-in cookie that keeps you signed in, and the small security cookies needed to make sign-in and forms work safely. They are set only when you sign in or use those forms, they can't be used to track you across other sites, and we use no cookies for analytics or advertising. Because of this, we don't show a cookie banner. You can delete cookies in your browser at any time; you'll just be signed out.
4. Where your information is stored, and who helps us
Your account and application data live in a database in Sydney, Australia, and the site's server code also runs in Sydney. We use these companies to run the site. Each one handles your information only on our instructions, under its standard data processing terms:
| Service | What it does for us | What it sees | Where |
|---|---|---|---|
| Vercel | Runs the website | Requests to the site (including IP addresses, briefly, in logs) | Server region Sydney, Australia; Vercel is a US company |
| Neon | Hosts our database | Everything in section 2 | Sydney, Australia (AWS ap-southeast-2); Neon is a US company |
| Resend | Sends our account emails | Your email address, display name and the content of each email we send you | Resend is a US company; email is sent from its servers |
| Cloudflare | Manages our domain name and forwards our contact email | Only the request to find our address, and email sent to contact@sundermarch.gg; not your page visits or account data | Worldwide; Cloudflare is a US company |
| GitHub | Stores the website's code | No player information | n/a |
Because some of these companies are based in the United States, some information (mainly email sending and request logs) may be handled outside Australia. We take reasonable steps to make sure it's protected wherever it is, through each provider's contractual commitments. We do not disclose your information to anyone else, except if the law requires it or to protect the site and its players from abuse.
5. Security
Passwords are stored only as strong one-way hashes. Sign-in cookies are marked so scripts can't read them and are sent only over HTTPS. Staff must enter an emailed one-time code before they can reach the admin area, and every staff action is logged. Sign-in, sign-up and password reset are rate-limited. Our systems never write passwords, codes or sign-in links to logs.
No system is perfectly secure. If a breach happens that is likely to cause you serious harm, we will tell you and the relevant regulator as soon as we can (and, for EU/UK players, within the GDPR's 72-hour rule for regulators).
6. Your rights and choices
From your account page you can, right now:
- see your details and your tester application;
- change your password;
- edit your application (while it's still "received") or withdraw it (which deletes it);
- delete your account, which deletes your account, sign-ins, application and tester access immediately. (The staff audit log keeps entries about actions on your application by internal ID only, and technical logs expire on their own schedule.)
By emailing contact@sundermarch.gg you can also:
- ask for a copy of everything we hold about you (we'll send it as a file; an automatic "download my data" button is planned);
- ask us to correct anything;
- ask us to delete information;
- ask any question about this policy.
We'll reply within 30 days. We won't charge you. We'll need to check you're the account holder first (usually by asking from the account's email address).
Complaints: if you're unhappy with how we've handled your information, please email us first and we'll try to put it right. You can also complain to the Australian privacy regulator, the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au. EU and UK players can complain to their local data protection authority (section 8).
7. Age
You must be 16 or older to create an account and 18 or older to test the game. We ask you to confirm this with a tick box; we don't collect your date of birth. If we learn that an account belongs to someone under 16, we'll delete it. If you're a parent or guardian and think your child has an account, email contact@sundermarch.gg.
8. Players in the European Union and the United Kingdom
If you're in the EU or UK, the GDPR / UK GDPR gives you specific rights, and this section explains how we meet them. It adds to, and doesn't replace, the rest of this policy.
- Controller: Sundermarch, an independent game project, Australia, contact@sundermarch.gg.
- Why we're allowed to use your information (legal bases):
- your account and tester application: needed to provide the service you asked for (contract, Article 6(1)(b));
- sign-in records, IP addresses, rate limits, the staff audit log: our legitimate interest in keeping the site and players secure (Article 6(1)(f));
- account emails such as confirmation links and tester invitations: part of the service (contract). We don't send marketing email; if we ever do, it will be with your consent.
- Where your data goes: it's stored in Australia, and some services are in the United States. Australia and the US don't have a general EU adequacy decision. We rely on each provider's standard contractual clauses, and on the fact that you give us your information directly.
- Your rights: access, correction ("rectification"), deletion ("erasure"), restriction, portability (a copy of your data in a common file format), and objection to processing based on legitimate interests. Use your account page or email contact@sundermarch.gg; we reply within one month.
- Complaints: to your national data protection authority (EU) or the Information Commissioner's Office, https://ico.org.uk (UK).
- Retention: as set out in section 2.
9. Changes to this policy
We'll post any changes here with a new date. If a change matters to you (for example, collecting something new), we'll tell you by email or on your account page before it takes effect.