soullinked.io

Privacy Policy

Effective date: [DATE] Operator: the operator of soullinked.io ("we", "us", "Soullinked")

TL;DR

  • We collect almost nothing about you: a display name you pick, a color, and — only if you choose — an email address used solely for account recovery. No real names, no birth dates, no addresses, no payment details (nothing is for sale).
  • We collect a lot about your runs: gameplay events are the product. They're private to your lobby or community by default.
  • Save files you store in the vault are private and encrypted; you can download or delete them anytime.
  • Cookies: one httpOnly session cookie. No advertising or analytics trackers. Launcher telemetry is opt-in and off by default.
  • You can export your data and delete your account. Deleting pseudonymizes your event history rather than erasing it, because your events are woven into other players' shared runs — this policy explains exactly what that means.
  • We will never sell your data. Not "we may share with partners" — never.

The TL;DR is a summary; the sections below are the actual policy.

1. Our approach: hold less, leak less

Soullinked is built on data minimization as a security control: what we don't hold can't be leaked, subpoenaed, or abused. We do not ask for — and have no fields to store — your real name, date of birth, physical address, phone number, or government ID. Identity on Soullinked is a display name, a color, and a random ID. Email is optional and single-purpose. This policy describes everything we do collect, why, how long we keep it, and what control you have.

2. What we collect

2.1 Identity data

  • Display name and color — chosen by you; shown to other players as name#id4. Display names are freeform text; please don't put personal information in them.
  • Player ID and secret token — minted when you claim an identity. The token is stored on our servers only as a salted Argon2id hash; we cannot read your token back, and it never appears in logs.
  • Email address (optional) — only if you attach one, and used only to send you sign-in/recovery magic links. Never used for marketing, newsletters, or announcements; there is no marketing email pipeline, by design.
  • Passkey public key (optional) — if you attach a passkey (WebAuthn), we store only the public key. A breach of our database would yield nothing usable to sign in as you.
  • In-game profile cosmetics — the character name and gender you chose inside your own game, if the client reports them, used to decorate run boards.

2.2 Gameplay data (the product)

  • Run and game events — the Service is an event log at heart: encounters, catches, link formations, deaths, experience changes, badge progress, lobby joins, readiness, run start/end, rulings, and similar. This history is what powers run boards, career stats, replays, and leaderboard integrity.
  • Live position data — your in-game map position streams to your lobby while you play so partners see your "ghost." Positions are transient: they are relayed, not persisted to the event log.
  • Save files (only if you use the vault) — stored privately with per-object encryption keys, encrypted at rest, size-capped, and format-validated. They are never visible to other players and never opened by us except as needed to operate the vault (validation, storage, return). You can download or delete them at any time.
  • ROM hashes — a cryptographic fingerprint of your locally-verified game dump, used to confirm clean dumps and make randomized runs reproducible and auditable. We never receive the game file itself, or any part of one — there is no endpoint that could accept it.

2.3 Operational data

  • Connection and security data — like nearly every web service, our infrastructure processes IP addresses and request metadata to serve pages, hold WebSocket connections, rate-limit abuse, and block attacks. We use Cloudflare in front of everything (see Section 5). Our structured application logs are scrubbed by policy: no tokens and no personal data in logs.
  • Anti-bot checks — sensitive forms (identity claim, lobby/community creation, pool submissions, reports) use Cloudflare Turnstile to filter bots. Turnstile is an anti-abuse check, not an analytics tracker.
  • Audit log — administrative and moderation actions (recovery links issued, bans, ruling overrides) are recorded so power is accountable.

2.4 What we deliberately do not collect

  • Real names, dates of birth, physical addresses, phone numbers.
  • Payment information — nothing is for sale on the Service today. If a paid tier launches in the future (only after attorney review), payments would be handled by a payment processor and this policy would be updated first.
  • Uploaded images or files (other than vault saves). There is no image upload anywhere on the Service; avatars come from curated sets.
  • Advertising identifiers, cross-site tracking data, or analytics profiles. There are none of these on the Service.

3. Cookies and launcher telemetry

  • Cookies: the website sets a single httpOnly, SameSite session cookie to keep you signed in (30-day sliding). That's it. No advertising cookies, no third-party analytics trackers, no fingerprinting scripts.
  • Launcher telemetry: opt-in only and off by default. If you turn it on, crash reports are scrubbed of personal data before sending. The launcher works fully with telemetry off.

4. Who can see your gameplay

Privacy on Soullinked defaults to private:

  • Runs, live positions, boards, and community pages are visible only to members of the relevant lobby or community.
  • Public run pages exist only where a community explicitly opts in, and live position data is never public without that opt-in.
  • Anything you put in a player-authored string (display name, lobby title, ruleset description, profile text) is visible to whoever can see the surface it appears on — treat those fields as public writing.

5. Who we share data with

We share personal data only with the service providers that run the platform, and only what they need to do their jobs:

  • Infrastructure: Cloudflare (DNS, proxy/WAF, Turnstile, object storage), our hosting provider ([HOSTING PROVIDER]), and our managed database provider ([DB PROVIDER]) process traffic and store data on our behalf.
  • Transactional email: if you attach an email, magic links are sent through a transactional email provider ([EMAIL PROVIDER]); your address is shared with them solely to deliver those messages.
  • Discord integrations (community-configured): if your community connects Discord webhooks or the bot, run events (deaths, launches, champions, death-card images) are posted to that community's Discord channels. That data then lives under Discord's policies. Community admins, not us, choose to enable this.
  • Legal compulsion: we may disclose data if legally required (for example, a valid court order), and we hold little worth compelling — that is the point of Section 1.

We never sell your data. Not to advertisers, not to "partners," not in anonymized-but-actually-not form. Never. If the project ever changes hands (for example, reorganizing into an LLC), your data remains governed by commitments at least as protective as these, and you'll be notified.

6. How long we keep things (retention)

  • Run and game events: indefinitely. Event history is the shared, append-only record that run boards, careers, replays, and leaderboard integrity are built on — including other players' runs that you were part of. Deleting events out of the middle of a shared history would falsify other people's records, so events are retained; deleting your account pseudonymizes them instead (see Section 7).
  • Save files: lifetime of your account plus 90 days, then deleted. You can delete them yourself at any time before that.
  • Email address and passkeys: kept while attached; removed when you detach them or delete your account.
  • Live positions: not persisted at all — relayed to your lobby and discarded.
  • Backups: encrypted nightly snapshots are retained for [BACKUP RETENTION PERIOD]; deleted data ages out of backups on that schedule.
  • Deleted runs: a run's host can end a run with "END & DELETE," which destroys that run's log, packages, and associated saves for everyone in it. Its permanent URL will honestly answer that the history was deleted.

7. Your rights: export and deletion (and honest limits)

Wherever you live, we extend the same baseline:

  • Export: you can request a complete archive of your data — identity record, your events, and your vault saves.
  • Deletion: you can delete your account. Here is exactly what that does:
    • Your display name, email, passkeys, pairings, and token hashes are erased.
    • Your vault saves are deleted (fully purged within 90 days, per Section 6).
    • Your player ID in the shared event history is tombstoned and pseudonymized: events remain, but they no longer point to you — the history reads as an anonymous former player.
  • Why pseudonymization instead of full erasure: your events are entangled with other players' runs. The record "a link partner's Lotad died on Route 103, which killed Sarah's Marshtomp" is also Sarah's history and part of what keeps leaderboards honest and replays truthful. Removing your events would rewrite or corrupt other people's records. Pseudonymization removes what identifies you while preserving the integrity of the shared record. We believe this is the right balance under data-protection principles (and consistent with integrity and storage-limitation exemptions), and we'd rather explain it plainly here than surprise you later.
  • To exercise either right: use the account settings where available, or contact [PRIVACY CONTACT EMAIL]. We may ask you to prove control of the identity (that's what the token, paired devices, email, or passkey are for) — we cannot act on requests we can't verify, since that would itself be an attack vector.

8. Security

Security measures that bear directly on your data:

  • Tokens stored only as Argon2id hashes, compared in constant time; compromised tokens can be rotated instantly, invalidating old ones.
  • No password database exists — a deliberate design decision to eliminate credential-reuse breach risk entirely.
  • Save files encrypted at rest with per-object keys.
  • Web sessions via httpOnly cookies; launcher tokens in the OS keychain.
  • Production systems firewalled behind Cloudflare; admin console gated by hardware-key access; every admin action audit-logged.
  • Nightly encrypted backups with tested restores.
  • No tokens or personal data in application logs, enforced by policy and tests.

Breach notification commitment: if a breach affects your data, we will notify affected users promptly and plainly — what happened, what was exposed, what we did, and what (if anything) you should do — via the Service and via email where one is attached, and we will comply with applicable notification laws. Given Section 1, the honest worst case is smaller here than on most services, but you deserve to hear it from us first either way.

9. Children

The Service is for users 13 and older. We do not knowingly collect personal information from children under 13. We don't collect birth dates (so we rely on the age representation you make under the Terms), but if we learn a user is under 13 we will delete their identity data. If you believe a child under 13 is using the Service, contact [PRIVACY CONTACT EMAIL].

10. International users

The Service is operated from the United States and data is stored there (and on our providers' infrastructure, which may be global — e.g. Cloudflare's network). By using the Service you understand your data is processed in the United States. The export and deletion rights in Section 7 are available to everyone, not just where a law requires them.

11. Changes to this policy

We'll update this policy as the Service evolves (for example, before any future paid tier launches). Material changes will be announced on the Service — and by email if you've attached one — before they take effect, with the previous version available for comparison.

12. Contact

Privacy questions, export and deletion requests: [PRIVACY CONTACT EMAIL]

Postal address: the operator of soullinked.io (postal address pending entity formation)