Privacy Policy

Effective date: [DATE] Operator: the operator of soullinked.io ("we", "us", "Soullinked")

TL;DR

We collect almost nothing about you: a username and display name you pick, a color, your password (kept only as a one-way hash), and — only if you choose — an email address used solely for account recovery. No real names, no birth dates, no addresses, no payment details (nothing is for sale).

We collect a lot about your runs: gameplay events are the product. They're private to your lobby or community by default.

Your game file and the saves you make while playing stay in your browser, on your device. They're never uploaded. (Saves you choose to back up to the vault are private and encrypted. That includes cloud saves, a supporter feature you turn on yourself: each in-game save you make goes to the vault so another device can pick your run up. Your game file and the play page's autosaves never do.)

Cookies: one httpOnly session cookie. No advertising or analytics trackers, and no telemetry.

You can export your data and delete your account. Deleting pseudonymizes your event history rather than erasing it, because your events are woven into other players' shared runs — this policy explains exactly what that means.

We will never sell your data. Not "we may share with partners" — never.

The TL;DR is a summary; the sections below are the actual policy.

1. Our approach: hold less, leak less

Soullinked is built on data minimization as a security control: what we don't hold can't be leaked, subpoenaed, or abused. We do not ask for — and have no fields to store — your real name, date of birth, physical address, phone number, or government ID. Identity on Soullinked is a username, a display name, a color, a password we can't read back, and a random ID. Email is optional and single-purpose. This policy describes everything we do collect, why, how long we keep it, and what control you have.

2. What we collect

2.1 Identity data

Display name and color — chosen by you; shown to other players as name#id4. Display names are freeform text; please don't put personal information in them.
Username — chosen by you; it's how you sign in, and it's unique. Your display name starts out the same as your username, so other players see it until you change your display name. Please don't put personal information in it either.
Password — stored on our servers only as a salted Argon2id hash; we cannot read your password back, and it never appears in logs.
Player ID — a random ID minted when you create your account.
Invite code — during the closed alpha, the single-use code you signed up with is marked used; we keep only a hash of it.
Email address (optional) — only if you attach one, and used only to confirm the address, to send you password-reset links, and to tell you when your password or recovery email changes. Never used for marketing, newsletters, or announcements; there is no marketing email pipeline, by design.
Passkey public key (optional) — if you attach a passkey (WebAuthn), we store only the public key. A breach of our database would yield nothing usable to sign in as you.
In-game profile cosmetics — the character name and gender you chose inside your own game, if the client reports them, used to decorate run boards.

2.2 Gameplay data (the product)

Run and game events — the Service is an event log at heart: encounters, catches, link formations, deaths, experience changes, badge progress, lobby joins, readiness, run start/end, rulings, and similar. This history is what powers run boards, career stats, replays, and leaderboard integrity.
Live position data — your in-game map position streams to your lobby while you play so partners see your "ghost." Positions are transient: they are relayed, not persisted to the event log.
Live party data — while you play, the play page reports your party (nicknames, species, levels, HP) to your run so its boards show it as it happens. The latest report is held in memory, not logged; when a run ends, each player's final team is saved with the run's history.
Save files (only if you use the vault) — stored privately with per-object encryption keys, encrypted at rest, size-capped, and format-validated. They are never visible to other players and never opened by us except as needed to operate the vault (validation, storage, return). You can download or delete them at any time.
Cloud saves (only if you turn them on) — a supporter feature: each in-game save you make goes to the vault, so another device can pick your run up from it. They're save files, stored and handled exactly as above, and the vault keeps your newest few per run. The play page's autosaves (snapshots of the running game) never leave your browser, cloud saves or not. You can download or delete your cloud saves at any time; turning cloud saves off stops new uploads.
Game file fingerprints — the play page checks your game file in your browser against the cryptographic fingerprints (hashes) of known clean dumps. At most that fingerprint reaches us, for example to make sure everyone in a run plays from the same clean copy. We never receive the game file itself, or any part of one — there is no endpoint that could accept it.

2.3 Operational data

Connection and security data — like nearly every web service, our infrastructure processes IP addresses and request metadata to serve pages, hold WebSocket connections, rate-limit abuse, and block attacks. We use Cloudflare in front of everything (see Section 5). Our structured application logs are scrubbed by policy: no passwords, no tokens and no personal data in logs.
Audit log — administrative and moderation actions (recovery links issued, bans, ruling overrides) are recorded so power is accountable.

2.4 What we deliberately do not collect

Real names, dates of birth, physical addresses, phone numbers.
Payment information — nothing is for sale on the Service today. If a paid tier launches in the future (only after attorney review), payments would be handled by a payment processor and this policy would be updated first.
Uploaded images or files (other than vault saves and cloud saves). There is no image upload anywhere on the Service; avatars come from curated sets.
Your game file and the saves, autosaves, and backup snapshots the play page makes. They're kept in your browser on your device (Section 3) and never sent to us.
Advertising identifiers, cross-site tracking data, or analytics profiles. There are none of these on the Service.

3. Cookies and browser storage

Cookies: the website sets a single httpOnly, SameSite session cookie to keep you signed in (30-day sliding). That's it. No advertising cookies, no third-party analytics trackers, no fingerprinting scripts.
Browser storage: to play, the page keeps your game file, your saves, autosaves and backup snapshots, your settings (controls, speed, volume), and a little run bookkeeping (events not yet confirmed by the server, game writes still waiting their turn) in your browser's storage. It stays on your device and isn't sent to us, so we can't see it or recover it. Clearing this site's data in your browser deletes it; download your save from the play page first if you want to keep it.
No telemetry: the Service collects no crash reports, usage analytics, or session recordings.

4. Who can see your gameplay

Privacy on Soullinked defaults to private:

Runs, live positions and parties, boards, and community pages are visible only to members of the relevant lobby or community.
Public run pages exist only where a community explicitly opts in, and live position data is never public without that opt-in.
Anything you put in a player-authored string (display name, lobby title, ruleset description, profile text) is visible to whoever can see the surface it appears on — treat those fields as public writing.

We share personal data only with the service providers that run the platform, and only what they need to do their jobs:

Infrastructure: Cloudflare (DNS, proxy/WAF, object storage) and Railway (our hosting and managed database provider) process traffic and store data on our behalf.
Transactional email: if you attach an email, those account emails are sent through a transactional email provider (Resend); your address is shared with them solely to deliver those messages.
Discord integrations (community-configured): if your community connects Discord webhooks or the bot, run events (deaths, launches, champions, death-card images) are posted to that community's Discord channels. That data then lives under Discord's policies. Community admins, not us, choose to enable this.
Legal compulsion: we may disclose data if legally required (for example, a valid court order), and we hold little worth compelling — that is the point of Section 1.

We never sell your data. Not to advertisers, not to "partners," not in anonymized-but-actually-not form. Never. If the project ever changes hands (for example, reorganizing into an LLC), your data remains governed by commitments at least as protective as these, and you'll be notified.

6. How long we keep things (retention)

Run and game events: indefinitely. Event history is the shared, append-only record that run boards, careers, replays, and leaderboard integrity are built on — including other players' runs that you were part of. Deleting events out of the middle of a shared history would falsify other people's records, so events are retained; deleting your account pseudonymizes them instead (see Section 7).
Save files and cloud saves: lifetime of your account plus 90 days, then deleted. You can delete them yourself at any time before that.
Email address and passkeys: kept while attached; removed when you detach them or delete your account.
Live positions: not persisted at all — relayed to your lobby and discarded.
Live party reports: held in memory while a run is live; each player's final team is kept with the run's history when the run ends.
Your game file and in-browser saves: on your device, for as long as your browser keeps this site's data. We hold no copy.
Backups: encrypted nightly snapshots are retained for [BACKUP RETENTION PERIOD]; deleted data ages out of backups on that schedule.
Deleted runs: a run's host can end a run with "END & DELETE," which destroys that run's log and associated vault saves and cloud saves for everyone in it. Its permanent URL will honestly answer that the history was deleted.

7. Your rights: export and deletion (and honest limits)

Wherever you live, we extend the same baseline:

Export: you can request a complete archive of your data — identity record, your events, and your vault saves and cloud saves.
Deletion: you can delete your account. Here is exactly what that does:
- Your username, display name, password hash, email, and passkeys are erased.
- Your vault saves and cloud saves are deleted (fully purged within 90 days, per Section 6).
- Your player ID in the shared event history is tombstoned and pseudonymized: events remain, but they no longer point to you — the history reads as an anonymous former player.
- Your game file and in-browser saves were never with us: clear this site's data in your browser to remove them from your device.
Why pseudonymization instead of full erasure: your events are entangled with other players' runs. The record "a link partner's Lotad died on Route 103, which killed Sarah's Marshtomp" is also Sarah's history and part of what keeps leaderboards honest and replays truthful. Removing your events would rewrite or corrupt other people's records. Pseudonymization removes what identifies you while preserving the integrity of the shared record. We believe this is the right balance under data-protection principles (and consistent with integrity and storage-limitation exemptions), and we'd rather explain it plainly here than surprise you later.
To exercise either right: use the account settings where available, or contact [PRIVACY CONTACT EMAIL]. We may ask you to prove control of the account (that's what your password, email, or passkey are for) — we cannot act on requests we can't verify, since that would itself be an attack vector.

8. Security

Security measures that bear directly on your data:

Passwords stored only as salted Argon2id hashes at the OWASP-recommended cost: a database breach yields hashes, never passwords.
Sign-in is rate-limited per address and per username, and gives the same answer for a wrong username as for a wrong password; common and easily guessed passwords are refused when you set one.
Changing or resetting your password signs out every other session at once.
Save files and cloud saves encrypted at rest with per-object keys.
Web sessions via httpOnly cookies; the game connection signs in with a short-lived token held only in the page's memory.
The play page runs under a strict content security policy and loads no third-party scripts, which keeps other code away from the game file and saves in your browser's storage.
Production systems firewalled behind Cloudflare; admin console gated by hardware-key access; every admin action audit-logged.
Nightly encrypted backups with tested restores.
No passwords, tokens or personal data in application logs, enforced by policy and tests.

Breach notification commitment: if a breach affects your data, we will notify affected users promptly and plainly — what happened, what was exposed, what we did, and what (if anything) you should do — via the Service and via email where one is attached, and we will comply with applicable notification laws. Given Section 1, the honest worst case is smaller here than on most services, but you deserve to hear it from us first either way.

9. Children

The Service is for users 13 and older. We do not knowingly collect personal information from children under 13. We don't collect birth dates (so we rely on the age representation you make under the Terms), but if we learn a user is under 13 we will delete their identity data. If you believe a child under 13 is using the Service, contact [PRIVACY CONTACT EMAIL].

10. International users

The Service is operated from the United States and data is stored there (and on our providers' infrastructure, which may be global — e.g. Cloudflare's network). By using the Service you understand your data is processed in the United States. The export and deletion rights in Section 7 are available to everyone, not just where a law requires them.

11. Changes to this policy

We'll update this policy as the Service evolves (for example, before any future paid tier launches). Material changes will be announced on the Service — and by email if you've attached one — before they take effect, with the previous version available for comparison.

12. Contact

Privacy questions, export and deletion requests: [PRIVACY CONTACT EMAIL]

Postal address: the operator of soullinked.io (postal address pending entity formation)