Your data, in plain words

Privacy notice

Last updated 22 September 2026. This notice explains what personal data Astrub Legacy collects, why we collect it, who else sees it and what you can do about it. It covers this website and the game server.

1. Who is responsible for your data

Astrub Legacy is a private, non-commercial community server run by its owner, a private individual, who is the data controller for the data described here. There is no company, no advertising and no payment processing behind the service.

For anything in this notice, including requests about your data, contact the server owner: use the channel that gave you your invitation code, or the contact the community already uses to reach the owner.

2. What we collect

What	Details	Where it comes from
Account identity	Account name, nickname shown in game, registration date	You, when you register
Login secret	Password stored only as a salted PBKDF2-HMAC-SHA256 verifier. Plain passwords are never stored and never returned	You, when you register or change it
Recovery data	Email address, security question and answer	You, when you register or use the account pages
Access records	Last connection date, last IP address, vote counters, mute and ban flags	Generated by the game server when you connect
Game data	Characters, classes, levels, statistics, inventories, bank contents, guild membership, position, quest progress	Generated by the game while you play
Website security data	A strictly necessary form-protection cookie, a sign-in cookie if you log in to the character planner, and short-lived recovery links, sign-in sessions and rate-limit counters stored as one-way hashes	Generated by this website when you use an account form or log in
Saved character builds	The builds you choose to save in the character planner: a name you pick, the class, level, characteristic points and items, and when you saved them	You, when you save a build while logged in

We do not ask for your real name, postal address, telephone number, payment details or identity documents. There are no purchases, subscriptions to pay for or donations required.

Please choose a security question whose answer is not sensitive personal information. The answer is ordinary text stored with your account, and support may need to read it while helping you.

3. Why we use it, and our legal basis

Purpose	Data used	Legal basis
Creating your account and letting you play	Account name, login secret, game data	Performance of a contract with you (Article 6(1)(b) GDPR)
Letting you recover your password and confirming a recovery address	Email address, security question and answer, recovery records	Performance of a contract, and our legitimate interest in keeping accounts secure (Article 6(1)(b) and (f))
Keeping the game fair and available: rate limits, abuse investigation, mute and ban records	Access records, account and game data	Legitimate interests in protecting the service and other players (Article 6(1)(f))
Delivering recovery emails	Email address and the message content	Performance of a contract, through our email provider (Article 6(1)(b))

We do not use your data for advertising, profiling, automated decision-making with legal effects, or any purpose other than the ones listed. We never sell or rent personal data, and we do not add you to a newsletter or mailing list. The only email we send is the recovery or confirmation message you ask for. When no email is configured, no email is sent at all.

4. Who else sees your data

• OVHcloud hosts the virtual server this service runs on. The server is located in London, United Kingdom. The United Kingdom benefits from an EU adequacy decision, so data transferred there keeps GDPR-level protection.
• Resend is the transactional email provider used only to deliver password recovery and email confirmation messages. It receives the recipient address and the message text, and nothing else. Its sending region is configured in the European Union.
• Server administrators can access account and game data while operating the game, for example to help with a stuck character or investigate cheating.

There are no analytics services, advertising networks, social media plugins or third-party embeds on this website. The pages load no external fonts, scripts or images, so reading the site does not tell anyone else that you visited it.

The public leaderboard publishes your character names together with their class, level and the kamas they are carrying. It never publishes account names, email addresses, IP addresses, inventories or bank contents, and characters belonging to staff accounts are excluded from every ranking. If you would rather not appear, delete the character or ask us to remove it.

We would only disclose data to a public authority when the law requires it, and we would tell you unless we are legally prevented from doing so.

5. How long we keep it

• Account and game data: for as long as your account exists. If you ask us to delete the account, it is removed from the live service, and the data disappears from rotating backups as they expire.
• Recovery links and rate-limit counters: recovery links are valid for 30 minutes and are deleted when used or when they expire; rate-limit counters are deleted once their window has passed.
• Planner sign-in sessions and saved builds: a sign-in session lasts at most 30 days and ends when you log out or change your password; saved builds are kept until you delete them or your account is deleted.
• Last IP address and last connection date: overwritten the next time you connect, so they describe your most recent session rather than your history.
• Backups: the databases are backed up daily and three complete restore points are kept. A deletion request is therefore fully reflected once those restore points have rotated out.
• Server logs: rotating log files keep a small number of recent files and are used for operations and abuse investigations.

6. Cookies and local storage

This website sets at most two cookies, both strictly necessary and both marked HttpOnly and SameSite=Strict:

• legacy_csrf is set only when you use an account form or log in to the character planner, and expires after one hour. Its only job is to prove that the form you submitted came from this site, which stops other websites from creating accounts, changing passwords or changing your saved builds on your behalf.
• legacy_auth is set only if you choose to log in on the character planner. It holds a random sign-in token (never your password), is sent only to this site's account service, expires after 30 days and is deleted when you log out.

Neither is an analytics or advertising cookie, and neither can follow you to other websites. Because they are strictly necessary for a service you ask for, they do not require consent under the ePrivacy rules. Simply visiting a page, including the home page, the bestiary, the encyclopedia, the character planner, the changelog, the status page and this notice, sets no cookie at all.

The character planner keeps your current unsaved build in your browser's local storage so it is still there when you come back. It never leaves your device unless you save it to your account, and you can remove it by clearing this site's data in your browser. We do not use session storage, tracking pixels or fingerprinting.

7. Your rights

You have the right to:

• be told what data we hold and get a copy of it (access);
• have inaccurate data corrected (rectification);
• have your account and its data deleted (erasure);
• ask us to limit what we do with your data (restriction);
• receive the data you provided in a portable format (portability);
• object to processing based on our legitimate interests, such as abuse investigations;
• withdraw any consent you gave, without affecting what happened before you withdrew it.

To use any of these rights, contact the server owner using the details in section 1. We answer within one month. Because the account name is the only identifier we have, we will ask you to show that the account is yours, for example by logging in from the account, or by confirming from the recovery email address saved on it. We will never hand account data to someone else just because they know the account name.

If you are not satisfied with our answer, you can complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es). We would appreciate the chance to put things right first.

8. How we protect it

The site is served over HTTPS only. Passwords are stored as salted PBKDF2-HMAC-SHA256 verifiers and are never stored or shown in plain text. Recovery links are stored as one-way hashes, work once, expire after 30 minutes and stop working after a password change. The website cookies are HttpOnly and SameSite=Strict, the site sends a strict Content Security Policy and allows no external resources, and the database user used by the website can only reach the account, recovery and saved-build tables it needs, not player inventories or account roles. Backups are kept on the server for the retention period described above.

9. Children

Astrub Legacy is made for players aged 14 and over, or for younger players whose parent or guardian agrees to the account. We do not knowingly collect data from children below that age. If you believe a child created an account, contact the server owner and the account and its data will be removed. Please do not use your full real name, address or other contact details as a character or account name, because character names are visible to other players.

10. Changes to this notice

If the way the service handles personal data changes, this page is updated and the date at the top changes with it. Continuing to use the service after an update means the new notice applies.

11. Contact

Questions, requests and complaints about personal data: use the channel that gave you your invitation code, or the contact the community already uses to reach the owner.