Last updated 20 August 2026

Privacy Policy

1. 1. Who we are
2. 2. What we collect
3. 3. What we do not collect
4. 4. Why we use it
5. 5. Legal bases (EEA and UK)
6. 6. Cookies and browser storage
7. 7. Who we share it with
8. 8. How long we keep it
9. 9. Security
10. 10. Your rights
11. 11. California residents
12. 12. Children
13. 13. International transfers
14. 14. Changes
15. 15. Contact

1. Who we are

The Olde World: Online is operated by crkhaus studios, a sole proprietorship established in California ("we", "us"). For the purposes of the UK and EU General Data Protection Regulation, we are the controller of the personal data described here. You can reach us at legal@theoldeworld.com.

This policy covers the website at theoldeworld.com and the game served from it. It does not cover our Discord server, which is operated by Discord Inc. under its own privacy policy.

2. What we collect

2.1 Account details

To play you choose a name and a password. We store:

• The name, as you typed it. It is your login and your character's name, visible to every other player in the game. It does not have to be your real name, and we recommend it is not.
• A random salt and a scrypt hash of your password. We never store the password itself and cannot read, recover, or tell you what it is.
• The time the account was created, and a role flag recording whether the account has game-master powers.

2.2 Game data

So the world survives a restart, we store what your character is and where it left off: character name and appearance, position in the world, statistics, skills, the items you are carrying and wearing, any houses and pets you own, and your corpse if you have one. This is game state tied to your account, not information about you as a person.

2.3 Chat and in-game messages

Chat is relayed between players in memory and is not written to our database. Other players can of course read what you say and keep their own record of it, and we may view messages in the moment for moderation. Never type anything into game chat that you would not want a stranger to keep.

2.4 Technical and log data

Our web server keeps standard access logs. Each entry contains your IP address, the date and time, the page or file requested, the response status, and your browser's user-agent string. These are generated automatically by the web server software and are used for security, rate-limiting, abuse investigation, and diagnosing faults. We do not use them to build a profile of you or link browsing to gameplay.

3. What we do not collect

To be unusually specific, because most policies are not:

• No email address. There is no email field anywhere. This is also why we cannot offer a password reset.
• No real name, date of birth, postal address, or phone number.
• No payment information. The alpha is free and we take no payments, so we hold no card or bank details.
• No analytics or advertising. There is no Google Analytics, no pixel, no ad network, no A/B testing tool, no session recorder, no heatmap, no error-reporting service.
• No third-party requests at all. Every file the site and game load, including fonts and images, is served from theoldeworld.com. Loading this page contacts no other company.
• No cookies. See section 6.
• No sale or sharing of personal information, ever, for any price.

4. Why we use it

• To run the game. Authenticating your login, restoring your character, and keeping the world consistent between sessions.
• To keep it working and safe. Diagnosing crashes, blocking abuse, rate-limiting, and enforcing our Terms of Service.
• To answer you. If you email us, we use your message and address to reply.
• To comply with the law where we are required to.

We do not use your data for advertising, profiling, or automated decisions that produce legal effects.

5. Legal bases (EEA and UK)

If the GDPR or UK GDPR applies to you, we rely on:

• Performance of a contract (Art. 6(1)(b)) for account details and game data, since without them we cannot provide the game you asked for.
• Legitimate interests (Art. 6(1)(f)) for server logs and moderation: our interest in keeping the service secure and available, balanced against your interest in not being tracked, which is why the logs are minimal and short-lived.
• Legal obligation (Art. 6(1)(c)) where we must retain or disclose something by law.

6. Cookies and browser storage

We set no cookies. There is no consent banner on this site because there is nothing to consent to.

The game does use your browser's localStorage, which stays on your own device and is never transmitted to us as such:

• ow_remember, ow_auto and ow_hud_open hold interface preferences.
• ow_name and ow_pass hold your login details, and only if you tick "remember me".

7. Who we share it with

We do not sell, rent, or trade your data. We share it only with:

• Our hosting provider, which operates the server the game runs on and therefore necessarily stores the database and logs on its hardware.
• Law enforcement or courts, where we are legally required to, or where we believe in good faith it is necessary to prevent serious harm. Given how little we hold, there is usually little to give.
• A successor, if the game is ever sold or transferred. You would be told first, and this policy would continue to apply until replaced.

Anything you type in public chat, and your character's name and appearance, are visible to other players by design. We cannot control what they do with it.

8. How long we keep it

• Account and game data: for as long as the account exists. Because the game is in open alpha, accounts, characters, and the world may also be wiped at any time as part of development, which deletes this data outright.
• Server access logs: kept on a short rotation, ordinarily no more than 30 days, then overwritten.
• Email you send us: kept as long as needed to deal with the matter and any follow-up.

9. Security

• All traffic to the site and the game server is encrypted with TLS.
• Passwords are stored as scrypt hashes with a unique random salt per account and compared in constant time. A copy of our database would not reveal anybody's password.
• The game server and internal services are bound to the local machine only and are not reachable from the internet except through the front-end web server.

No system is perfectly secure, and this one is an alpha built by one person. Please use a password you do not use anywhere else. If we ever discover a breach affecting your data we will say so publicly and promptly, and notify regulators where required.

10. Your rights

Wherever you live, you may ask us to:

• Access the data we hold about your account, and get a copy.
• Correct anything inaccurate.
• Delete your account and its data.
• Port your data to yourself or another service in a machine-readable form.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent, where we relied on it.

Email legal@theoldeworld.com from wherever you like, with your account name. Because we hold no email address, we may ask you to prove control of the account by logging in and confirming something in game before we act on a request. We will respond within 30 days, free of charge. Deletion is permanent and cannot be undone, and it takes your characters, items, and houses with it.

If you are in the EEA or UK and think we have handled your data badly, you may complain to your national data protection authority, and we would rather you told us first.

11. California residents

Under the California Consumer Privacy Act as amended by the CPRA, you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising them.

• We have not sold or shared personal information in the preceding twelve months, and we do not do so now. There is no "Do Not Sell or Share My Personal Information" link because there is nothing to opt out of.
• We do not use or disclose sensitive personal information for any purpose beyond providing the service.
• Categories collected in the preceding twelve months: identifiers (a chosen account name, an IP address in server logs) and internet activity information (access logs). Sources: you, and your browser. Purposes: as set out in section 4. Recipients: as set out in section 7.
• To exercise a right, email legal@theoldeworld.com. You may use an authorised agent, and we will verify their authority.

12. Children

The Service is for adults. You must be 18 or older to have an account. We do not knowingly collect personal data from anyone under 18, and there is no part of the game aimed at children.

If you believe a minor has created an account, tell us at legal@theoldeworld.com and we will close it and delete the data.

13. International transfers

Our servers are in the United States. If you play from outside the United States, the data described here is transferred to and stored there, a country whose data protection laws may differ from your own. Where we transfer personal data out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where applicable. Ask us and we will tell you what is in place.

14. Changes

We may update this policy. The date at the top always reflects the current version, and for material changes we will give notice on the website or in the game before they take effect.

15. Contact

crkhaus studios
A sole proprietorship established in California
legal@theoldeworld.com

See also our Terms of Service.