Privacy Policy
Effective: 30.08.2026
1. Who is responsible
Age of Aincrad (age-of-aincrad.com) is operated by Rockin' Round Robin, Poland. We are the data controller for the personal data described in this policy, except where stated otherwise (see section 4 regarding payments).
Contact for anything in this policy, including data requests: [email protected], or the contact form on the website.
2. What we collect
When you create an account: username, email address, your password (stored only as a bcrypt hash — we never see it), whether your email is verified, and whether 2FA is enabled.
If you sign in with Discord: the account ID, email address, and display name Discord sends us. Your site username is created from your Discord display name. If you sign in with Google: the account ID and email address Google sends us.
If you buy something through Xsolla: to open the checkout we send Xsolla your user ID and email address. Xsolla acts as the merchant of record and sells the content to you under its own terms (see section 4). From Xsolla we receive limited transaction data: the order ID, what you bought, the amount, the transaction reference, your country, and the type of payment method used. We never receive your card number or full billing details — those go directly to Xsolla and never touch our systems.
If you buy something through PayPal checkout: we act as the seller and receive from PayPal the transaction ID, amount, and the name and email on your PayPal account. Your card or bank details go directly to PayPal and never touch our systems.
If you buy or redeem a gift code: the person who redeems a gift code can see the username of the account that bought it.
If you use the contact form: your email address and message, plus your name and phone number if you choose to provide them.
If you apply to join the team: your name, email address, country, website (if provided), the text of your application, and any file you upload.
If you post on the forum: your posts and comments, which are visible to other users together with your username.
Automatically, when you use the site or game client: IP address, browser/user-agent, and request timestamps, recorded in server logs and login audit logs. Our site is served through Cloudflare, which processes visitor IP addresses and request data to route and protect traffic, and provides the Turnstile bot check on our contact form.
In-game: character data and gameplay state needed to run the game.
We do not collect special-category data (health, biometrics, political opinions, etc.), we do not buy data about you from third parties, and we do not build advertising or behavioural profiles.
3. Why we use it, and our legal basis
| What for | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, giving you game access, delivering purchases, running the forum | Contract — Art. 6(1)(b) |
| Transactional email (verification, password reset, order confirmation) | Contract — Art. 6(1)(b) |
| Responding to contact-form messages | Legitimate interest in answering enquiries — Art. 6(1)(f) |
| Handling team applications | Steps taken at your request prior to a contract — Art. 6(1)(b) |
| Rate limiting, blocking abuse, bot protection, login audit logs, keeping the service up | Legitimate interest in security — Art. 6(1)(f) |
| Keeping payment and accounting records | Legal obligation — Art. 6(1)(c) |
We do not sell personal data, share it with advertisers, or use it for marketing.
4. Who else handles your data
Payments — Xsolla. Purchases through the Xsolla checkout are processed by Xsolla (Xsolla (USA), Inc. and its group companies), acting as merchant of record. This means Xsolla — not us — is the seller of the digital content for payment purposes and is an independent data controller for the personal data it collects during checkout: your payment details, billing information, tax data, and fraud-prevention data. For how Xsolla handles that data, see Xsolla's privacy policy at xsolla.com/privacypolicy.
Payments — PayPal. Purchases through the PayPal checkout are processed by PayPal (in Europe: PayPal (Europe) S.à r.l. et Cie, S.C.A.), which is an independent data controller for the payment data it collects. For those purchases, we are the seller and receive only the transaction data listed in section 2. See PayPal's privacy statement at paypal.com/privacy.
Service providers acting on our behalf (processors):
- Cloudflare — provides our content delivery network, DDoS protection, and the Turnstile bot check on the contact form. Cloudflare processes IP addresses and request metadata for all site visitors.
- Our hosting provider, a server hosting company located in Germany (EU) — hosts our servers and database.
- Resend (Resend, Inc., USA) — sends transactional email (verification, password reset, order confirmation) on our behalf.
Sign-in providers: Discord and Google — only if you choose to sign in with them, and each under its own privacy policy.
Where our processors operate outside the European Economic Area, those transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. International transfers connected with payments are addressed in Xsolla's and PayPal's own privacy policies.
5. How long we keep it
- Account data — while your account remains active. If you request account deletion, we delete or anonymise this data except where limited retention is necessary to comply with a legal obligation, investigate security incidents, resolve disputes, or establish, exercise, or defend legal claims.
- Payment and order records — for the period required by applicable accounting and tax law, generally at least 5 years calculated under those rules. Records may be retained longer where required for an audit, dispute, or legal claim.
- Contact-form messages and team applications — until handled, and no longer than 12 months, unless further retention is necessary for a dispute or legal claim.
- Forum posts — visible until removed by you or by our moderation team. Removal currently hides the content from public view. The underlying content and moderation record may remain temporarily for abuse prevention, moderation, dispute handling, and legal claims, after which it is deleted or anonymised under our retention process.
- Login audit logs — normally deleted automatically after 30 days. The configured retention period is technically capped at 90 days, so these records will not be retained for longer than 90 days.
- Server and rate-limiting logs — up to 30 days.
Account deletion works by request: email [email protected] from your account's email address, or use the contact form, and we will delete your account and the character data associated with it. Payment records are retained for the period above because we are legally required to keep them. Data held by Xsolla or PayPal is retained according to their own policies.
6. Your rights
Under the GDPR you can ask us to: give you a copy of your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict how we use it (Art. 18), export it in a portable format (Art. 20), or object to processing based on legitimate interest (Art. 21).
Email [email protected] and we will respond within one month.
For data collected by Xsolla or PayPal during payment, you can also exercise your rights directly with them via the contact details in their privacy policies.
If you think we have handled your data wrongly, you can complain to the Polish supervisory authority: Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or to the authority in your own country of residence.
7. Cookies
We use only cookies that are strictly necessary to run the site — principally a session cookie that keeps you signed in. Cloudflare may set strictly necessary cookies for security and bot protection, including for the Turnstile check on the contact form. We do not use analytics, tracking, or advertising cookies. Payment checkouts may set their own strictly necessary cookies, covered by the payment provider's policy. If our own cookie use ever changes, we will ask for your consent first.
8. Security
We use TLS in transit, bcrypt password hashing, rate-limited authentication endpoints, signed game-server requests, and optional 2FA. Payment card data is handled exclusively by our payment providers: Xsolla is certified under PCI DSS Level 1, the highest level of the payment card industry security standard, and PayPal handles card data for PayPal purchases under its own PCI-compliant systems. No system is completely secure. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.
9. Children
The Service is not intended for anyone under 16. If you believe a child has given us personal data, contact us, and we will delete it.
10. Changes
We may update this policy at any time. The effective date above will change.