Privacy policy

In short

• The website runs no ads, and sets no cookies except one, only if you sign in to your account page, to keep you signed in. We count visits with Cloudflare Web Analytics, which keeps nothing in your browser and doesn't try to recognise you. You don't need an account to read the site.
• Like any server, ours records the requests it gets, including your IP address. We use those logs to keep the site and game running and to stop abuse.
• A game account is a name and a password. We never ask for your real name. You can choose to link an email to it, which we use only to reset your password and remind you of your login names.
• Your settings, quick slots, friends list and copies of your mail are kept on your own device, not by us.
• We never sell your information or share it for advertising.

The website

The site (this page, the downloads and the wiki) is a set of static pages. It sets no cookies, except while you're signed in to your account page: then one cookie, shards_session, keeps you signed in. It's needed for that page to work, only our account service can read it (the page's own scripts can't), it holds which account or linked email you signed in with, and it ends after 30 days, when you log out, or when the account's password changes. The only thing it keeps in your browser is how far down each page you'd scrolled, so the Back button returns you there, and your browser forgets that when you close the tab. Its fonts and images come from our own server.

Requests to the site pass through Cloudflare, which protects it and helps deliver it quickly, and then reach our server. Both record each request: your IP address, the page asked for, the time, and what your browser says about itself (its user agent). See Cloudflare's privacy policy for what it does with them.

Cloudflare also counts visits for us, with its Web Analytics. A small script on each page, the game's page at /play/ included, reports the page you opened (without anything after a ? in its address), the site that sent you, your country, your kind of device, browser and operating system, and how quickly the page loaded. It sets no cookies, keeps nothing in your browser and doesn't try to recognise you from one visit to the next; we see only totals. Cloudflare keeps the full detail for a week, and a sample of it after that. Blocking the script doesn't stop the site or the game working.

The downloads page asks GitHub for the latest release when it opens, straight from your browser, and the downloads themselves come from GitHub. GitHub sees your IP address when that happens; see GitHub's privacy statement.

Links to other sites, such as GitHub and Buy Me a Coffee, take you to services with their own privacy policies. If you support the project through Buy Me a Coffee, that payment is between you and them; we don't receive your card details.

Playing the game

Whether you play in your browser, in the desktop app or on Android, the game connects to our own server, which began as the Meridian 59 Server 104 code.

• Your account: the name and password you choose when you make it in the game.
• A linked email, if you add one: on your account page you can link an email to your account. We keep it with the account and use it only to send you the link that confirms it, password reset links, your login names when you ask for them, and a notice when the email or password is changed. We send nothing else to it. You can remove it on the same page at any time.
• Your characters and play: your characters, what they carry, their skills and spells, where they are, and the in-game mail you send and receive, all kept on our server so the game can work.
• Chat: what you say in the game reaches the players it's meant for. Our server can also record game events and messages in its logs, which we use to fix problems and deal with abuse.
• Connections and logins: your IP address, when you connect, and which account logs in. We use them to limit how many connections one address can open, to stop abuse and to find faults.

Friends

Meridian 59: Shards adds friends to the game through a small relay on our server. While you're playing, it holds your character's name, the server you're playing on, and a key your device made for this, so friends can find and recognise you. The relay keeps this in memory only, and forgets it when you disconnect.

• Your friends can see when you're online. With Share my location on (it is by default), they can also see which room you're in, and where you stand in it while they're in the same room. Turn it off in the Friends window at any time.
• Friends in the same room see your health as a percentage, over your head. Your mana and vigor are never sent.
• With Show me in search on, other Meridian 59: Shards players on the same server can find your character's name to send a friend request. Turn it off to be found only by people who already know you.

On your device

The game keeps some things on your own device, in your browser's storage or the app's own: your settings and key bindings, quick slots, your friends list and its key, and copies of your mail. They stay there; clearing the site's data in your browser, or uninstalling the app, removes them. The desktop and Android apps also keep the game files, and check GitHub for new versions.

Who else sees it

We don't sell your information, and we don't share it with advertisers. Besides other players seeing what the game shows them, it reaches only:

• Cloudflare, which carries the requests to the site and game, and counts visits (above);
• the company we rent our server from, which stores what's on it;
• GitHub, when you use the downloads (above);
• Resend, which sends our account emails, if you link an email: it sees the address and the message (see Resend's privacy policy);
• anyone the law requires us to give it to.

How long we keep it

Your account and characters are kept while the game runs, until you ask us to delete them. A linked email is kept until you remove it or the account is deleted. Logs are kept only as long as we need them to run the service, fix problems and deal with abuse.

Your choices

You can ask us what we hold about your account, to correct it, or to delete your account and characters. Ask on our GitHub issues page. Issues there are public: give only your account or character name, and never your password. We'll check in the game that the account is yours before we act.

Keeping it safe

The site, and the connections our browser, desktop and Android clients make to the game, are encrypted (HTTPS). If you play with the original Windows client instead, its connection isn't encrypted. Only the people who run the server can reach what's on it. No service is perfectly secure, so use a password for Meridian 59: Shards that you don't use anywhere else.

Children

Meridian 59: Shards is for players aged 13 and over. If you think a child under 13 has made an account, tell us and we'll delete it.

Changes to this policy

If what we collect changes, we'll update this page and the date at the top. Every change to the site, this page included, is recorded in our Git history.