Privacy Policy
Updated 8 November 2026.
This policy covers crownsandrealms.com (the game) and forum.crownsandrealms.com (the field manuals). The same person operates both. Write to [email protected] for any privacy request.
What we keep because you play
When you register we store a username, a password hash (not the password itself), the time the account was created, and an email address if you typed one. The character you then live — name, species, skills, inventory, gold, letters, journal, location, and the rest of that life — is stored so the world can continue when you come back. That processing is necessary to provide the game you asked to play.
The sign-in cookie CROWNHEARTH holds only a session id. It is marked HttpOnly and SameSite=Lax, it is Secure on HTTPS, and it ends when you close the browser. Without it the game cannot tell that you are signed in.
What we keep only if you agree
If you choose Accept all, the game writes a first-party visit record: the page, the time, your IP address, a short browser string, a hash of the session id, and your account id if you are signed in. Those rows are deleted after 90 days. They are for the operator’s own count of who is in the world. They are not sold, not used for advertising, and not sent to Google or any other analytics company.
If you choose Reject non-essential, those visit rows are not written. You can change this later with Cookie settings. The choice itself is stored in the cookie cr_consent for 180 days on the host where you made it. The game and the forum each keep their own choice.
Payments
The Donator Pack, when it is offered, is charged by Stripe on Stripe’s page. We do not receive your card number. We keep a record that a pack was paid, the amount, the Stripe session id, and which character it was granted to, so a pack is not granted twice. Stripe’s own privacy policy applies on their checkout page, and Stripe may process that payment in the United States under its own safeguards.
The forum
The field manuals are public pages. You do not register there to read them. WordPress sets a sign-in cookie only when an administrator logs in. Comments are closed, so the forum does not set a comment cookie for readers.
Who else sees it
The sites are hosted by HostUp in Sweden. HostUp processes the data as the host of the server. Stripe processes a payment only if you start one. We do not sell personal data and we do not share it with advertisers.
How long
- Account and character: for as long as the account exists.
- Visit records, if you allowed them: 90 days.
- Cookie choice: 180 days, or until you change it.
- Sign-in cookie: until you close the browser, or until you log out.
Your rights
You can ask for a copy of the account and character data, a correction, deletion, a limit on processing, or a portable copy. You can withdraw the analytics choice at any time with Cookie settings; that does not affect play that already happened. You can also complain to the data protection authority where you live. Because the server is in Sweden, you can also complain to the Swedish Authority for Privacy Protection (IMY).
To delete an account, write to [email protected] from the email on the account if there is one, and include the username. Letters you already sent to other players can remain in their journals, because those letters are part of their game.
The game is not directed at children under 16. Do not register a child.