Privacy Policy

1. Who we are

Acris Software Ltd. Co. is a veteran-owned company based in Kingwood, Texas, USA. We are the controller of the personal data described here. Contact us at info@acrissoftware.io about anything in this policy.

2. What we collect

Account data, needed to provide your account:

• Email address and username.
• Password, stored only as an argon2 hash; we cannot read it.
• Your authenticator (TOTP) secret, encrypted, and one-time recovery codes, stored only as hashes.
• Access tier, invite details and the date your account was made.
• Sign-in records: IP address, browser or device type, and time, kept for security.
• Devices you sign the launcher in on: a device label, the platform and when it was last seen.
• Installs and play time: which launcher and game versions are installed, and when each play session started, how long it lasted and which build it was. This is used for your account standing (for example the supporter steps shown on your account) and is not opt-in.

Gameplay data, on by default; turn it off at any time in Settings in the portal or the launcher:

• Game logs, performance metrics, how long each craft takes you, and what happened during a scripted test.
• A session report written by the game when it closes: the build and platform, when the session ended, and the game's log for that session, used to fill in bug reports and to improve the game.
• It is collected only while the game is running and is sent by the launcher. If you have turned it off, our servers refuse it.

Things you choose to send us:

• Bug reports, questionnaire answers, survey answers and messages from the contact form.
• A tester application: your email address, your platform, and if you give them, your Discord username and the games you play.
• Worlds (save files) you upload to your account.
• Questions you ask Traveler, our help assistant, and any rating or correction you give an answer.
• If you link Discord: your Discord user ID and username.
• If you support us through Ko-fi: the amount, currency and Ko-fi's reference for the payment. We never receive card details.

We do not collect precise location, contacts, microphone or camera data, or advertising identifiers.

3. How we use it, and our legal bases

• To provide your account, the launcher, game downloads, updates and support (performance of a contract).
• To keep accounts and our services secure, prevent abuse and enforce our Terms (legitimate interests).
• To find and fix bugs and improve the game from gameplay data (legitimate interests: making the game work for the people playing it). You can object at any time by turning gameplay data off in Settings or the launcher, and we stop collecting it.
• To answer messages and send emails you asked for, such as invites and account notices (contract, or legitimate interests).
• To meet legal obligations (legal obligation).

We do not use your data for advertising, we do not sell it, and we do not share it for cross-context behavioural advertising. We make no automated decisions that have legal or similarly significant effects on you.

4. Traveler, our AI assistant

Traveler answers questions on the website, in the launcher and on Discord. It runs on our own hardware; your questions are not sent to any third-party AI service. Player questions are answered only from our public player guides.

A question waiting to be answered is stored encrypted and deleted 30 minutes after it is answered. If you rate or correct an answer, the question, the answer and your correction are kept and may be used to improve Traveler. Traveler can be wrong; do not rely on it for anything outside the game.

5. Who we share it with

We share personal data only with providers that help us run the service, under their own security and privacy terms, and only as needed:

• Cloudflare: website hosting, DNS, content delivery, and bot protection on our forms.
• Proton: sending our email.
• Discord: only if you link your account or use our Discord server.
• Ko-fi: only if you choose to support us there.
• YouTube: dev blog videos on our website load from youtube-nocookie.com only when you press play.

Our own servers, in Texas, USA, store everything else. We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or merger of the company, in which case this policy continues to apply to it.

6. Security

Every connection to our services uses TLS. Passwords are hashed with argon2, authenticator secrets and account numbers are encrypted, and Traveler conversations and queued help questions are encrypted at rest. Every account requires an authenticator app to sign in. Access to personal data inside the company is limited to staff who need it, and staff access to player records is logged.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

7. How long we keep it

• Account data: while your account exists. When you ask us to delete your account, we delete or anonymise its personal data within 30 days, except what the law requires us to keep.
• Sign-in sessions: deleted when they expire. Sign-in security records: 12 months.
• Gameplay data (logs, metrics, session reports, craft times, scripted test runs): 180 days.
• Queued Traveler questions: 30 minutes after they are answered.
• Bug reports, questionnaire and survey answers, ratings and contact messages: as long as they are useful to improve the game, and no longer than 3 years.
• Uploaded worlds: until you delete them or your account.
• Tester applications: 12 months, then deleted.

8. Your choices and rights

Gameplay data collection is on by default. You can turn it off (or back on) at any time in Settings in the portal or in the launcher. Turning it off stops future collection; data already sent is kept only for the period above, or deleted sooner if you ask.

Depending on where you live (including the EU, the UK, California, Texas and other US states), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and to appeal our decision on a request. We do not sell personal data, so there is nothing to opt out of; we will not treat you differently for using these rights.

To make a request, email info@acrissoftware.io from the address on your account. We answer within 30 days (45 where the law allows). If you are in the EU or UK you may also complain to your data protection authority.

9. International users

We are based in the United States and store data here. If you use our services from elsewhere, your data is transferred to the US. Where the law requires it, we rely on appropriate safeguards for that transfer, such as the European Commission's standard contractual clauses.

10. Children

Our services are not directed at children under 13, and you must be at least 13 to make an account (16 in the European Economic Area and the UK, unless a parent or guardian consents). We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

11. Cookies and local storage

The portal uses one strictly necessary cookie to keep you signed in, and stores a security token in your browser for the session. The website remembers your light or dark theme in your browser. Cloudflare may set strictly necessary security cookies. We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

12. Changes

When we change this policy we update the version and date below. If a change is material, we tell you by email or in the launcher, and ask you to review it before you continue.