PRIVACY POLICY

1 · The short version

• You can create an account with just a username and password. An email is optional and only used to recover your password.
• We don't use ad trackers or third-party analytics, and we don't sell your data. There are no advertising cookies. We do keep our own anonymous, aggregate usage counts — how many people play, which features get used — to improve the game, never tied to your name.
• Some features — the werewolf's "howl," the witch's "selfie," and the mystic's "third eye" — can record your microphone or camera, but only after you opt in and tap a consent prompt, and only for that one feature.
• Payments are handled by Stripe. We never see or store your card number.
• You can delete your own account and all its data yourself, anytime, right from your profile — no need to ask us. See Your choices.

2 · Who we are

Thornreach ("the game", "we", "us") is operated by the Thornreach team. This policy covers the Thornreach website and the game at thornreach, however you reach them. For anything about your data, contact us at [email protected].

3 · What we collect

We try to collect as little as possible. Here's the full list.

Account information

Gameplay data

Your characters, levels, story progress, in-game gold, inventory, coven membership, achievements, and leaderboard standings. This is what makes your account yours, and some of it (name, class, level, coven, honors) is shown publicly on your profile and the leaderboards.

Technical & security data

To keep the town safe from abuse, we keep a security log of events like failed logins and rate-limit trips. These records can include your IP address and the time. We use them only to protect accounts and the service — not to build a profile of you.

Payments

If you buy a Town Pass or a coven charter, checkout is handled by Stripe. Your card details go straight to Stripe — we never receive or store them. We keep only a payment reference so we can confirm your purchase. In-game gold is not real money, has no cash value, and can't be cashed out.

Notifications (optional)

If you turn on browser notifications (for events like moonrise), your browser gives us a push "subscription" so we can send them. You can turn this off in your browser at any time.

On your device

We store a small login token and your display name in your browser's local storage so you stay signed in. This is not an advertising or tracking cookie — it's only used to keep you logged in and lives on your device.

Anonymous usage statistics

To understand how the game is doing and where to improve it, we keep aggregate counts — things like how many people opened the game today, which callings get chosen, or how many covens were founded. These are plain tallies: no profile of you, no browsing history, no third-party analytics service. The only per-account detail involved is a single "last active day" marker so we can count unique players without identifying them.

4 · Selfies, howls & voice — read this one

A few optional features capture real media. We want to be especially clear about these.

The witch's "selfie"

In one in-game trade, you may choose to take a selfie with your camera. If you do:

• It happens only after you agree to the trade — nothing is captured unless you opt in.
• The photo is sent to Anthropic's Claude vision service for a one-time automated check that it actually shows a human face (to keep the feature from being abused). Anthropic processes it to answer that check.
• If you then list it, the selfie is shown to other players on the in-game Auction House. Treat anything you list as public.
• Only upload a selfie of yourself. Don't capture or upload anyone else's face.

The werewolf's "howl"

In another optional trade, you may record a few seconds from your microphone. It happens only after a consent prompt, captures just that short clip, and — if you list it — can be heard by other players on the Auction House. Again: record only your own voice.

The mystic's "third eye"

One optional spell — "Open the Third Eye" — lets another player ask for a glimpse through your camera. It is off by default: you only ever take part if you switch it on, and even then nothing is captured unless you tap "allow" on the prompt for that specific cast. If you allow it, a single photo from your camera is sent to that one player's in-game inbox — not the public Auction House. Leave the opt-in off and you'll never be asked. (A separate spell, the Scrying Orb, only reveals in-game stats like health and level — it uses no camera.)

What happens to captured media

Deleting your account removes the selfies, voice clips, and vision photos tied to it — from your hard drive, your inbox, and any Auction House listings. Separately, to keep these features from being abused, media may be preserved in a private, access-controlled safety record; we may retain that record, and report it to the proper authorities, where safety or the law requires — see How long we keep it. It isn't used for anything else.

Live coven voice chat

Coven voice chat is peer-to-peer (WebRTC). Your audio streams directly between you and your covenmates and is not recorded or stored on our servers — we only pass along the brief messages that let two browsers connect.

5 · How we use it

• To run your account, save your progress, and show your public profile, covens, and leaderboards.
• To process purchases and confirm your Town Pass.
• To keep the game working and protect it from cheating, abuse, and attacks.
• To send you notifications you asked for, and password resets you request.

We do not use your data for advertising, and we do not sell it.

6 · Who we share it with

We don't sell or trade your personal data. We rely on a few service providers to run the game, and data passes through them only for that purpose:

We may also disclose information if the law requires it, or to protect the safety and rights of players and the game.

7 · How long we keep it

We keep your account and gameplay data for as long as your account exists. Security logs are kept for a limited period and then rotated out. Media you list on the Auction House stays until the listing ends or you remove it. When you delete your account (see below), we remove your account and the personal data tied to it, except anything we're required to keep for legal, accounting, or safety reasons (such as payment records, or a safety record preserved to respond to abuse — see "Selfies, howls & voice").

8 · Your choices & rights

• Delete your account & data: open your profile, scroll to "Delete account," and confirm — it erases your account and the data tied to it right away, no waiting on us. (You can also email [email protected] if you'd rather we do it.)
• See or correct your data: ask us and we'll help.
• Notifications: turn browser notifications off any time in your browser settings.
• Media: don't use the selfie or howl features if you'd rather not — they're entirely optional, and you can remove a listing you made.

Depending on where you live, you may have additional rights over your data (for example under the GDPR or CCPA). We'll honor valid requests — just reach out.

9 · How we protect it

Passwords are salted and hashed, not stored in the clear. Password-reset links are stored hashed. Backups are encrypted. No system is perfectly secure, but we take reasonable steps to protect your data and we limit what we collect in the first place.

10 · Age requirement

Thornreach is for players 18 and older. You confirm your age when you register. The game is not directed to children, and we don't knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we'll remove it.

11 · Changes to this policy

As the game grows we'll update this policy and change the "last updated" date above. If we make a significant change, we'll make a reasonable effort to let players know.

12 · Contact

Questions, requests, or concerns about your data: [email protected]. See also our Terms of Service.