Privacy Policy

Last updated: 24 July 2026

Caves & Lizards ("the game", "we") is a free browser game run by an independent developer based in Sweden. This page explains, in plain words, what data the game touches and what happens to it. Questions or requests: viktor.raskandersen@gmail.com.

What we collect, and why

• Game account — your email address, a password (stored only as a salted scrypt hash — we cannot read it), and your game progress (characters, deeds, gold, and the like). Legal basis: performing our contract with you — running the game you signed up for.
• Launch-news list — if you sign up on the front page: your email address and the time of your consent. Legal basis: your consent, which you can withdraw at any time.
• Anonymous visit statistics — a first-party, cookie-free counter. It stores the page visited, the referring site, and a salted identifier that rotates every day, so we can count daily visitors but cannot follow anyone from one day to the next. No raw IP address is ever stored in these statistics. Legal basis: legitimate interest in knowing whether anyone is out there.
• Server logs — like nearly every web server, ours records requests (including IP addresses) in technical logs used for security and troubleshooting. Logs are rotated and kept for at most 90 days. Legal basis: legitimate interest in keeping the service secure.

Cookies

One cookie: arenan_sid, which keeps you logged in to the game for up to 7 days. It is strictly necessary, HttpOnly, and never used for tracking or advertising. There are no third-party or analytics cookies, which is why there is no cookie banner.

Where your data lives, and who sees it

Everything is hosted on a server in the EU (AWS, Stockholm region). We do not sell, rent, or share your data with anyone. If password-reset email is enabled, the email delivery provider processes the recipient address for the sole purpose of delivering that message.

How long we keep it

• Account and game data: until you delete your account.
• Launch-news list: until you unsubscribe or the list is retired.
• Technical logs: at most 90 days.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected, or have it erased. The fastest road to erasure is in the game itself: log in, go to the champion-selection screen, and press Delete account — it removes your account, characters, art, and email immediately and permanently. To unsubscribe from the launch-news list, or for anything else, email viktor.raskandersen@gmail.com. You also have the right to complain to your data-protection authority (in Sweden, IMY).

Age

The game is meant for players aged 13 and up. If you are under 16, make sure a parent or guardian is fine with you playing.

Changes

If this policy changes in a way that matters, we will say so on the site. The date at the top always tells you when it was last touched.