Privacy Notice

Effective October 25, 2026

What we store when you have an account

• Your account: your username; your password and recovery code, but only as scrambled “hashes” that can’t be turned back into the original (we never see or keep the password itself); when you joined and last signed in; recent failed sign-in attempts (to stop password guessing); and, if it ever happens, a suspension and its reason.
• Your sign-ins: a random sign-in token kept in a cookie on your device, of which we store only a hash, with when it was made and last used, when it expires, and the name your browser gives itself (its “user agent”, like “Chrome on Windows”). A sign-in lasts 30 days from when you last used it.
• Your heroes: names, classes, appearance, skills and experience, items, marks, quests, deeds, map discoveries, titles and other progress, with when each was saved and a random ID that the game makes for your browser, so it can tell which device saved last.
• A security log of account events: sign-ups (with only the start of your IP address, like 203.0.x.x), password changes and recoveries, heroes made, imported and retired, saves that look unusual, and moderation actions.

Your IP address is used, while you are connected, to stop abuse such as password guessing, and isn’t stored apart from that partial address at sign-up.

What other players can see

• While you play an online hero: your hero’s name, class, appearance, gear, level and title, where your hero is and what it is doing, and the emotes and quick-chat phrases you choose. There is no free-text chat, and anyone can hide another player.
• On the hiscores, which anyone can view: your hero’s name, class, ranks and experience.
• Your username is never shown to other players.

Cookies and storage on your device

• One essential cookie, gr_session, keeps you signed in. It can’t be read by the game’s code or by other sites, and it is only sent to the Glyphrest server.
• The game also keeps your settings, a copy of your heroes (so a lost connection can’t lose progress) and that random browser ID in your browser’s local storage. When you sign out, the copies of your heroes are removed, except progress that hasn’t reached the server yet.
• If you play offline, your heroes stay only in your browser on that device. We never see them.
• No advertising, tracking or analytics cookies, and no analytics of any kind.

Where it is kept, and who helps us

• Render (Render Services, Inc., United States) runs the game’s server.
• DreamHost (New Dream Network, LLC, United States) hosts the database that holds accounts and heroes, and our website.
• Like any website, both may keep standard network logs (such as IP addresses and times) for security and reliability, under their own privacy policies.
• When you open the game, your browser also fetches the typefaces from Google Fonts (Google LLC) and the three.js 3D library from cdnjs (Cloudflare, Inc.), which see your IP address and basic browser details as any website does.

We don’t sell or share your information with anyone else, and we don’t use it for advertising. We would only disclose it if the law required us to.

How long we keep it

• Your account and heroes: until you delete your account.
• A hero you retire from the Characters screen: kept for 30 days in case it was a mistake (write to us to bring it back), then deleted for good.
• Sign-ins: deleted when they expire or when you sign out.
• The security log: 12 months.
• When you delete your account, your account, sign-ins, heroes, skills and items are deleted straight away. Copies in our hosts’ backups age out on their normal schedule.

Your choices

• On the title screen, Account lets you change your password, make a new recovery code, sign out, sign out on every device, and delete your account and all its heroes.
• You can ask us for a copy of what we hold about your account, or ask us to correct or delete it, by writing to 2ndthunder@gmail.com with your username. Because accounts have no email address, we may ask you to confirm details only the account’s owner would know, such as your heroes’ names, classes and roughly when you made them.
• If you email us, we use your message and address only to reply to you.

Keeping it safe

Connections to the game use HTTPS. Passwords and recovery codes are hashed with scrypt, sign-in tokens are stored only as hashes, sign-in attempts are limited, and accounts rest for a few minutes after repeated wrong passwords. No system is perfectly secure, so please use a password you don’t use anywhere else.

Children

You must be 13 or older to make an account. We don’t ask for real names, email addresses, birthdays or photos from anyone, and online play has no free-text chat. If you believe a child under 13 has made an account, write to 2ndthunder@gmail.com and we will delete it.

Changes

If we change what we store or who can see it, we will update this notice first, and change the “Effective” date above.

Contact

Jacob Unger (“Hellzthunder”) · 2ndthunder@gmail.com