Who is responsible
Halmgaard is operated by Alexander Gillberg, who is the data controller for the personal data described here. For anything in this policy — including access, correction and deletion requests — write to codatproduction@gmail.com.
This website
halmgaard.com has no accounts, no forms that collect personal data and no advertising. Nothing on this site is shared with an analytics company, an ad network or any other third party, and no cookie is set on your browser for measurement.
We do count visits, on our own server. When you open a page we record the date, which page it was, which site linked you here (the site's name only, never the full address you came from), and whether your browser reports itself as a phone or a computer. Downloads of the desktop client are counted the same way.
Alongside each of those we store a short code made by hashing your IP address together with your browser's user-agent string, today's date and a secret held on the server. Your IP address itself is never written down. Because the date goes into the hash, the code you get today and the code you get tomorrow are unrelated — the record cannot be used to follow you from one day to the next, or to recognise you when you come back. It exists only so that reading five pages in an afternoon counts as one visit rather than five. These records are deleted after 400 days. We do this on the basis of our legitimate interest in knowing whether the site is reaching anyone.
The web server also keeps standard access logs, which include your IP address, the page requested and your browser's user-agent string. These exist to keep the site running and to investigate abuse.
Signing in on the website
You can sign in at your account to see your own characters and account status. There is no separate website account: you sign in with the Halmgaard account you already play with, using Discord, Google or your email address and password — the same three ways the game offers. Signing in here cannot create a new account.
If you use Discord, it tells us your Discord user id and username and nothing else: we ask only for the identify permission, not your email address and not the servers you are in. If you use Google, we ask only for openid and email. Either way that provider will have its own record of you having signed in, governed by their privacy policy rather than ours.
If you sign in with your email address and password, the password passes through this website on its way to the game server, which is the only place it is checked. It is sent over an encrypted connection, held only for as long as that one request takes, and is never written to a log or stored anywhere on the website. It is worth knowing that the two options above avoid this entirely — with those, no password exists for this site to handle.
Failed sign-in attempts are counted, by your IP address and by the email address being tried, so that the form cannot be used to guess passwords. These counts expire within fifteen minutes.
When you sign in, your IP address is passed on to the game server, exactly as it would be if you had signed in from the game itself. Without that the game server would record this website's address as yours, which would break the account-theft detection described further down and let IP bans be sidestepped.
Signing in sets one cookie, which holds nothing but a random session identifier. It is marked so that scripts in the page cannot read it, and everything it refers to — including the token that speaks to the game server on your behalf — is kept on our server, never in your browser. It lasts one hour from your last visit, and signing out deletes it immediately. It is strictly necessary for signing in to work, so no consent banner asks you about it; nothing on this site sets a cookie for any other purpose.
The account page reads your data live from the game server each time you open it. Nothing from it is stored on the website.
Fonts are loaded from Google Fonts. That means Google receives your IP address when a page loads. If you would rather that did not happen, a browser extension that blocks third-party requests will stop it; the site remains fully usable without the fonts.
The leaderboards and character pages show data from the live game world: character names, levels, classes and skills. They never show account information such as email addresses or IP addresses, and characters belonging to staff or deleted characters are excluded.
The game
Playing Halmgaard requires an account. In connection with it we store:
- Your email address and password. The address identifies the account and is the only way to recover it. The password is stored hashed, never in readable form.
- Your IP address. The address used at your most recent login is retained, and addresses are logged when you sign in and when a session ends. This is used to detect account theft and abuse, and to enforce bans.
- Your characters and their progress. Names, levels, skills, inventory, position, guild membership, quests and property.
- Purchases. When you buy something through Google Play we store the order identifier and the receipt returned by Google, so the purchase can be verified and honoured. We never see or store your card details — the payment is handled entirely by Google.
- Moderation records. If an account is suspended we store the reason and how long it lasts.
- Chat and in-game actions, to the extent needed to investigate reports of cheating or harassment.
Why we may process it
Account data, character data and purchases are processed to perform the contract you enter into by playing the game. IP addresses, moderation records and abuse investigations are processed on the basis of our legitimate interest in keeping the game secure and fair for everyone. Purchase records are also kept to satisfy accounting obligations.
Who else sees it
We share personal data only with the services required to run the game:
- Mailgun — sends password recovery emails. It receives your email address. We use their EU infrastructure.
- Google Play — handles Android distribution and payments, and verifies purchase receipts.
- Vultr — hosts the game servers and this website.
We do not sell personal data, and we do not share it for advertising.
Where it is stored
Game and website data is stored on servers operated by Vultr. Some of the services above process data outside the EU/EEA; where that happens it is covered by the transfer safeguards those providers offer, such as the EU Standard Contractual Clauses.
How long it is kept
Account and character data is kept for as long as the account exists. If you delete a character it is retained in an inactive form so that the name cannot be immediately reused and so that trades and guild history remain coherent; it no longer appears anywhere on this website. Purchase records are kept as long as accounting rules require. Server logs, including IP addresses, are kept for a limited period and then overwritten.
Deleting your account
You can have your account removed at any time. Email codatproduction@gmail.com from the address the account was registered with, and say that you want it deleted. Writing from the registered address is what lets us confirm the account is yours.
Your email address is deleted along with the account — we do not keep it on file afterwards, and it is not added to any mailing list. Your characters are removed from play at the same time. The only things that may remain are records we are legally required to keep, such as purchase receipts for accounting, and those are no longer linked to you by name or address.
Your rights
If you are in the EU or EEA, the GDPR gives you the right to obtain a copy of the data we hold about you, to have inaccurate data corrected, to have your data deleted, to restrict or object to how we process it, and to receive your data in a portable form. Where processing rests on consent, you may withdraw it at any time.
Write to codatproduction@gmail.com to exercise any of these. You also have the right to complain to your national data protection authority; in Sweden that is Integritetsskyddsmyndigheten (IMY).
Children
Halmgaard is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, write to us and we will remove it.
Changes
We will update this page when the way we handle data changes, and the date at the top will tell you when that last happened. Material changes will also be announced in the game and on the Discord.