Privacy policy
Shards of Kael · last updated 17 October 2026 · server: shardsofkael.com
Shards of Kael is a small fantasy role-playing game. This page explains what the game stores, where, and why, in plain words. Short version: the game works without an account and keeps your hero on your device; if you choose to sign in to a game server, that server stores your account and hero so you can play with other people; diagnostics are anonymous and can be turned off.
Who is responsible
This copy of the game and the game server at shardsofkael.com are operated by support@shardsofkael.com. Questions and requests about your data go there. The game software itself does not send anything to its developer; each server operator holds only the data of the players who sign in to their server.
Playing without an account
Your hero, settings and progress are saved in your browser's storage or in the app's storage on your device. Nothing is sent anywhere. A save code you create is a copy of your hero as text; it stays wherever you paste it, and it is your responsibility to keep it private, because anyone with the code can load that hero.
If you sign in to a game server
Creating an account on a server is optional. It enables parties, guilds, trading, the arena, chat and a hero that is stored on the server. The server then stores:
| Data | Why | How long |
|---|---|---|
| Username, a salted hash of your password (scrypt), a hash of your recovery key, when the account was created, and sign-in tokens for staying signed in | To run your account and let you back in | Until you delete the account |
| Email address, only if you add one in Account settings | So the operator can confirm it is you if you contact them; it is never used for marketing | Until you remove it or delete the account |
| Your hero: level, class, items, gold, quests, achievements, outfits, arena and tower records, guild membership, friends list and blocked list | That is the game | Until you delete the account |
| Chat messages you send (world, nearby, party, guild and whispers) | Delivered to the players they are addressed to. The last 12 lines from each account are kept briefly so that reports can be reviewed | Delivered messages are not archived; the 12-line moderation buffer rolls over as you chat and is dropped when the account is deleted |
| Reports you send or that name you: reporter, reported player, reason, your note and the reported player's recent chat lines | Moderation | Up to the 500 most recent reports; reports about a deleted account are anonymised |
| Moderation records: mutes, suspensions, restrictions and flags raised by automatic progress checks | Fair play and safety | Until cleared by a moderator or the account is deleted |
| Your network address (IP) | Rate limits and sign-in lockouts, held in the server's memory only; a hashed, daily-changing form is written with diagnostics | Memory entries expire within an hour; hashes cannot be turned back into an address |
Other players see your hero's name, class, level, outfit, guild tag, region and arena standing, and your username in the player list, friends lists and leaderboards.
Diagnostics
When you first open the game you choose whether to send diagnostics. If you allow them, the game sends small anonymous events: a session start with your device's screen size, graphics chip name, browser or app version, memory and processor count, the graphics quality in use and language; level-ups; deaths and which monster caused them; quests completed; arena duels; rebirths; purchases made with in-game gold; errors with their message; and when you quit. Events carry a random session id, a pseudonymous device id derived from a daily-changing hash of your network address and, if you are signed in, a hash of your username. No names, chat or message contents are included. Diagnostics are kept for 90 days, are visible only to the server operator, and are used to find crashes and balance the game. You can turn them off at any time in Hero → Settings or in the Account tab.
Reminders (Android app)
If you turn reminders on, the app schedules notifications on your phone (when daily missions reset and if you have been away a few days). These are set locally on the device; there is no push service and nothing is sent to a server.
What the game does not do
- No advertising, no advertising identifiers, no tracking across apps or sites, no analytics or crash-reporting SDKs from other companies.
- No in-app purchases and no access to contacts, location, camera, microphone, photos or files.
- Your data is not sold and is not shared with anyone except the hosting provider the operator uses to run the server, which processes it only to keep the server running.
The web version on claude.ai
When the game is opened as a page on claude.ai, that page is hosted by Anthropic under its own terms and privacy policy. The game stores your hero in your browser; the page's owner can additionally keep a copy in the page's storage, and people viewing the same page may see each other's hero names and chat in the shared room provided by that platform. The game server described above is separate and only involved if you sign in to one.
Your choices and rights
- See your data: Online → Account → Export shows and downloads everything the server stores about your account.
- Correct it: change your password, recovery key or email in the Account tab.
- Delete it: Online → Account → Delete account, or the web form at /delete-account. Deletion is immediate in the live database; hourly server backups are kept for up to 30 days and then expire, after which no copy remains.
- Turn off diagnostics: Hero → Settings, or the Account tab.
- Depending on where you live you may have additional rights (for example under the GDPR or the CCPA) to access, port, restrict or object to processing of your data, and to complain to a supervisory authority. Contact the operator above to exercise them; the legal basis for processing account data is the performance of the game service you requested, and for diagnostics your consent.
Children
The game is not directed at children under 13 and does not knowingly collect personal data from them. The only personal data a player can provide is a username, an optional email and what they type in chat; please do not use your real name as a username. Parents who believe a child has created an account can ask the operator to delete it.
Security
Connections to a properly configured server use HTTPS and secure WebSockets. Passwords are stored only as salted scrypt hashes, recovery keys and sign-in tokens only as hashes. No system is perfectly secure, so use a password you do not use elsewhere.
Changes
If this policy changes in a way that matters, the date at the top changes and the game shows a notice. Continuing to play after that means you accept the updated policy.
This page is served by the game server, so every operator publishes it with their own contact details.