Privacy Policy
What Emberfall keeps about you, why, and for how long. The short version: your account's name and email, and nothing you don't need to play. No ads, no tracking, no selling anything to anyone.
Last updated 8 October 2026.
Who runs Emberfall
Emberfall is made and run by Thomas van Otterloo, a private person in the Netherlands, who decides what is done with your data (the "controller" in the GDPR's words). Questions, requests and complaints: [email protected].
Your password
We never have it. When you type your password in the launcher or on the account page, your own computer turns it into a key, and only the public half of that key (with a random "salt") is ever sent to us. We can check a signature made with it, but we can't work out your password from it. Every message between you and the account service is also encrypted end to end.
What we keep, and why
Your account
- Your account name, your email address, your account number and when you made it. The name is what you play under; the email is how we send you a code to confirm the account and to reset your password.
- The public key and salt made from your password, and how many times it has been changed (so a password change can sign out your other computers).
- Confirmation and reset codes, kept only as a fingerprint of the code, for 30 minutes. If you ask to change your email, the new address waits beside the old until you confirm it.
We need these to give you the account you asked for (GDPR Article 6(1)(b), performing our agreement with you). We keep them until you delete your account. An account whose email is never confirmed is deleted by itself after two days.
Emails
We only email you codes you asked for: to confirm your account, to reset your password, or to confirm a new email address. No newsletters, no marketing.
On your computer
When you sign in, the launcher makes a key for that computer and keeps it, with a certificate we sign, in your own settings folder. It lasts a month and renews itself. Signing out, or "Sign out everywhere" on the account page, ends it. The game also writes logs on your computer; they stay there unless you send them to us yourself, for example with a bug report.
Playing on servers
- Servers we run keep, under your account number, what you need to carry on where you left off: your inventory and armour, where you are, your health, hunger and bed. They also keep the world you build in, the chat in their logs, and lists of operators and bans. We keep these while the server runs; ask us and we'll delete your player.
- Servers other players run, including any in the server list, are run by them, not us. They see your account name, account number and IP address when you join, and keep your player and anything else as they choose. Their owners are responsible for that.
The server list
If you list a server, its name, description, address, room code, player count and your account name are shown publicly to everyone who opens the list. We keep a listing only in memory, and it disappears three minutes after your server stops reporting in.
Technical data
- IP addresses, to stop abuse such as guessing passwords or mass sign-ups: the account service counts requests per address in memory, and forgets an address after a day without requests.
- Web and download logs: our web server and update server log each request (IP address, time, what was asked for, and the browser or launcher's description of itself). These are deleted after 14 days.
- The relay, which lets you join friends by room code, sees both players' IP addresses while you're connected and keeps nothing afterwards.
We do this because we have a legitimate interest in keeping the services secure and working (GDPR Article 6(1)(f)).
What we don't do
No analytics, no ad trackers, and no cookies of our own on this website. The game sends no data about how you play. We don't sell or rent your data, and we don't use it for anything not described here.
Who helps us run it
These companies process data for us, under data processing agreements, and only to provide their service:
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH | The servers everything runs on: the account service, the update server, the relay, our game servers | Germany |
| Brevo (Sendinblue SAS) | Sending the emails with your codes: it sees your email address and the email | France / EU |
| Cloudflare, Inc. | Delivering this website and protecting it from attacks: it sees your IP address and the pages you visit, and may set a strictly necessary security cookie | Worldwide, including the US |
Cloudflare may process data outside the EU. It does so under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
How long we keep it
| Your account | Until you delete it |
| An unconfirmed account | 2 days |
| Codes | 30 minutes |
| Server listings | 3 minutes after the server stops reporting |
| Web and download logs | 14 days |
| Abuse counters | Until a day without requests |
Children
You need to be at least 13 to make an account. If you're under 16, you need your parent's or guardian's permission. If you're a parent and think your child made an account without it, email us and we'll delete it.
Your rights
Under the GDPR you can ask to see the data we have about you, have it corrected, have it deleted, have its use restricted, object to it being used, and get a copy to take elsewhere. Much of this you can do yourself on the account page: see your details, change your email, and delete your account, which removes it straight away. For anything else, email [email protected] and we'll answer within a month.
If you think we've handled your data wrongly, you can complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens, or the one where you live.
Keeping it safe
Passwords never reach us. Everything between the launcher, the website and the account service is encrypted and signed. The servers are kept up to date, and only the people running Emberfall can get into them.
Changes
If we change this policy, we'll update the date at the top. If the change matters, such as keeping something new, we'll say so in the launcher's news before it takes effect.