Privacy and cookies

Who runs the game

Marginalia is a hobby project, free and without ads. The data controller is Valentino Mettifogo.

What we keep

• Your account: your username, your password (only as a bcrypt hash, never in plain text), when you signed up and when you last logged in.
• Your game: heroes, items, gold, materials, story and expedition progress, achievements, letters received, Arena rating and fights.
• Other players see your username, your team and your rating on the Arena ladder and in the fight history.

We don't ask for an email, a real name or payment details, and we use no analytics, ads or third-party trackers: even the fonts, pictures and music come from our own server.

Browsing data

The site goes through Cloudflare, which protects it from attacks and abuse and so processes your IP address on our behalf. Its privacy policy: cloudflare.com/privacypolicy

Our server uses your IP address only to limit login and sign-up attempts: it keeps it in memory for at most 60 minutes and never saves it.

Cookies and browser storage

We only use technical cookies, needed for the game to work, which by law need no consent:

• grimoire_session: keeps you signed in, for 30 days or until you log out.
• grimoire_lang: remembers the language you picked, for a year.

Your browser also keeps, on your device only, the music and effects volume and whether you closed the cookie notice.

Why

We process this data to let you play, that is to give you the service you ask for by creating an account (GDPR art. 6.1.b), and to protect the game and its players from abuse (legitimate interest, art. 6.1.f).

For how long

As long as you have an account. When you delete it, your data leaves the game at once; the database backups that still hold it are deleted within 14 days.

Where

The game and its database run on a server in Italy run by the controller. Cloudflare may process browsing data outside the European Union too, with the safeguards the GDPR requires (standard contractual clauses).

Your rights

You can ask to access your data, correct it, receive a copy of it, restrict its processing or object to it.

You can delete your account yourself, whenever you like, in the game's settings (Privacy → Delete account): all your data goes with it.

If you think your data is mishandled you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali: garanteprivacy.it

Age

You must be at least 14 to create an account.