Privacy Policy

1. Playing without an account (guest play)
2. Information we keep when you have an account
3. Purchases
4. Co-op play
5. Who we share information with
6. Your choices and controls
7. Security
8. Children
9. Android permissions
10. Changes and contact

Lantern Keeper is made by Exenova ("we", "us"). This policy explains what information the game uses, why, where it is kept, for how long, and the choices you have. Contact: l4nternkeeper@gmail.com.

The short version

You can play the whole game without an account. Then your progress stays on your device and we receive nothing.
If you create an account, we keep your email address, your keeper name and a copy of your save so you can play on more than one device.
No ads, no advertising ID, no analytics or tracking tools, and we never sell your data.
If you use the social features, we keep your friends list and parties. Community and region chat is a daily conversation, deleted at the end of each day (UTC); party chat and whispers are kept for 30 days. You can block, mute and report other players, and choose who may challenge you to a duel.
If you trade with a friend or post on the Market, we keep a record of the trade or listing (who, what and when) for one year, to keep everyone's items honest. Other signed-in players see your keeper name on your open Market listings.
You can switch cloud saves off, hide your profile, turn news emails off with one click, or delete your account and its data from inside the game at any time.

1. Playing without an account (guest play)

Your progress and settings (embers, upgrades, unlocks, records, the items in your satchel, your player name, sound, graphics and control settings, recent replays) are saved on your device only. On the desktop app a backup copy is kept in the app's own folder on your computer. We never receive this data. If you use Save transfer, the game shows your save as a code, which goes only where you paste it.

If you install the web version from your browser, the browser keeps the game's own files on your device so it can start without a connection. That stores the game, not information about you, and sends us nothing.

2. Information we keep when you have an account

What	Why	How long
Account data: email address, password (stored only as a secure hash, which we cannot read), keeper name, when the account was created and last used	To create your account, sign you in, send the codes that confirm your email or reset your password, and show your name in the game	Until you delete the account
Sign-up answers: that you are 13 or over; if you are 13 to 15, that a parent or guardian agreed; the version of the Terms of Service you accepted and when; whether you chose news emails and when; and a random code that makes the unsubscribe link in our emails work. We never keep your date of birth: the game asks for your birth month and year, works out on your device whether you are old enough, and sends only the answer.	To show that accounts are made only with the required age and agreement (legal obligation and consent), and to stop news emails with one click	Until you delete the account
Gameplay data: a copy of your save (the same progress as above), a short summary of it (for example regions cleared and best night), when it was saved and a device label such as "Android app"	Cloud saves: to keep your progress safe and on all your devices, and to help you choose between two copies if they differ	Until you delete the account
Profile choices: title, avatar, frame, banner and your privacy settings	To show your profile the way you set it	Until you delete the account
Save check notes: when a save sent to us is corrected because it was impossible (for example more embers than can be earned in the time played), a note of what was corrected	Fair play, and to find bugs that damage saves	90 days, then deleted automatically
Social data: your friend code, friends and friend requests, the parties you are in and party invites, the keepers you have played co-op with ("recent players"), and the players you block	To let you add friends, team up, invite people you played with, and keep people you blocked away from you	Friends and blocks: until you remove them or delete the account. Party invites: 7 days. Recent players: 90 days
Chat messages: what you write in party, community, region and private (whisper) chat, and the emotes you send, with the time and who sent them	To deliver messages, show recent conversation, and look into reports of abuse	Community and region chat: until the end of the day (midnight UTC), then deleted automatically. Party chat and whispers: 30 days, then deleted automatically
Reports and moderation: reports you make or that are made about you (the reason, any details written, and a copy of the reported message, its sender and time, kept with the report so it can still be checked after the chat itself is deleted), and any chat mute a moderator applies	To keep chat safe and deal with abuse, spam and cheating	Open reports: until handled. Handled reports: 1 year. Mutes: 30 days after they end
PvP Battle (ranked): your rating, wins, losses and streak; while you search, a place in the matchmaking queue; for each ranked match, the two players, the result each reported, a few numbers from the duel (such as damage dealt), the items each player had equipped (keeper, weapon, charms, lighthouse and looks, checked against what the account owns) and when it was played	To find you a fair opponent, keep ranked results honest (a result counts only when both players report the same one), and show your rank and the leaderboard	Queue place: while you search (at most a few minutes). Match records: 1 year. Rating: until you delete the account
Duel requests (friendly PvP challenges, from game version 0.29): who challenged whom, when, and the answer (accepted, declined, busy, withdrawn or expired); and your choice of who may challenge you (everyone, friends or nobody; friends unless you change it). An accepted duel is played as an unranked match: it is kept like a match record (above) but never changes a rating	To deliver a challenge, show its answer, and stop unwanted or repeated challenges (limits per player and per hour)	Requests: 1 day, then deleted automatically. Your choice: until you change it or delete the account
Trading and the Market: the items in your Trade chest (boosts, keepsakes, materials and event items); for each Market listing, what you give and want, when it was posted, when it ends, who took it and how it ended (your keeper name and the listing are shown to other signed-in players while it is open, never to players you have blocked); for each trade, the two accounts, what each offered and exchanged, the time of each step (asked, accepted, ready, confirmed) and how it ended; and a log of each item put into or taken out of your chest	To carry out trades safely on our server, keep inventories correct (so no item is copied or lost, even when an older copy of a save is uploaded), prevent cheating and duplication, and look into problems you report. Never for marketing	Your chest and open listings: until you delete the account. Trade records, finished Market listings and the chest log: 1 year, then deleted automatically
Community goals: totals across all players (for example creatures defeated during an event). Only the running total is kept, not who added what	To show community events and their progress	While the event is shown
Technical data: IP address, app version and error messages in the logs of our hosting provider	To run the service securely, stop abuse (such as password guessing) and fix faults	Kept by the provider for a short time (days, not months)
Payment data (only if you buy something): the product, Google Play's order number and purchase token, the purchase state and date. We never see or store your card or bank details; Google handles payment.	To confirm the purchase with Google, give you the item, restore it on a new device, and handle refunds (when Google tells our server a purchase was refunded or cancelled, we mark it refunded and take back what it gave)	Items you own: until you delete the account. The purchase record itself is kept, no longer linked to your account, for as long as tax and refund law requires

We do not collect your location, contacts, photos, advertising ID or real name, and we do not build advertising profiles.

3. Purchases

Anything sold in Lantern Keeper is cosmetic or a supporter item: it changes how things look, never how strong you are. Purchases are made through Google Play and are covered by Google's own terms and privacy policy. When you buy, the game sends the purchase token to our server, which asks Google whether it is genuine before giving you the item. Each purchase can be used by one account only. Our server regularly asks Google which purchases were refunded or cancelled; for those, it takes back what the purchase gave (the Lumens of a refunded pack, never below zero, or the items of a refunded pack) and records this in your Lumens history.

Lumens, the premium currency, are kept with your account: your balance and a history of each change (a pack bought, with its receipt reference; a look bought with Lumens, and when). We keep them so your Lumens are the same on every device and so we can answer questions about a purchase; they are deleted with your account, except purchase records the law requires us to keep.

4. Co-op play

Co-op is optional. When you play co-op, your player name, the keeper you play as and your game actions (taps, abilities, and if you host, what happens in the night) are sent to the other players in your game. They travel either:

phone to phone, directly between the devices on your local network, with no server in between (the pairing code contains your device's local network address so the other device can reach it); or
through a co-op server ("relay") at the address you or your host enter. The relay passes messages between the players in a room, keeps rooms in memory only while a game is on, and uses connection addresses in memory to limit abuse. It does not store your messages or your name. A relay run by someone else is covered by that person's own policy.

through our online service (the Online tab, for signed-in players): the game uses Supabase Realtime to pass game messages between the players who share a room code. Messages are relayed live and are not stored; the room exists only while the game is on.

In a ranked PvP match, the game sends your keeper name, loadout (keeper, weapon, charms, lighthouse), the upgrades you pick and your duel actions (taps and ability use) to your opponent over our online service, while the match is on. These live messages are not stored. Practice matches against an AI keeper stay on your device.

A co-op server can also run the night itself ("server-run co-op"): then every player's game sends its actions to the server, and the server works out the night and sends what happens to everyone. It uses the same information as above, holds it in memory only while the night is on, and stores none of it.

Our co-op server (the Online tab, from game version 0.28): online rooms are normally run by our own co-op server, hosted by Render. It works as described above: it receives your keeper name, the keeper you play as and your game actions, uses your connection's IP address in memory to limit abuse, and stores none of it; the room and the night exist only while the game is on. Its address comes with the game or from a small file on our website (service.json), which the game reads when you open Co-op.

The Lantern Bazaar (the walkable meeting place): while you are in it and signed in, the game shares your keeper name, your keeper's look and where you walk with the other signed-in players in the Bazaar, live over our online service. It is not stored. Players you have blocked don't see you, and you don't see them.

In the co-op lobby (from game version 0.29), the players in your room also see whether you are ready, the quality of your connection to the room (worked out from how long messages take), and which kind of controls and device you play with (for example "controller" or "touch", and "Android" or "desktop"), so everyone can tell who is set. This travels with the other co-op messages and is not stored.

Local and phone-to-phone co-op do not use your account. No kind of co-op ever shows your email address to anyone. Signed-in players you play co-op with are added to each other's recent players list (see above).

We don't sell or rent your information, and we don't share it with advertisers. We use these service providers, who process it for us and only on our instructions:

Supabase hosts the accounts database, sign-in and the save service. Data may be stored or processed in a country other than yours; it is encrypted in transit and at rest.
Google Play handles payments and tells our server whether a purchase is genuine.
hCaptcha runs the human check on the sign-up, sign-in and password forms, to stop automated accounts and password guessing. While you complete the check it receives your IP address and information about your browser or device, under its own privacy policy. It is not used anywhere else in the game.
Render hosts our co-op server (see section 4). Like any host it handles your connection's IP address while you are connected, and may keep its own short-lived connection logs under its own privacy policy; it receives nothing else about you from us.
GitHub hosts this website, the web version of the game and the downloads. When you visit or download, GitHub receives your IP address and browser information under its own privacy statement.
An email delivery service sends the codes that confirm your email address and reset your password (and news emails, only if you chose them).

If you choose to show your profile, other signed-in players can see your keeper name, friend code, title, avatar, frame, banner, badges, the achievements and challenges you choose to show, and a summary of your progress (such as level, regions cleared, time played, highest Ascension and how many keepers you have played co-op with). Never your email address.

While you are signed in, the game records when you were last active (checked every few minutes). If your profile is shown, friends and other players see only a rough status next to your name: online (active in the last 10 minutes), today or away. Never the exact time. Hiding your profile hides this status too.

From game version 0.29 the game also records what you are doing in broad terms (at home, in a night, in co-op, in PvP or in the Bazaar), updated at most twice a minute while you are signed in. Only your friends see it, only while you are online, and only if your profile is shown. It replaces the previous value; no history is kept.

If your profile is shown, the ranked leaderboard lists your keeper name, rating and wins and losses once you have played a ranked match. Hiding your profile takes you off the leaderboard.

Chat is seen by the people in that channel: your party, everyone in community or region chat (that day's conversation only), or the one player you whisper. Messages pass an automatic filter for slurs and spam before they are sent. Moderators (people we choose to help keep chat safe) can read reported messages and recent chat to handle reports, and can remove messages and mute players.

We may also disclose information if the law requires it, or to protect players and the game from fraud or abuse.

6. Your choices and controls

In the game, under Profile > Account and sync, you can:

turn cloud saves off: your progress then stays on this device only;
hide your profile from other signed-in players;
in Social, block a player (they can no longer message, befriend or invite you, and you don't see their messages), mute a player on your device, report a message or player, remove friends and recent players, leave a party, and choose whether your new achievements are announced in chat (off unless you turn it on), and who may challenge you to a duel (everyone, friends or nobody);
turn news emails on or off (off unless you choose them; otherwise the game only emails you account codes). Every email we send also has a one-click link that turns news emails off without signing in;
change your email address or password, and sign out;
delete your account. This permanently deletes your account, cloud save, profile and items straight away. Your progress on the device you are using stays there as a guest save unless you clear it. Purchase records are kept without your account, as described above.

You can also email l4nternkeeper@gmail.com to get a copy of your data, correct it, or delete it if you can no longer sign in. We may ask you to confirm you own the account. We answer within 30 days. Depending on where you live (for example under the Philippine Data Privacy Act, the EU and UK GDPR, or Californian law) you may have further rights, including to object to processing and to complain to your data protection authority.

Legal bases, where the law asks for them: providing the game and account you asked for (contract); keeping the service secure and fair (legitimate interests); news emails (consent, which you can withdraw); purchase records (legal obligation).

7. Security

Connections to our servers use HTTPS. Passwords are stored only as hashes. Each player can read only their own account data, and saves can be changed only through our save service, which checks them. No system is perfectly secure; if a breach affected your information we would tell you and the authorities as the law requires.

8. Children

Lantern Keeper is not directed at children under 13, and accounts are for players aged 13 or over. The sign-up form asks for the birth month and year, refuses anyone under 13, and for players aged 13 to 15 asks that a parent or guardian agrees first (our server checks the same answers). We keep only those answers, never the birth date. Younger players can play as a guest, which sends us nothing. If you believe a child has created an account, email us and we will delete it.

9. Android permissions

Internet: for signing in, cloud saves, purchases and co-op.
Camera (optional): only to scan a co-op pairing QR code. Images are processed on your device and are never saved or sent. You can paste codes instead.
Vibration: for haptic feedback, which you can turn off in Settings.
Game controllers: read only while the game is open, to play with them. Nothing about them is sent to us.

10. Changes and contact

If this policy changes, the new version will be posted at this address with a new version number and date, and important changes will also be shown in the game. Version 1 (game versions before 0.13) described a game without accounts; version 2.0 adds accounts, cloud saves and purchases; version 2.1 (game version 0.14) adds friends, parties, chat, reports and moderation, online co-op through our service, community goals, and more on the public profile; version 2.2 (game version 0.15) adds ranked PvP: ratings, matchmaking, match records and the leaderboard; version 2.3 (game version 0.16) adds the rough online status on player cards; version 2.4 (game version 0.17) stores the items you have equipped with each ranked match record; version 2.5 (game version 0.20) adds Lumens, the premium currency; version 2.6 (game version 0.26) adds trading and the Trade chest (with how long trade records are kept), the answers kept from the sign-up form (the age check, a parent's agreement, the Terms accepted and news emails), one-click unsubscribe, the Lantern Bazaar, server-run co-op, installing the web version and game controllers, and names hCaptcha, the human check on the account forms; version 2.7 (game version 0.27) adds the Market (listings other players can see, and how long they are kept) and how refunded purchases are taken back; version 2.8 (game version 0.28) adds our own co-op server for online rooms, hosted by Render, and names GitHub, which hosts the website and the downloads; version 2.9 (game version 0.29) makes community and region chat a daily conversation, keeps a copy of a reported message with the report, and adds duel requests (with who may send them), friends seeing what you are doing, and what the co-op lobby shows.

Questions or requests: Exenova, l4nternkeeper@gmail.com.