1. Information We Collect
When you participate in Arcane Rebirth, we collect only the minimal data necessary to provide secure authentication and persistent gameplay:
- Account Credentials: Username and verified email address for account recovery and identity.
- Gameplay State: Character statistics, learned spells, equipped armaments, Knight Rank, Order affiliation, inventory, and quarters customization.
- Connection Diagnostics: IP address, timestamp, and user-agent string captured for brute-force protection and moderation audit trails.
2. Avatar Uploads & EXIF Metadata Sanitization
To protect your real-world privacy when uploading custom profile avatars, the engine enforces strict automated sanitization:
Automated EXIF Stripping:
All uploaded images (JPEG, PNG, GIF ≤ 150 KB) are re-encoded through the server-side GD graphics library prior to storage. All embedded EXIF metadata—including GPS coordinates, device models, camera serial numbers, and creation timestamps—is permanently stripped.3. Cryptographic Standards & Password Storage
We protect sensitive player authentication using industry-standard cryptography:
- Bcrypt Password Hashing: Passwords are never stored in plaintext. They are hashed using
PASSWORD_BCRYPTwith a computational work cost of 12. - Zero Plaintext Tokens: Password reset tokens are generated via cryptographically secure pseudo-random bytes (
random_bytes(32)) and stored exclusively as SHA-256 digests with a 1-hour expiration. - SQL Injection Immunity: All database queries are executed strictly through parameterized PDO prepared statements.
4. Cookies & LocalStorage Usage
Arcane Rebirth employs essential functional cookies, client-side storage, and authorized advertising partner cookies:
| Storage Type | Key / Identifier | Purpose & Security |
|---|---|---|
| Session Cookie | PHPSESSID / arcane_sess |
Maintains authenticated state. Flagged HttpOnly, SameSite=Lax, and Secure. |
| Security Header | X-CSRF-TOKEN |
Cryptographic token regenerated per session to protect mutating requests from Cross-Site Request Forgery. |
| Client LocalStorage | arcane_sound_volume, arcane_sound_muted |
Persists your procedural Web Audio ambient soundscape volume and mute preference on your local device. |
| Advertising Cookies | __gads, __gpi, IDE |
Third-party cookies deployed by Google AdSense to serve relevant ads, limit repeated impressions, and combat ad fraud. |
First-party game cookies are used exclusively for functional state, authentication, and anti-CSRF protection.
5. Google AdSense & Third-Party Advertising
We utilize Google AdSense to display advertisements across our realm. Google's advertising network adheres to the following privacy rules and disclosures:
- Vendor Advertising Cookies: Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites on the Internet.
- Personalized Advertising: Google's use of advertising cookies enables it and its partners to serve targeted ads to our users based on their visits to Arcane Rebirth and/or other sites across the web.
- Opting Out of Personalized Advertising: You may opt out of personalized advertising by visiting Google's Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting AboutAds.info or Your Online Choices.
- Diagnostics & Measurement: When displaying ads, Google AdSense may gather non-identifying telemetry (such as IP address, browser type, interaction timestamps, and device metrics) to analyze ad performance, calculate publisher compensation, and prevent automated click fraud.
How Google Uses Information From Sites That Use Its Services:
To learn more about how Google handles and protects data when you browse sites using Google AdSense, please visit Google's Partner Technologies Privacy Policy.6. Spatial Coordinates & Public Visibility
Certain gameplay elements are inherently public within the game world:
- Map Coordinates: When you roam outside safe zones or resting tents, your spatial coordinate position is visible to players within scouting perception range.
- Chat Broadcasts: Messages transmitted to the Global Nexus or Order Tavern are logged in the
chat_messagestable and visible to participating players. - Public Profiles: Your username, Order heraldry, Knight Rank, and achievement medals are publicly viewable at
/player/{username}. Internal attributes (STR/AGI/INT/WIL) and inventory remain private. - Quarters Privacy: You maintain full control over your private chamber visibility (
Public,Order Only, orPrivate) via your Quarters Settings.
7. Third-Party Data Disclosure Policy
We do not sell, rent, monetize, or broker your personal player account data (passwords, emails, chat history) to external third parties.
Information is never shared except with essential service integrations (such as Google AdSense for advertising display as outlined in Section 5) or when required by mandatory law, subpoena, or competent regulatory authority.
8. Player Rights, Data Export & Erasure
You retain full authority over your personal information. You may:
- Update your email address or password at any time via your Profile Settings.
- Request a complete dump of your account records or initiate permanent account deletion by contacting the server administration.
- Upon account deletion, all personal credentials and private records are eradicated from reality in accordance with data protection guidelines.
Last Updated: October 4, 2026 • Arcane Rebirth Security Directive