1. Information We Collect
When you participate in Arcane Rebirth, we collect only the minimal data necessary to provide secure authentication and persistent gameplay:
- Account Credentials: Username and verified email address for account recovery and identity.
- Gameplay State: Character statistics, learned spells, equipped armaments, Knight Rank, Order affiliation, inventory, and quarters customization.
- Connection Diagnostics: IP address, timestamp, and user-agent string captured for brute-force protection and moderation audit trails.
2. Avatar Uploads & EXIF Metadata Sanitization
To protect your real-world privacy when uploading custom profile avatars, the engine enforces strict automated sanitization:
Automated EXIF Stripping:
All uploaded images (JPEG, PNG, GIF ≤ 150 KB) are re-encoded through the server-side GD graphics library prior to storage. All embedded EXIF metadata—including GPS coordinates, device models, camera serial numbers, and creation timestamps—is permanently stripped.3. Cryptographic Standards & Password Storage
We protect sensitive player authentication using industry-standard cryptography:
- Bcrypt Password Hashing: Passwords are never stored in plaintext. They are hashed using
PASSWORD_BCRYPTwith a computational work cost of 12. - Zero Plaintext Tokens: Password reset tokens are generated via cryptographically secure pseudo-random bytes (
random_bytes(32)) and stored exclusively as SHA-256 digests with a 1-hour expiration. - SQL Injection Immunity: All database queries are executed strictly through parameterized PDO prepared statements.
4. Cookies & LocalStorage Usage
Arcane Rebirth employs only essential functional cookies and client-side storage:
| Storage Type | Key / Identifier | Purpose & Security |
|---|---|---|
| Session Cookie | PHPSESSID / arcane_sess |
Maintains authenticated state. Flagged HttpOnly, SameSite=Lax, and Secure. |
| Security Header | X-CSRF-TOKEN |
Cryptographic token regenerated per session to protect mutating requests from Cross-Site Request Forgery. |
| Client LocalStorage | arcane_sound_volume, arcane_sound_muted |
Persists your procedural Web Audio ambient soundscape volume and mute preference on your local device. |
We do not utilize third-party marketing cookies, tracking pixels, or cross-site behavioral telemetry.
5. Spatial Coordinates & Public Visibility
Certain gameplay elements are inherently public within the game world:
- Map Coordinates: When you roam outside safe zones or resting tents, your spatial coordinate position is visible to players within scouting perception range.
- Chat Broadcasts: Messages transmitted to the Global Nexus or Order Tavern are logged in the
chat_messagestable and visible to participating players. - Public Profiles: Your username, Order heraldry, Knight Rank, and achievement medals are publicly viewable at
/player/{username}. Internal attributes (STR/AGI/INT/WIL) and inventory remain private. - Quarters Privacy: You maintain full control over your private chamber visibility (
Public,Order Only, orPrivate) via your Quarters Settings.
6. Third-Party Disclosure Policy
We do not sell, rent, monetize, or disclose your personal data to any external advertising or data brokerage networks.
Information may only be disclosed if required by law or a valid court subpoena issued by a competent legal authority.
7. Player Rights, Data Export & Erasure
You retain full authority over your personal information. You may:
- Update your email address or password at any time via your Profile Settings.
- Request a complete dump of your account records or initiate permanent account deletion by contacting the server administration.
- Upon account deletion, all personal credentials and private records are eradicated from reality in accordance with data protection guidelines.
Last Updated: September 12, 2026 • Arcane Rebirth Security Directive