Privacy and cookies
Wildgrims sets no cookies and loads nothing from other companies: no ads, no trackers, no fonts or scripts from elsewhere. Your browser keeps only what the game needs to work, and at the server's https address the connection is encrypted.
Cookies
This site sets no cookies — neither its own nor anyone else's. That is why it shows no cookie banner: there is nothing to accept or refuse.
What your browser keeps
A few small notes in your browser's own storage for this site (its local storage and the tab's session storage) — only what the game needs. Of these only the login key goes to the server, with each request; when you are logged in, the language you choose is also saved on your account, so that it follows you to other devices.
| Entry | What it is | How long |
|---|---|---|
wh_token | Your login: a random key the server gave you when you logged in. | Until you log out: this tab only — or 30 days with “Keep me logged in”. |
wh_lang, wh_lang_geo | The language you chose; the language suggested for your country. | Until you choose another; the suggestion a week. |
wh_settings | The game's settings: the volumes, the graphics, names over heads. | Until you change them. |
wh_windows | Where you put the game's windows. | Until you move them. |
wh_pick, wh_updated_to, wh_portrait_ok, wh_reloaded_… | Short notes for this tab: the character list, an update just installed, the phone turned upright. | Until the tab closes. |
wh_sw_off_until | Only when the game's copy could not start: when to try it again. | 6 hours. |
wh_nocache | Never written by the game: only if you set it yourself (to find a fault), the game keeps no copy of its files. | Until you remove it. |
| The game's copy | The game's files (code, pictures, sounds), so that the game starts faster and the server sends less. No personal data. | Until a new version replaces it. |
wh_admin_map_… | Administrators only: the layers of the admin map. | Until changed. |
You can delete all of it in your browser's settings (the site data of this address). You will be logged out and the game will download its files again.
Visit statistics
The server counts visits to its pages: which page, the site you came from, your browser's language, the kind of device and browser, and your country and city — worked out from your IP address at the moment of the visit. The statistics don't store the IP address: they tell visitors apart by a mark that changes every day and can't be turned back into an address. When you are logged in, the visit is also noted with your account (so that the statistics can tell how many visitors play). Nothing is stored in your browser for them. Single visits are deleted after 180 days.
What the server keeps about your account
- Your email address: to confirm it and to reset your password — never shown to other players.
- Your password: only as an Argon2id hash — nobody, not even the administrators, can read it back.
- Your recovery key: only as its SHA-256 hash.
- Your login sessions: the session key only as an HMAC, with the IP address and browser it was opened from (to protect the account). The security log notes registrations, logins (successful and failed), account recoveries, premium codes used and bug reports sent, with their IP address.
- Your characters and what they have and did in the world: bags, buildings, land, skills, achievements, premium days.
- Your account's settings, such as the language you chose.
- Chat messages, whispers too: kept on the server for moderation.
- Bug reports you send: your words, a picture of your screen, where your character stood and what the game knew at that moment — your browser's description of itself, the screen and window size, the page and the game's recent errors.
A character can be deleted in the game with your password (seven days to change your mind). For anything else write to the server's administrators — the bug button in the game reaches them too.
Encryption
- At the server's https address everything between your browser and the server is encrypted with TLS: the pages, logging in, your password and the game itself (its connection, a WebSocket, runs over the same encryption).
- There your browser is also told to use only HTTPS for this site for a year (HSTS).
- When its address is https, the server takes logging in, the account and the game only over an encrypted connection: a page asked for over plain http is sent on to https, everything else is refused.
- Your password never rests in the clear: on the server it is only an Argon2id hash; at the https address it is encrypted on the way too.
This page describes Wildgrims 0.35.2.