Privacy policy

Last updated October 18, 2026

This covers brambletide.com and the game at play.brambletide.com ("Brambletide", "we", "us"). We've tried to write it the way we'd want to read it.

What we collect

Your account.

• Your username.
• Your password, but never the password itself. We store it as an argon2id hash, which is one-way: we can check a password you type against it, but we can't turn it back into your password.
• Your email address, only if you choose to add one. We use it to help you recover your account and for important notices about it. We don't send marketing email.
• When the account was created, and whether it has been banned.

Your game. Your characters and everything attached to them: appearance, level, skills, inventory, equipment, quest progress, fishing journal, guild membership, trade board listings and similar game state. Other players can see the parts of this that are visible in the game, like your character's name, look, gear and guild.

Login sessions. When you log in we create a session so you stay logged in. For each session we keep the time it started and was last used, when it expires, the IP address it came from and your browser's user-agent string (which says roughly what browser and operating system you use). The session token itself is only stored as a hash. Sessions expire after 7 days without use, and after 30 days at most, and expired sessions are deleted.

Chat. Chat messages go through our server to the other players in that channel. A filter may mask or block some words. We don't keep a history of chat messages in our database.

Server logs. Like most online services, our servers write technical logs (connections, errors, failed logins and so on) that can include IP addresses and account IDs. We use them to keep the game running and to deal with abuse, and they're kept for a short time by our hosting provider.

What's stored in your browser

• The game keeps your login token in your browser's session storage. It's gone when you close the tab.
• Game settings like key bindings, volume and graphics quality are saved in your browser's local storage so they're still there next time. They stay on your device.
• We don't set cookies on either site.

When you log in or sign up on brambletide.com, the form sends your details straight to the game server. The game server sends back a login token, which is passed to the game in the page address (in the part after #, which browsers don't send to any server). The game removes it from the address as soon as it loads. This site doesn't keep a copy.

How we use it

• To run the game: log you in, save your progress, show your character to other players.
• To keep it fair and safe: rate-limit login attempts, stop cheating and abuse, and enforce bans.
• To fix problems: work out what broke and why.
• To contact you about your account, if you gave us an email address.

We don't sell your data, use it for advertising or build profiles about you.

Who else handles it

We use a few companies to host things. They process data on our behalf to provide their service, not for their own purposes:

• Vercel hosts brambletide.com.
• Railway runs the game servers and the database.
• Cloudflare delivers the game's art files.

Each of them sees your IP address and basic request details as part of serving pages and files. Their servers may be outside your country. We'll also share information if the law requires it, or if we need to in order to protect players or the service.

How long we keep it

We keep your account and game data for as long as your account exists. If you delete your account, we delete your account and characters within 30 days, apart from anything we have to keep for legal reasons or to handle abuse (for example, a record that an account was banned). Sessions are deleted when they expire.

Your choices

You can ask us to:

• send you a copy of the data we hold about your account,
• correct something that's wrong,
• delete your account and its data.

Email [email protected]. Since an email address is optional, we may ask you to prove the account is yours (for example by logging in, or by writing from the email on the account). We'll answer within 30 days. Depending on where you live, you may have further rights under laws like the GDPR or CCPA, including the right to complain to your local data protection authority.

Children

Brambletide isn't meant for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has made an account, email us and we'll delete it. In some countries the minimum age is higher (up to 16); if that's you, ask a parent or guardian before signing up.

Security

Passwords and session tokens are stored only as hashes, and all traffic to both sites is encrypted with HTTPS. No system is perfectly secure, so please use a password you don't use anywhere else.

Changes

If we change this policy we'll update the date at the top. If a change matters, for example if we start collecting something new, we'll also say so on this site or in the game before it takes effect.

Contact

Questions about any of this: [email protected].