Privacy Policy
Version 1.0 · last updated 2026-10-12
This policy describes how personal data is processed in the game Undor and on undor.app. It is written purpose by purpose: for each thing we do, you can see which data is needed, on what legal basis, who receives it and how long it is kept.
The essentials
- You can play without an account. A guest has only a random id and their game progress, no name and no e-mail.
- With an account we keep your e-mail and a hashed password. We never sell data and use no ads or tracking cookies.
- Your characters' names, levels and ratings, and everything you write in the forum, are public.
- Accounts and the forum are for anyone 13 or older. Playing as a guest is for everyone.
- You can export your data and delete your account directly in the app. Questions: privacy@undor.app. You can always complain to the Swedish Authority for Privacy Protection (IMY).
1. Who is responsible for your data?
Gustav Andersson, Borås, Sweden, who develops Undor as a private individual, is the controller for the processing described here. You can reach me at privacy@undor.app.
There is no appointed Data Protection Officer; data protection matters are handled by me directly.
2. What we do with your data
Each processing below has its own purpose and its own legal basis. We collect nothing beyond what is listed here.
Playing
- Purpose (P1)
- Let you play straight away without an account, and keep your characters and progress between runs and devices.
- Data
- A random guest id (no name, no e-mail), your characters with their names, levels, gold, talents, gear and cleared chapters, and the game actions the server checks.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
- Recipients
- Supabase (database and sign-in, Stockholm), Fly.io (the game server, Stockholm)
- Kept for
- Until you delete the account. A guest is deleted at once; a saved account 30 days after you ask (signing in again cancels it).
Account
- Purpose (P2)
- Save your progress to an account so you can sign in on other devices and on undor.app, and help you if you forget the password.
- Data
- E-mail address, password (stored only as a hash), one-time codes sent to your e-mail, sign-in times.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
- Recipients
- Supabase (database and sign-in, Stockholm), Resend (sending e-mail, Ireland)
- Kept for
- As P1: until the account is deleted.
Feud (online)
- Purpose (P3)
- Match you against other players in Feud, judge the match and keep the ranking.
- Data
- Your character's name, rating, wins and losses, and match results (opponent, winner, wave, length). Name, rating and record are shown on the public ladder.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
- Recipients
- Supabase (database and sign-in, Stockholm), Fly.io (the game server, Stockholm), other players (what shows in the match and on the ladder)
- Kept for
- Until the account is deleted. An opponent's history keeps the match, without a link to you.
The village forum
- Purpose (P4)
- Let you write in the village forum, show who wrote what, and show players' characters publicly.
- Data
- Your posts, replies and lit candles. For each character: name, level, cleared chapters, talents and gear, shown on a public character page and next to your posts. Consider a character name that is not your real name.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
- Recipients
- Supabase (database and sign-in, Stockholm), Vercel (the website), anyone who visits undor.app (posts and characters are public)
- Kept for
- Until you delete the post or the account. Deleting the account removes your posts and replies with it.
Safety and fair play
- Purpose (P5)
- Keep the forum and the game safe and fair: handle reports, stop spam and cheating.
- Data
- Reports (who reported what and why), the rate of new posts, the server's check of game actions.
- Legal basis
- Legitimate interests (Art. 6(1)(f))
- The interest
- Our and other players' interest in a safe forum and fair matches. The data is minimal, used only for this, and never shown to other players.
- Recipients
- Supabase (database and sign-in, Stockholm)
- Kept for
- Reports until the reported post or the account is deleted.
Website and operations
- Purpose (P6)
- Deliver the website and the game server, keep you signed in and troubleshoot outages.
- Data
- IP address, browser and device in our providers' operational logs, and one necessary sign-in cookie on undor.app. We use no cookies for analytics or advertising.
- Legal basis
- Legitimate interests (Art. 6(1)(f))
- The interest
- Keeping the service working and secure. The logs are not used to track you.
- Recipients
- Vercel (the website), Fly.io (the game server, Stockholm), Supabase (database and sign-in, Stockholm)
- Kept for
- Operational logs for as long as the provider keeps them, normally days to a few weeks. The cookie until you log out.
The waitlist
- Purpose (P7)
- Send a single e-mail when Undor is on the App Store, to you who asked for it.
- Data
- E-mail address and where you signed up (the front page, or when you created an account).
- Legal basis
- Consent (Art. 6(1)(a))
- Recipients
- Supabase (database and sign-in, Stockholm), Resend (sending e-mail, Ireland)
- Kept for
- Until the launch e-mail has been sent; then the list is deleted. You can withdraw your consent at any time by e-mailing us.
3. Who receives the data, and does it leave the EU?
We use a few providers who process data on our behalf (processors), under agreements that limit them to providing the service to us:
- Supabase: database and sign-in. Data is stored in Stockholm (EU).
- Fly.io: the game server that runs matches and checks game actions, in Stockholm (EU).
- Vercel: delivers the undor.app website.
- Resend: sends e-mail (codes and the launch e-mail) from Ireland (EU).
The providers are US companies. Even when data is stored in the EU they may, in exceptional cases, access it from the US, for example for support. Such transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
What you make public, that is the forum, your characters' names and the ladder, can be seen by anyone who visits undor.app or plays Undor.
4. How long is the data kept?
The retention period is listed with each processing in section 2. The main rule: everything tied to your account stays until you delete the account. A deleted saved account is gone after 30 days, so you can change your mind by signing in again. A guest is deleted at once.
5. Your rights
- Access and data portability: in the app, under 👤 Account → Export all my data, you get all your data in a machine-readable format.
- Erasure: in the app, under 👤 Account → Delete account. You can also delete individual posts in the forum. If you cannot reach the app, e-mail us.
- Rectification: you can edit your posts yourself; for anything else, e-mail us.
- Objection and restriction: you can object to processing based on legitimate interests (P5, P6) and ask us to restrict a processing while something is looked into.
- Withdraw consent: for the waitlist (P7), at any time, by e-mailing us.
E-mail privacy@undor.app for anything about your data; we reply within one month. If you are not satisfied, you always have the right to complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the supervisory authority where you live.
6. Automated decisions
Feud matches players by rating, and the server automatically checks that game actions follow the game's rules. None of this has legal effects on you or affects you in a similarly significant way (Art. 22).
7. Children
Playing as a guest is for all ages and collects no data that identifies who you are. Accounts and the forum are for anyone 13 or older, and you confirm this when you create an account on the website. If we learn that an account belongs to someone under 13, we delete it.
9. Changes
If the policy changes in a way that affects you, we tell you in the app or on undor.app before the change applies. The version and date at the top show which text applies.