Privacy policy

Summary

• Only your SteamID identifies you. We never receive your Steam password, real name, email address, payment details, friends list, avatar or profile name.
• We store your game account on our server: SteamID, hero, items, gold, Rations, professions, run history and settings, plus login sessions stored as one-way hashes.
• Steam playtime bonuses are optional and off by default. If you turn them on, the server reads only app IDs and playtime numbers.
• We never read the list of programs running on your computer. Numbers the game reads from files on your PC are never sent to our server.
• No advertising, no third-party analytics, no client-side telemetry and no sale of data.
• The in-game Privacy panel has two separate actions: delete Steam source data (your progress stays) or delete your whole account (7-day undo period, then permanent).

Who is responsible

The data controller is ByteBadgers, Ümraniye, İstanbul, Türkiye. Privacy contact: yunus@bytebadgers.net. We have not appointed a data protection officer.

Signing in with Steam

The game asks the Steam client for a one-time sign-in ticket and sends it to our server. The server asks Valve's Steam Web API to confirm the ticket and to check that your account has a valid licence for SteamVerse or its demo, including temporary licences such as Family Sharing. We keep your SteamID, which is the only identifier we store, and which SteamVerse edition (demo or full game) each session used.

We keep the sign-in ticket only as a one-way SHA-256 hash for up to 24 hours (technical maximum 7 days) to stop it being reused. That record is not linked to your account.

Your game account and progress

The server runs the game's rules, so your progress is stored on our server: level and experience, gold, Rations, equipment and items, skills and builds, professions and crafting, automation settings, dungeon runs and results, in-game decisions, patrol and background-income records, purchases with in-game gold and the timestamps needed to calculate them.

The server records gameplay events such as run results, deaths and economy changes to balance the game and publish exact numbers in patch notes. The game client does not send separate telemetry.

Sessions and connection

After sign-in you receive a session token. The server stores only its one-way hash, its creation and expiry time and the SteamVerse app ID. Sessions expire after 24 hours by default. While the game is open it sends regular activity confirmations that contain game state, not information about other programs.

Your IP address is used in memory to limit abusive request rates. Our game server does not write IP addresses or Steam identifiers to its logs. Cloudflare processes connection data as described below.

Optional Steam playtime bonuses

[This feature is not available yet. When it is, this section applies.] If you choose to connect your Steam playtime, our server uses the Steam Web API on your behalf to read app IDs, total playtime and recent playtime numbers for the games in your library. It does not request game names, your profile, friends or achievements. The numbers are used only to calculate in-game Rations and genre Auras and are stored with your account.

This needs your Steam profile's game details to be visible to the Steam Web API. If the numbers are unavailable or do not match, bonuses simply wait; there are no automatic bans. You can switch it off at any time with Delete Steam source data. Progress you already earned stays.

Data we never collect

Steam password, real name, email address (unless you write to us), postal address, payment or card details, friends list, Steam profile name or avatar, chat, voice, camera, precise location, the list of running processes, the contents of your files or advertising identifiers.

Why we use your data

• Signing you in, checking your licence, running the game and keeping your progress: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Security, abuse and cheating prevention, rate limiting, replay protection and backups: our legitimate interest in a safe, reliable service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Game balance and patch notes from server-side gameplay events: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Optional Steam playtime bonuses: your consent, which you can withdraw at any time (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
• Support requests and legal obligations: legitimate interest, contract or legal obligation.

A Steam account is needed to play online. The offline tutorial works without signing in, and the game is fully playable without connecting your Steam playtime. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who receives your data

We do not sell or rent personal data or share it for advertising. Recipients are limited to Valve Corporation (Steam sign-in, licence checks and, if you opt in, playtime requests; Valve's privacy policy: https://store.steampowered.com/privacy_agreement/), our server hosting provider Contabo GmbH (Munich, Germany), which hosts our server in France and processes data on our behalf (Contabo's privacy policy: https://contabo.com/en/legal/privacy/), Cloudflare, Inc. (DNS, TLS and network protection in front of our server, and storage for our encrypted backups; Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/) and authorities where the law requires it.

Where data is stored

Our game server and database run on a virtual server in France (European Union) operated for us by Contabo GmbH. The database is only reachable from that server. The server makes a daily database backup that stays on the same server, and an encrypted copy of each backup is stored in Cloudflare R2 object storage in the European Union. Only our team holds the decryption key. Cloudflare processes connection data on its global network and primarily stores information in the United States and the European Economic Area.

Because our game server is in the European Union, the data stored on it stays in the EEA. We are based in Türkiye, so keeping your data on a server in France is a transfer abroad under Turkish law; for this we rely on KVKK Article 9 (the standard contract with our hosting provider and notification to the Personal Data Protection Authority where required). Where personal data is otherwise transferred outside Türkiye or the EEA, for example by Cloudflare, we rely on the safeguards required by law, such as an adequacy decision or standard contractual clauses.

How long we keep data

• Game account and progress: while your account exists; erased after a 7-day undo period when you delete your account.
• Steam playtime records: until you choose Delete Steam source data or delete your account.
• Active session records: until they expire (24 hours by default). Expired and signed-out session records: until Delete Steam source data or account deletion.
• Sign-in ticket hash: 24 hours by default, at most 7 days, not linked to your account. Account deletion confirmation hash: 24 hours, not linked to any account.
• IP addresses for rate limiting: in memory only.
• Backups: 14 days on the server; encrypted off-site copies 30 days, then deleted on a rolling basis. Deleted data can remain in backups until they expire.
• Support emails: only as long as needed to resolve the request.

Your controls in the game

Settings → Privacy shows what the server holds about you, what is read from Steam, what the game sends and what is never collected. Delete Steam source data removes Steam playtime records, withdraws playtime consent and removes expired session history; your level, items, gold, Rations and all other progress are kept, and so is your SteamID so you can sign in to the same account.

Delete account and all progress deletes your account and everything linked to it, including your SteamID and all sessions. You confirm by pressing and holding the delete button. The account is then scheduled for deletion for 7 days and you are signed out on all devices. During that time your data is kept unchanged only so you can cancel: sign in again with the same Steam account and keep your account from the Privacy panel. While deletion is pending the account cannot be played. After 7 days it is permanently deleted. Signing in again with the same Steam account later creates a new, empty account. You can also ask for either action by email.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests and withdraw consent at any time, and you can complain to your local data protection authority.

Under KVKK Article 11 you can learn whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad who receive it; request correction, erasure or destruction and that these be notified to those third parties; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

Apply through the in-game Privacy panel or by email to yunus@bytebadgers.net. We may ask you to confirm the request from inside the game or to provide your SteamID. We reply free of charge within 30 days. Under KVKK you may complain to the Personal Data Protection Board if your application is rejected, our answer is insufficient or we do not answer in time.

Children

SteamVerse is not directed at children under 13, and Steam accounts are subject to Steam's own age requirements. If you believe a child under 13, or under the age of digital consent in your country, used SteamVerse without a parent's or guardian's consent, contact us and we will delete the account.

Security and changes

Session tokens, sign-in tickets and deletion confirmations are stored only as one-way hashes. The Steam Web API publisher key stays on the server. The database accepts connections only from the server itself, connections use TLS and off-site backups are encrypted. We will publish changes to this policy on this page with a new effective date and tell you in the game before a change that materially affects data you already gave us.