Privacy Policy

What Information Is Stored

When you sign in or save character builds on Embervillers, only the minimum data required to provide account features is stored:

• Account Identifier & Username: A random internal user ID and the username chosen by or assigned to you (which you can rename in your account settings).
• Login Provider ID: Your Steam ID (SteamID64) or Discord account identifier when you choose to connect those services. We do not request email addresses, friends lists, or private profile information.
• Saved Character Builds: The build configurations, titles, equipment choices, and optional notes you choose to save or publish.
• Likes: Records of which published builds you have marked with a like.

What Is Never Collected or Stored

• No Passwords: Authentication is handled directly via Steam OpenID and Discord OAuth. We never receive or store passwords.
• No Email Addresses: We do not ask for, receive, or store your email address. We send no promotional or automated emails.
• No Persistent IP Storage: For rate limits, your network address is reduced to a one-way hash and never stored in our database. Saving a build without an account runs a Cloudflare Turnstile check, which sees your network address to tell people from bots.
• No Third-Party Advertising Trackers: We do not load advertising scripts, analytics beacons, or behavioral tracking tools.

Cookies and Local Storage

We use essential security cookies strictly necessary for authentication:

• __Host-sid: A random, HttpOnly session cookie maintaining your login state for up to 30 days. Only a cryptographic hash of this token is stored on the server.
• __Host-oauth: A short-lived (10-minute) security cookie protecting against unauthorized login attempts during third-party sign-in.
• localStorage: Used in your browser to remember your chosen visual theme (light or dark) and temporary edit tokens for anonymous builds created before signing in.

Anonymous Saving

If you create and save a build without logging in, the build is saved as unlisted. A private edit token is stored exclusively in your browser's local storage so you can edit it from the same device. When you subsequently log in, anonymous builds created on that browser can be claimed into your account automatically.

How to Delete Your Data

You retain complete control over your account. You can delete your account at any time:

1. Navigate to Account Settings while signed in.
2. Scroll down to the Delete Account section.
3. Type your username into the confirmation prompt and confirm deletion.

Deleting your account immediately and permanently purges your account record, active login sessions, linked provider identities, all builds created under your account, and all likes you have given.