1. Data controller

[Operator name], registered office: [address], email: [contact email].

2. What data do we process?

  • When you sign up: username, email address, password (stored only as an irreversible hash – never the password itself), character deletion code.
  • While you play: your characters' data (name, class, level, items, playtime), login times and IP addresses.
  • On the website – security: to prevent abuse (too many failed logins, bots, break-in attempts), security events (time, type of event, the page requested and, where relevant, the username) are stored together with a keyed, pseudonymised hash and a truncated form of your IP address (for example 87.229.x.x), for at most 30 days. Hashes used for rate limiting are kept for at most 2 days.
  • Temporary bans: if an address repeatedly sends requests that indicate an attack, it is temporarily banned (first for 1 hour, for at most 7 days on repetition). Only in this case does the security system store the full IP address: for at most 7 days after the ban expires.
  • Web server log: the web server writes the time of each request, the address requested, the browser identifier and the IP address to a technical log (troubleshooting, investigating attacks). It is kept for at most 15 days.
  • Login history: on a successful login we store the time, the browser and operating system name (for example "Chrome · Windows") and the truncated IP address, for at most 90 days (the last 50 logins per account). You can see these on the My account page. If email sending is enabled, we send a warning email when someone logs in from a new device.
  • Bot filter: on some forms (sign-up, forgotten password, after repeated failed logins) your browser solves a short computing task in the background. This uses no third-party service, cookie or tracking, and collects no data.

3. For what purposes and on what legal basis?

  • Running your account and the game – performance of a contract (Art. 6(1)(b) GDPR).
  • Security, fraud and abuse prevention – legitimate interest (Art. 6(1)(f) GDPR).
  • The AI helper's answers and player protection (detecting cheats and bots) – legitimate interest (Art. 6(1)(f) GDPR); see sections 9–10.
  • Compliance with legal obligations, where applicable (Art. 6(1)(c) GDPR).

4. How long do we keep it?

Account data is kept for as long as the account exists and for at most [X] days afterwards. Technical logs are kept for at most [X] days. Website security events are kept for 30 days and login history for 90 days (see section 2). The website does not store conversations with the AI helper; player-protection samples are kept for 8 days and suspicion flags for at most 90 days (see sections 9–10). Backups of the website's own data are kept for at most 14 days.

5. Who has access?

We do not sell your data or share it for advertising. Our hosting provider acts as a data processor: [hosting provider name, address]. When the AI features are switched on, Anthropic PBC is also a data processor (see section 9). The team's internal alerts (security events, the internal number of a suspicious character) go to the team's Discord channel; they contain no names, email addresses or full IP addresses. The website uses no third-party trackers, ads or external font services.

6. Cookies

  • lmmo_s – session cookie for logging in and protecting forms (strictly necessary).
  • lang – remembers your chosen language for 1 year (functional).
  • lmmo_d – a random device identifier used to recognise your own devices in your login history and to flag logins from a new device; 2 years (security, strictly necessary). It is only set when you log in.

The AI helper keeps the conversation in your browser's session storage (sessionStorage) until you close the tab – this is not a cookie and never reaches us.

We do not use analytics or advertising cookies.

7. Your rights

You may request access to your data, its rectification or erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest. Send your request to [contact email].

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11, naih.hu) or with the data protection authority of your country, or go to court.

8. Data security

Passwords are stored only as hashes, and the website accesses the database with the narrowest permissions it needs. In production, the website is available exclusively over an encrypted (HTTPS) connection. Further protection: rate limits, a bot filter, a ban on easily guessed passwords, automatic temporary bans during attacks, two-factor authentication for administrators and a weekly vulnerability check of the server software.

9. AI helper (artificial intelligence)

When it is switched on, the "Help" button in the bottom right corner lets an artificial intelligence – Anthropic's Claude model – answer questions about the game and the website, based on the website's public content (FAQ, Getting started, news etc.). The window clearly shows that you are talking to a machine; answers can be wrong, and the team helps with account matters.

  • What is sent: the text of your question, the last few messages of the conversation (your browser sends them with the question) and the page language – together with the website's public content – plus an opaque identifier that changes daily (a keyed hash of your IP address) so that Anthropic can tell abusers apart. Your IP address, username, email address and cookies are not sent.
  • What the website stores: not the conversation; only the daily number of questions and the estimated cost (statistics), and, for the abuse limit, a keyed, pseudonymised hash of your IP address for at most 2 days.
  • Data processor: Anthropic PBC (San Francisco, United States). According to Anthropic, content sent through its API is not retained by default and is not used to train its models; content that violates its usage policy may be kept for up to 2 years for safety review. Transfer outside the EU: [legal basis – Anthropic's Data Processing Addendum (DPA) with the EU Standard Contractual Clauses (SCCs); to be verified].
  • Please do not send passwords, deletion codes, email addresses or other personal data to the helper.
  • Using the helper is optional; the FAQ and the team can answer your questions too.

10. Player protection (detecting cheats and bots)

To protect fair play and the game economy, the website samples the game database every 5 minutes for characters active in the past day: level, experience, gold, playtime, map and position, and a keyed, pseudonymised hash of the last IP address (the full IP address is not stored). From this it builds statistics – for example unusually long play without a break, a pace many times that of similar-level players, farming on one spot – and shows suspicious characters to the game masters.

  • The website's statistics decide nothing: they only flag; every step (watching, warning, banning) is decided by a game master after checking in game.
  • Automatic temporary ban on the game server: when the game server detects unambiguous cheating (speed or position hacks repeated several times within an hour), it suspends the account automatically for 24 hours; every other detection is only logged. On request the team reviews an automatic ban (see the contact in section 10 and in the Terms); any permanent sanction is always decided by a human.
  • AI analysis: at a game master's request, the numbers behind a suspicion may be analysed by Anthropic (see section 9) – only pseudonymous numbers are sent: never the character name, the account or the IP address.
  • Retention: samples for 8 days, suspicion flags for at most 90 days after the last flag; when a character is no longer suspicious, its open flag is deleted within 2 hours. Samples are not included in backups.
  • Legal basis: legitimate interest (Art. 6(1)(f) GDPR) – preventing cheating and protecting the other players. You may object as described in section 7.

11. Anti-cheat in the game client (Easy Anti-Cheat)

From release the game uses the Epic Games Easy Anti-Cheat (EAC) service. While the game runs, EAC checks that neither the game client nor programs running on your computer interfere with the game.

  • What data: technical data about your computer and operating system (e.g. hardware and system identifiers), data about running processes and modules loaded into the game, integrity checks of the game files, plus your in-game identifier and IP address. EAC does not access your personal files.
  • Purpose: preventing cheats, bots and game modification, protecting the other players and the game economy.
  • Legal basis: performance of the service (Art. 6(1)(b) GDPR) – fair play is part of the Terms – and legitimate interest (Art. 6(1)(f)).
  • Epic Games' role: for EAC-related processing, Epic Games International S.à r.l. (Luxembourg) acts as [independent controller / processor – per Epic's agreement, to be verified]; see the Epic Games privacy policy. Transfers outside the EU may take place under Epic's contractual safeguards.
  • Consequence: if EAC detects cheating, the game disconnects you and the account may be sanctioned (Terms, Rules of Conduct).

12. Login log, new-location confirmation, two-step sign-in

  • Game logins: the game server logs every successful login (account, time, IP address). When someone signs in from a new location (a new IP range), we send an e-mail; if you turned on "confirm new devices", a login from a new location is held until you approve it in the e-mail or on the My Account page. My Account shows your last 10 logins.
  • Two-step sign-in on the website: if you turn it on, we store your authenticator app's secret key and a keyed hash of your backup codes (not the codes themselves); both are deleted when you turn it off.
  • Retention: the game login log is kept for 90 days and sent sign-in notifications for 30 days; after that the daily automatic clean-up deletes them. Two-step sign-in data is kept until you turn it off or your account is closed.
  • Legal basis: protecting your account – performance of the service and legitimate interest (Art. 6(1)(b) and (f) GDPR).