Accounts and payments: what we keep

No analytics, no tracking

This site loads no analytics, tracking or advertising scripts. Every font, image and script comes from accounts.earthablaze.com itself. You can check: open your browser's developer tools and watch the Network tab while you use the account page.

It sets cookies only when you sign in, and only for that: one that lasts 15 minutes while you wait for the email link, and your session, which lasts 30 days or until you sign out. Both are HttpOnly (page scripts can't read them) and sent only to this site. Each game keeps its own sign-in cookie on its own site, so one game can't read another's.

What an account holds

Signing in is by a link we email you. There are no passwords. Your account is:

• your email address, an account id (the same in every game, so each game can keep your progress under it) and when the account was made,
• sign-in links, stored only as one-way hashes. Each works once, expires after 15 minutes and is deleted within the hour,
• sessions, one for this site and one for each game you sign in to, stored only as hashes, for 30 days,
• the one-time codes that hand a sign-in from here to a game, as hashes, for 60 seconds,
• what you own in each game: the item, where it came from (a card payment, the App Store, Google Play, a code, a gift, or an old licence you claimed), whether it's active, and when it ends or renews.

Games get your account id and email address over a private connection between our own servers, so they can say “Signed in as …”. They're asked not to store the email address, and they never see anything about how you paid.

Payments

On the web, payments go through Stripe, on Stripe's own checkout page. Your card details go to Stripe and never reach our servers. Stripe gets your email address, payment details and billing country, and handles them under its own privacy policy. We get back what you bought and Stripe's ids for it (customer, subscription, payment and invoice), and nothing about your card.

In a game's iOS or Android app, purchases go through Apple or Google, and reach us through RevenueCat, which the apps use to handle store purchases. Before you sign in in an app, RevenueCat knows you only by a random id. Once you sign in, it also knows your account id, so a purchase lands on your account. We get the product, the store's transaction id, and when it renews or ends.

Prices are in each game's own currency: Australian dollars for Operation Overlord, US dollars for Operation Freedom and Operation Epic Fury.

Records we keep to run payments

• A payments ledger: for each payment, the account id, the game and item, the amount and currency, any discount and the code it came from, Stripe's ids, whether it was a test payment, and any refund. It's a business record, kept for seven years (Australian tax law asks for five), and it stays after an account is deleted, with no email address in it.
• Chargebacks on your payments: the dispute id, the payment it's about and how it ended, until the account is deleted.
• Payment events already handled, as Stripe's and RevenueCat's event ids, for 90 days, so none is applied twice. Refunds and chargebacks that arrive before the purchase they're about wait as ids for up to 90 days.
• Codes you've used: which code and when, until the account is deleted. Codes themselves are stored as hashes. For a code that works once per account, a one-way hash of your email address stays against that code after the account is deleted, until the code expires, so deleting and signing up again doesn't use it twice.
• Purchases from a game's old store, if a game moved here from its own checkout: kept against a one-way hash of the address used to buy, and added to your account the first time you sign in with that address. We never make an account from one.
• An audit log, for a year: what the people who run the service change in admin, such as granting or revoking an item, with the reason given.

Licences

Games that run in your browser or offline can ask for a licence: a signed list of what your account owns in that game, kept on your device. It names your account id, not your email address. It works for up to 90 days without the game checking in, and the game refreshes it whenever it's online, which is also when a refund takes effect there.

Network addresses

To stop someone flooding an inbox or guessing codes, sign-in emails, code attempts and trips to the payment page are counted per network (an IPv4 address, or a block of IPv6 addresses) and per account or email address. Those counts are kept as one-way hashes, never the addresses themselves, and deleted after two days. Our logs record errors, never addresses, emails or sign-in links.

Cloudflare hosts the service. Like any host it processes your IP address to deliver the pages. Our data is in Cloudflare's D1 database.

Email

Sign-in links are the only email we send you: no newsletters, no marketing. They go out through Cloudflare's email sending service, from signin@earthablaze.com.

Deleting your account

The Delete account button on your account page removes the account from every game at once: your email address, sessions, what you own, and your Stripe customer records, which cancels any subscription first so nothing charges again. Each game is told within a day, through the list of deleted accounts we keep for 90 days, and deletes its own data for you. What stays: the ledger and the hashed address against once-per-account codes, as above, and the payment records Stripe, Apple and Google keep under their own policies.

Asking about your data

Email privacy@earthablaze.com from the address on your account and we'll tell you what we hold, correct it or delete it. Magnetic Labs Inc, 1930 Village Center Circle #3-6537, Las Vegas, NV 89134, United States.

Changes

If what we store changes, this page changes first, with a new date at the top. Adding analytics, or anything else that collects more, would be written here before it happened.