Privacy Policy

What we collect

• Account details: the username, password, email address and gender you provide when registering. Gender is asked because the game client requires it for your character.
• Game data: the characters on your account, their levels, zeny and last known location.
• Technical data: your IP address and the time of each sign-in attempt.
• Support records: if you donate, we record the amount, the currency, the cash points granted, and PayPal's reference for the transaction.

Why we collect it

• Your username and password authenticate you on the website and in the game client.
• Your email address is used only to reset your password. We do not send marketing email.
• Your IP address is used to rate-limit sign-in attempts and to investigate abuse.
• Donation records let us deliver your cash points, answer questions about a payment, and handle refunds or disputes.

How your password is stored

Passwords are stored as an MD5 hash, which is the strongest format the game server supports. The game client transmits your password without encryption when you log in. For that reason, do not reuse a password here that protects anything important elsewhere.

Cookies

We set one cookie, rift_session, when you sign in. It keeps you signed in and does nothing else. It is not used for advertising or tracking, and we run no analytics.

• It expires after 7 days, or immediately when you sign out.
• It is marked HttpOnly, so scripts in your browser cannot read it, and SameSite=Lax, so it is not sent from other sites.
• On the live site it is also marked Secure, so it is only sent over HTTPS.

Card details

We never see or store your card details. Payments are processed by PayPal, and the card form belongs to PayPal: those details are entered on PayPal's systems and never reach ours. All we receive back is confirmation that the payment succeeded, the amount, and PayPal's reference for it.

Who we share it with

RiFT does not sell or rent your data to anyone. Two service providers are involved, each only for the thing they provide:

• PayPal: processes payments, if you choose to donate.
• Our email provider: delivers password reset emails, and nothing else.

How long we keep it

Account and character data is kept for as long as the account exists. Password reset tokens expire one hour after they are issued. Donation records are kept even after an account is deleted, because we are required to retain financial records and may need them to resolve a dispute or refund.

Deleting your account

Ask us from the address registered to the account and we will delete the account and its characters: reach us on Discord

Contact

Questions about this policy: reach us on Discord