Privacy Policy

This is the privacy policy for Play AC Online, at playaconline.com. We try to collect as little as possible. What we do collect is listed below, along with where it lives and how to make us delete it.

What we collect

Account info (only if you sign up)

• Username or email address. Whichever you chose to log in with. Private: other players see your display name, never your login. Never shared, never sent to advertisers. If you log in with an email address, we keep it only as that login and never send mail to it.
• Display name. Whatever you typed at registration. Shown in the topbar when you're logged in.
• Password. Stored only as an Argon2id hash, so we cannot read your actual password. If you forget it, ask in our Discord and we'll give you a one-time link to set a new one; we can't recover the old one.
• Account created timestamp. Also used for City chat safety: an account less than an hour old can't chat in The City yet. An account less than 7 days old that joins The City from a network an account currently banned from The City has used can't chat there until it is 7 days old (see Network checks when you enter The City below). If our server can't tell how old an account is, City chat is refused for it until it can.
• Your sign-up agreement. To make an account you tick a box saying you are 13 or older (16 in the EEA) and agree to the Terms and the Community Rules. We store when you agreed and which version of the rules was in force. Accounts made before the box existed have neither.
• Your contact settings. Whether players can find you by name, who can ask to visit your town, and whether you can ask to visit players who aren't your friends (see below). Stored with your account.

Cloud saves (only if you opt in by logging in)

When you're logged in, your in-game save data is bundled and uploaded to AWS S3 about 5 seconds after each in-game save. The bundle contains only the contents of your /save directory inside the game: your character, town, items, and progress. It does NOT contain your ROM, your real-world location, your device's other files, or anything outside the game's save slot.

We retain the latest snapshot indefinitely (so you can resume on any device) and keep the last 30 days of versioned backups in case of corruption or accidental deletion. After 30 days, old backups expire automatically.

Friends, chat and reports (only if you log in and play together)

• Friend code. A random code made for your account. Anyone you give it to can send you a friend request.
• Contact settings. Three settings decide how other players can reach you, and all three start on the safe side for every account. Let players find me by name is off: other players can't find you by searching your display name unless you turn it on. Visit requests from is set to friends: only your friends can ask to visit your town unless you choose everyone. Let me ask to visit players who aren't my friends is off: you can only ask to visit your friends unless you turn it on. Friends can always visit each other. A visit between two players who are not friends needs both: the host takes visit requests from everyone, and the visitor has turned this setting on. Our server checks this when the request is sent and again when the host says yes.
• Who can send you a friend request. Anyone with your friend code, and, if you turned on Let players find me by name, anyone who finds you by searching your name. Otherwise a player can only send you a request with Add friend if the two of you were in the same part of The City, or the same friend visit, at some point in the last 24 hours. To check that, our server reads the records of time in The City and of friend visits described below; it stores nothing new for it.
• Friends, requests and blocks. Who you are friends with, the requests you sent or got, and the players you blocked. Stored on our server. A player you block is not told. A friend request nobody answers is deleted after 90 days.
• What your friends see. Only your friends see whether you are hosting a visit, visiting, in The City, online (you used the site in the last few minutes) or offline. This is worked out live and not stored.
• Chat in The City. Messages pass through our server to the players in the same part of The City. We store every line said in The City (the words as they were shown, who said it with their display name at the time, which part of The City, and when) for 30 days, then it is deleted automatically. We keep it so we can check what really happened when someone is reported, when our system mutes a player automatically, or when something goes wrong in The City while it is happening. The developers also see numbers worked out from it (how much is said, when and in which part of The City, the words used most, and which players say the most, by display name), never a line's words; opening those numbers is logged like any other read. A line is kept for its 30 days even if the account that sent it is deleted, so harm reported late can still be checked. A line from an account we have marked as our own test or bot account is stored only when a player who is not one of those accounts was in the same part of The City to read it.
• Lines the chat filter refuses. In every room, our server refuses a line with a link or contact details in it (a web address, an email address, a phone number, a username-style @handle, or a messaging app offered with a handle or an invitation), as well as lines its word filter blocks. A refused line is not delivered to anyone and is not stored, not in the chat log and not in a report. The one exception: a line refused for contact details that also matches the safety phrase list below is kept as a flag. You see a short message saying it was not sent.
• Chat on friend visits reaches your friends only. In a friend visit, a line you send goes only to the players in it who are your friends. Players in the visit who are not your friends don't see it, and the first time that happens in a visit you see a note saying so. So two players who are not friends can be in a visit together but cannot chat with each other.
• Chat on friend visits with just two players. When only two players are connected to a friend visit (a player who stepped away with their seat held does not count), we store each line the other player received: the words as they were shown, who said it with their display name at the time, who it was said to, which visit, and when. We keep it for 7 days, then it is deleted automatically. It is never shown in the City chat log, and nobody reads it unless something leads to a case: a report about that visit, or a flagged line from that visit (see below) that a developer opened a case from. Even then, a developer must write down why before reading it, and the read is logged. If you report a player from a two-player visit, the lines the two of you said there in the last 7 days (up to 200) are copied into the report's evidence, and from then on they are kept like any other report evidence. Only a line between two accounts we have marked as our own test or bot accounts is not stored.
• Chat on friend visits with three or more players. Not stored. The server keeps the last 50 lines of each visit in memory only while it is open, so a report can include them, and they are gone when it closes. While a visit is open, a developer acting as a moderator can read those last lines, for example during a live problem; that read is logged like every other.
• Lines flagged for safety. In every room, The City and friend visits, our server checks each line against a short list of phrases that adults use to approach children: asking someone's age, whether they are alone, where they live or go to school, for a picture, to keep a secret, or to move to another app or meet up. A match never stops the line: it is delivered as usual, and the player who said it is not told. Instead we store a flag for a developer to look at: the line, the 3 lines said just before it in the room (which can include what other players said), which room, who said it with their display name, and in a friend visit, which other players were there. A flag is kept for 90 days. If a developer opens a case from it, it is kept with the other case records for 2 years after that. A flag on its own never restricts anyone: a developer reads it and decides.
• Designs on friend visits. If you wear clothing or hold an umbrella you drew yourself, the design (a small 32x32 picture from your save) is passed through our server to the other players in the visit so they can see it. It is never stored and is never shown in The City.
• Who can read stored chat. Only the developers, acting as moderators, in a private moderation console. Every time a developer reads chat, or opens a player's moderation record, a case or an evidence export, we log who looked, at what and when. To read the City chat log, a live room's chat or a two-player visit's stored chat they must write down why (5 to 200 characters), and that reason is logged with the read; for other reads a reason is optional. Opening any list in the console (reports, appeals, the moderation log, a player search, the live rooms and who is in them, automatic mutes, flagged lines, the chat numbers) is logged the same way. That access log is kept for 2 years.
• Reports. When you report a player, we save the reason, your note, and that player's recent lines with the two lines before each one (which can include what other players said), so the developers can see what happened. You can also report a player from your friends list, or from the list of players on a friend visit; a report made when you are not in a room with them carries no chat lines, only the reason and your note. A short notice goes to a private Discord channel only the developers read (what it carries is under Where your data lives). The player you report is not told who reported them. We keep a report's evidence (the lines and your note) until the report is decided, plus the length of any restriction that came of it, plus 6 months. After that only the record stays: who reported whom, when, why, and what was decided. That record is deleted 2 years after the decision, or 2 years after the last restriction that came of the case ends, whichever is later (never while a permanent one is still in force).
• Evidence of very serious harm. For threats to someone's safety, or sexual content involving a child, a developer can preserve the evidence to pass to the police or the authorities that protect children. Preserved evidence is kept for 2 years from the day it was preserved, then deleted, and the reports it covered go back to the normal rules above.
• Mutes. The players you mute are remembered in your own browser only.
• Time in The City. When you enter The City we record which part of it you joined, when you arrived and when you left, and a keyed hash of the network you joined from (worked out from your IP address, the same way as Shared networks below; the address itself is not kept), tied to your account. We use it to look into reports and abuse, and to check whether two players met before a friend request (above), and delete each record after 30 days.
• Network checks when you enter The City. To stop a player who was banned from The City coming back on a new account, each time an account less than 7 days old enters The City our server compares its network's hash with the hashes recorded for other accounts: on their City visits in the last 30 days, and when they signed up (we keep the hash of the network an account was created from, never the address, for as long as the account exists). If an account that is currently banned from The City used the same network, the new account can't chat in The City until it is 7 days old, or may be kept out of The City until then, and a flag goes to the developers to look at. That flag names the accounts and the network hash and is kept like other flags: 90 days, or 2 years if a developer opens a case from it. A family or a school can share a network, so a match is treated as a hint: it never bans anyone on its own.
• Friend visits. We record who visited whom and when (the request, when the visit started and when it ended), tied to both accounts. We keep this history for 13 months, then delete it; after that only the daily count of visits, with no names or ids, stays.
• Names in the host's town. When a visitor joins a friend visit, our server hands them the host's save, and reads the names in it that the visitor will see: the town's name, its players' names and the names of its designs. It keeps them in memory for 12 hours, so that a report from that visit, by the host or a visitor who was handed the save, includes them as evidence; from then on they are kept like any other report evidence. If a name fails the same word and contact checks as chat, a flag goes to the developers with the names that failed, and is kept like other flags: 90 days, or 2 years if a developer opens a case from it. A visitor's own player and town names, which the host's villagers remember them by, are checked the same way and are not passed on when they fail; they are not stored.

Activity records (only if you log in)

• Days and sessions. When you are logged in, we record each day (in UTC) you used the site, and each logged-in session: when it started and ended, and whether it included a friend visit or The City. These are tied to your account. We use them to run the game, for safety and to prevent abuse, and delete them after 35 days.
• Last seen. We also store the last day you were seen on your account, for as long as the account exists.
• Counts with no ids. We keep totals, such as how many players were online each minute, how many were in The City, and how many registrations, visits, chat messages and reports there were each hour and day. These contain no ids, names or anything that points to you. Per-minute counts are kept 14 days and per-hour counts 13 months; daily counts are kept indefinitely.
• Who can look. Only the developers, acting as moderators, can open one player's activity record, and each time they do it is logged like every other moderation read (kept 2 years). Activity is never shown as a pattern of the times of day you play, and is never exported.

Moderation records

When a developer acts on a player (a warning, a chat mute, a multiplayer ban, an account suspension, a name reset or a removal from The City), we keep a record of it:

• The action itself. What it restricts, when it started and ends, the rule it was for, the reason shown to the player, a private note for the developers, which developer took it, and whether and why it was lifted early. A name reset also records the old name.
• A log of every moderation action. Each action above, each lift, when a player confirmed they had read a warning, and each change developers make to the live multiplayer settings. Entries are added and never edited.
• Automatic mutes. If several players whose accounts are more than a day old report the same player within a few minutes, our system mutes that player's chat for 30 minutes, and a developer then reviews it and decides. Nothing longer or broader is ever applied automatically. The player is told the mute was automatic.
• Appeals. You can appeal any decision once: within 30 days of it, or later while it is still in force. A name reset is appealed through the warning that comes with it; if the reset is overturned, your old name comes back, as long as you have not changed your name since. If you appeal, we keep what you wrote, the answer and which developer gave it, for 2 years after the decision. If your account is suspended, after you log in with the right password, you get 30 minutes to send that appeal from the same tab, and to download the town saved to your account: a suspension never takes your town away.
• What you see. If you are restricted, the game tells you what, until when and why, and how to appeal. The private note is never shown to anyone outside the developers. What each restriction means and how appeals work are in the community rules.
• How long. Kept while the restriction is in force and for 2 years after it ends, so repeat problems can be recognized and appeals answered, then deleted. A permanent restriction is kept for as long as it is in force. An action that restricts nothing (a name reset, a warning you have read, a settings change) is kept for 2 years after it was taken.
• Your copy. When you ask us for a copy of your data, it includes the moderation records about you, everything above except the developers' private note.

Sessions + security

• Session cookies:set on login. HttpOnly + Secure, with cross-site requests refused by the server. Tied to a hashed-at-rest token in our database, never the plaintext cookie value.
• Log-in record:each session we keep in our database stores the IP address and the browser user-agent string you logged in from, tied to your account. It is deleted when the session ends: when you log out, when it expires 7 days after you logged in, or when it is ended for you (a password reset, an account suspension).
• IP address:also recorded in request logs for ~30 days for abuse detection + rate limiting.
• Shared networks:to spot someone getting around a ban with a new account, the moderation console can show that a player "shares a network with N accounts". It is worked out from the IP addresses of the players' current log-in sessions (the same address, or for IPv6 the same household-sized /64 block), compared as keyed hashes. The developers see the count and which accounts, never an IP address. A family or a school can share a network, so this is treated as a hint, never as proof. The network hashes kept from sign-up and from entering The City are described under Network checks when you enter The City, above.
• User-agent string:also used to populate the "device hint" on cloud-save metadata so the conflict modal can show "from Chrome on macOS" if you log in on two devices.
• Anonymous player id:a random id stored in your browser's localStorage (key acweb_pid) so the live "players online / played today" counter can tell distinct players apart. It contains no personal information, isn't tied to your account, and is sent only with a lightweight "I'm playing" ping while the game is running. On our server we record which UTC days an anonymous id played, for the played-today and this-week counts, and delete those days after 35 days; and when an id was first seen, kept indefinitely for the all-time total. Neither is ever linked to your account. Clearing site data removes the id from your browser.

Analytics

We use PostHog for product analytics: page views, when you leave a page (so we can see time on page), how fast pages load (web vitals), and a set of events we explicitly fire (e.g. cloud_save_upload_success, user_registered), plus how far your game got through booting and a per-session performance summary (frame rate, memory use, graphics card, screen size, and basic device facts such as CPU cores and connection type).

PostHog gives this browser a random id and keeps it in a PostHog cookie and in localStorage, so it stays the same from one visit to the next and we can tell a returning browser from a new one. When you're logged in, events and session recordings are also tagged with your user id and display name, so they are linked to your account. Logging out clears that link and gives the browser a new random id; clearing site data does the same.

We deliberately do NOT send your username or email address to PostHog. We can compute aggregate engagement, but we can't trade your login or contact you through it.

Crash reports

When the game crashes we send PostHog the error, where in the boot it happened, and a short extract from the end of the game's own log, which is what it was doing at the moment it died. The extract is truncated before it is sent, and save and disc filenames are stripped out of it first, so your town name does not ride along inside it. In multiplayer, other players' names and ids, bulletin board posts and drawn designs are taken out too. The same scrubbed extract is what the crash window lets you copy.

Session recordings

PostHog also records how you move through the site so we can see what actually went wrong when the game fails to start. A recording captures the site's own interface: which buttons you press, which panels you opened, how long each step took, and the shape of the page at every moment.

• The game itself is not recorded. The game runs in a separate frame that we exclude outright, so nothing you do in-game and nothing drawn on the game screen is captured.
• All visible text is masked before it leaves your browser, not just what you type. Every word on the page, including your display name, the names of friends you visit, their town names, and the filename of a disc image you picked, is replaced with asterisks. We can see that text was there and how long it was; we cannot read it. Passwords and everything else typed into a form are masked the same way.
• URLs are stripped of anything secret. If a link you followed carried a password-reset token or a similar one-time code, the value is replaced with the word redacted before the address is recorded or sent as an event.
• Your ROM is never touched. When we accept or reject a disc image we record why, its container format and file extension, the game ID from its header, and, when it is rejected or converted, its size. We never record its file name and never anything else from inside it.
• You can turn it off. Open Settings on the game screen and switch Session recording off under Privacy. It takes effect immediately, with no reload: the recorder stops in that moment, and it is never started again on this browser until you switch it back on. It is on unless you turn it off. Turning it off leaves the analytics events alone (page views, errors and the rest described above), and they still carry this browser's id and, when you're logged in, your user id and display name.
• Recordings honour Do Not Track exactly like our analytics events: with DNT on, nothing is recorded at all.
• Recordings are held by PostHog and deleted on PostHog's own schedule for session replay, which is set by them and is shorter than the one for analytics events. We don't set it and we don't keep a copy anywhere else. The current periods are in PostHog's data-storage docs.

PostHog respects the browser's Do Not Track signal, for both events and recordings: with it on, nothing is sent. Recordings also have their own switch in Settings, described above. To stop the analytics events as well, block i.posthog.com in your browser or use a privacy extension. That one rule covers both the address the events go to and the one the recorder is fetched from; blocking only the assets host stops the recording but not the events.

What we DON'T collect

• Your ROM. The game disc image you load stays in your browser's IndexedDB cache; it never leaves your device.
• Payment info. The site is free; no payment processor is involved.
• Your real name, address, phone number, or any other PII beyond the account info above.
• Cookies for advertising or cross-site tracking. There aren't any.
• Your contact list, location, microphone, or camera. The site doesn't request those permissions.

Where your data lives

We're a small team running on cloud infrastructure. The third-party processors we use (and what they touch):

• Amazon Web Services (us-east-1):runs the backend server, holds the database, and stores cloud saves in S3 (encrypted at rest with AES-256).
• Turso / libSQL:the database that holds your account row and cloud-save metadata. Encrypted in transit.
• PostHog:product analytics and session recordings, as described above.
• Discord:our contact channel (see Contact below), and where our server posts short notices to a private channel only the developers read. A report notice carries the display names of both players, the reported player's account id, the report's id, the reason, the room, whether it is marked severe, whether chat lines were captured and how many, and whether the reporter wrote a note and how long it is: never the chat lines and never the note's words. An automatic mute notice carries the muted player's display name and account id, how many players reported them and within how long, the reasons they gave, and when the mute ends. An appeal notice carries the player's display name and account id, the appeal's and the decision's ids, which kind of decision they appealed and how long the appeal is, never its words. Feedback board posts and replies are sent with their title, their text and the author's display name, after the same word filter as chat. A daily activity summary and alerts about unusual activity carry counts only, never names or ids. Discord keeps these messages under its own terms.
• YouTube (Google):plays the trailer on the home page, and only once you press play. Until then the page shows our own picture and nothing is loaded from YouTube. The player comes from YouTube's privacy-enhanced youtube-nocookie.com.
• Cloudflare DNS / AWS Route 53:DNS resolution for the domain. Sees the fact that your IP looked up our hostname; doesn't see your traffic content.

Database backups. Our server takes a full copy of the database every 6 hours and keeps it in AWS S3, where each older copy is kept for up to 30 days and then deleted automatically. So something deleted from the database (by you, by us, or by the automatic deletions below) can remain in a backup for up to 30 more days.

Most of our infrastructure runs in the United States. If you're in another jurisdiction, by using the site you consent to your data being transferred to + processed in the US.

Why we are allowed to use it (lawful basis)

• To give you the service you signed up for (contract). Your account, log-in sessions, cloud saves, friends, live chat and friend visits.
• To keep players safe and the service working (legitimate interests). The City chat log, the 7-day store of two-player friend-visit chat, lines flagged for safety, the check that two players met before a friend request, reports and their evidence, moderation records, appeals, the moderators' access log, time in The City, automatic mutes, session IP addresses, shared-network checks and the network checks when you enter The City, the names read from a host's save, activity records and counts, and analytics. We have weighed each of these against your privacy, especially for younger players, and kept each one as small and as short-lived as we can.
• Where a law requires a record (legal obligation). For example the safety records the Online Safety Act requires, and reports we must make to the authorities.

How we protect it

• Passwords hashed with Argon2id (memory-hard, cost-tuned).
• Session and password-reset tokens stored only as SHA-256 hashes; the plaintext lives only in your browser's cookie.
• HTTPS everywhere:site assets, API, cloud saves. The S3 buckets actively reject any non-TLS request.
• Encryption at rest on cloud saves and configuration in S3.
• Rate limits on login, password-reset, and cloud-save uploads.
• HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy response headers on every page, and a Permissions-Policy header from our API.

Your rights

Under UK data protection law (the UK GDPR) you have these rights. To use any of them, contact us as described under Contact below.

• Access. Reach out via Discord and we'll send you a copy of everything we have on your account, including the moderation records about you (all but the developers' private note on each).
• Rectification. Ask us to correct anything we hold about you that is wrong. You can also change your display name yourself, once every 7 days.
• Deletion. Reach out and we'll delete your account and your cloud saves: your log-in, sessions, friends, friend requests and blocks, friend code, feedback posts, visit history and activity records go with it. If there are moderation records about your account (restrictions, appeals or reports), we keep those for the periods above, attached to an account that has no name or log-in left, and delete them when those periods end. Your cloud saves are deleted from S3 with every backup of them at once, and database backups expire on a 30-day rolling lifecycle. City chat lines stay for the rest of their 30 days, two-player visit chat for the rest of its 7 days, and flags for the rest of their 90 days (or 2 years when a case was opened from one), as described above.
• Restriction. Ask us to stop using your data, other than keeping it, while a question about it (such as whether it is correct) is settled.
• Objection. Object to anything we do on the basis of legitimate interests. We will stop unless we have a strong reason that outweighs yours, such as keeping other players safe or dealing with a legal claim.
• Export. The Options menu in-game already includes "Export Save", so you can download your save bytes as standard .gci files at any time.
• Opt out of analytics. Enable DNT in your browser or block posthog.com at the network level.
• Wipe everything locally. The Options menu has "Reset Save" (wipes save data) and "Forget ROM" (wipes the cached ISO). After both, clearing site data in your browser removes any remaining traces.
• Complain. If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Data retention

• Account row: indefinite, until you ask us to delete it.
• Current cloud save: indefinite.
• Versioned cloud-save backups: 30 days, then auto-expire in S3.
• Active session cookie, and the session's stored IP address and user-agent: 7 days from issue (or whenever you log out, or the session is ended for you).
• Time in The City (which part, when you arrived and left, and the network hash): 30 days.
• The hash of the network an account was created from: while the account exists.
• Names read from a host's save on a friend visit: 12 hours in memory, longer only as report evidence or in a flag.
• Logged-in activity days and sessions: 35 days, then deleted automatically.
• The last day you were seen: while your account exists.
• The days an anonymous player id played: 35 days. When an anonymous id was first seen: indefinitely. Neither is linked to an account.
• Friend visit history (who visited whom and when): 13 months, then only the daily counts stay.
• Friend requests nobody answered: 90 days, then deleted automatically.
• Your contact settings and your sign-up agreement (when you agreed, and to which version of the rules): while your account exists.
• Counts with no ids (players online, in The City, registrations and similar): per minute, 14 days; per hour, 13 months; per day, indefinitely.
• Chat said in The City: 30 days, then deleted automatically.
• Chat said in a friend visit with only two players connected: 7 days, then deleted automatically. Friend-visit chat with three or more players: not stored, except the lines that come with a report.
• Lines flagged for safety (the line, the 3 lines before it, the room and who was there): 90 days, or 2 years after a case was opened from the flag.
• Report evidence (the chat lines and the reporter's note): until the report is decided, plus the length of any restriction that came of it, plus 6 months; then only the record of the report and the decision stays. While the reported player has an open report or a pending appeal, their older evidence waits for that to be decided, because it is part of the same case. A report that is still undecided a year after it was made loses its evidence then, unless it was kept for the police.
• The record of a decided report (who reported whom, when, why and what was decided): 2 years after the decision or after the last restriction from the case ends, whichever is later.
• Evidence preserved for the police or child-protection authorities: 2 years from the day it was preserved.
• Moderation records and the moderation log: while the restriction is in force and for 2 years after it ends; an action that restricts nothing, 2 years after it was taken.
• Appeals: 2 years after the decision.
• The moderators' access log (who read chat or a player's record, and why): 2 years.
• Password-reset links: valid for at most a day; deleted when they expire, or at most 24 hours after use.
• Request logs (with IP): ~30 days, then rotated out of CloudWatch.
• Database backups: each copy up to 30 days, so anything above can last up to 30 days longer in a backup.
• Analytics events: per PostHog's retention defaults.
• Session recordings: per PostHog's replay retention, which is shorter than the one for events and is set by PostHog, not by us.

Children

Our Terms of Service require account holders to be at least 13 (16 in the EEA). If we discover an account belongs to a child below the relevant age, we'll delete it. Parents who want a child's account removed can reach us via Discord.

Cookies

We set as few as possible:

• One session cookie (HttpOnly, Secure, SameSite) for login state.
• PostHog's own cookie, plus a copy in localStorage, holding the random analytics id for this browser and the current session, described under Analytics above. See their privacy policy.
• If you press play on the home page trailer, YouTube may set its own cookies or storage while it plays. See Google's privacy policy.

We do not use any third-party advertising or cross-site tracking cookies.

Changes to this policy

We may update this policy occasionally. The "Effective" date at the top reflects the most recent change. Material changes (new processors, new categories of data) are announced on the site and in our Discord.

Contact

We don't have an email address. Privacy questions, data-export requests and account deletion go through our Discord: ask in a public channel and a moderator will take it to a private message, so you never have to post account details in public. Tell us which account you mean, and we'll check it's yours before acting on it. We aim to reply within a few days.

This policy is not legal advice. If anything here materially affects you, please consult a lawyer in your jurisdiction.