Privacy Policy

Terran Ventures LLC develops and publishes DUAT and operates duat.gg. We are organized in the State of Wyoming, United States, and we act as the data controller for everything described in this policy.

For any privacy or data protection question, request, or complaint, write to privacy@duat.gg. A person reads that address. We reply to every request within 30 days, and we will tell you before that deadline if a request is complex enough to need longer. You do not need an account to contact us, and we will not charge you for a request.

We have not appointed a data protection officer, because our size and the data we handle do not require one under Article 37 of the GDPR. Requests to the address above reach the people who can act on them.

Nothing, by default. Browsing duat.gg requires no account and stores no cookies or other local data on your device. We run no advertising, no tracking pixels, and no fingerprinting. There is no analytics product on this site. If we ever add one it will be cookieless, and we will update this policy before it ships rather than after.

Your email address, if you subscribe. The “Follow development” form sends your email address to Buttondown, our newsletter provider. Subscription is double opt-in, so nothing happens until you confirm from your inbox. Buttondown records the date you confirmed and whether our emails reached you. We use the address to send development updates and for nothing else, and every email carries an unsubscribe link that works on the first click.

Whatever you put in an email to us. If you write to privacy@duat.gg we receive your address and your message. We use both to answer you.

Server logs.Vercel hosts this site and processes standard request data, including your IP address, the page you asked for, your browser’s user-agent string, and a timestamp. This is how a web server delivers a page and blocks abuse. We do not use those logs to identify visitors and we do not join them to anything else.

DUAT is in development and is not yet playable by the public. This section describes the data the game handles by design, and it applies from the moment you can first sign in and play. Nothing in it applies to you today if all you have done is read this website.

Account and sign-in data. You sign in to DUATthrough the platform you bought or launched it on. From that platform we receive a persistent account identifier, your display name or persona, your country or region, and your avatar. Where a platform asks you for explicit permission before sharing a field with us, we receive that field only if you grant it, and you can withdraw that permission in the platform’s own settings. We never receive or store your platform password. Your relationship with the platform itself is governed by that platform’s own privacy policy, which you should read alongside this one.

Game and progression data. To let you keep playing the same character across sessions and devices, we store your characters, your level and attributes, weapon progression, the Names you have claimed, your inventory and stash, your settings and key bindings, and your friends and party membership inside the game.

Session and match data. When you enter a world or an arena match we record which session you joined, when, with whom, and how the run ended. Ranked play additionally stores your rating and per-match results, because a ladder cannot exist without them.

Network data. Multiplayer requires your device to reach other players and our servers, so our networking provider processes your IP address and connection quality measurements for the duration of a session. This is what makes a networked game work, and it is the same data any online game must handle.

Crash reports and diagnostics. When the game crashes it can send us a crash report containing the error, a stack trace, your operating system version, and your hardware specification. These help us fix the crash. They are not used to build a profile of you.

Fair play data. To keep ranked play cheat-free we record gameplay telemetry and enforcement history, such as reports made about an account and any restriction we applied to it.

Purchases. If you buy the game or anything in it, the store handles the transaction. We receive a confirmation that an entitlement exists, and we never receive or store your card number, bank details, or billing address.

What we do not collect. We do not collect your real name, your postal address, your phone number, your precise location, your contacts, biometric data, or any of the special categories of data listed in Article 9 of the GDPR. We do not read your microphone or camera. We do not buy personal data from data brokers, and we do not build advertising profiles.

We do not sell your personal information, and we never have. We do not share it for cross-context behavioural advertising. We do not trade, rent, or licence it. The only companies that touch your data are the service providers we need in order to run the website and the game, and each one may use it only to perform that service for us under a written contract.

Two situations fall outside that list. We will disclose data if a valid legal process compels us to, and we will say so publicly unless the law forbids it. If the project is ever sold or merged, your data may transfer to the buyer, who would remain bound by this policy until they give you notice and a chance to object.

If the GDPR or UK GDPR applies to you, these are our lawful bases under Article 6. We rely on your consent for the newsletter and for any platform field you explicitly grant us, and you can withdraw it at any time without affecting what we did beforehand. We rely on contract for account, progression, session, and purchase data, because without it we cannot deliver the game you obtained. We rely on legitimate interests for server logs, crash diagnostics, and fair play enforcement, having weighed those interests against your rights and concluded that running a working, cheat-free game does not override them. We rely on legal obligation where a law requires us to keep or produce something.

We keep each kind of data only as long as it does the job it was collected for, then we delete it. These are the periods we work to.

One exception is worth stating plainly. If we have restricted an account for cheating or abuse, we keep the minimum record needed to enforce that restriction, because deleting it would let the same account return immediately. We keep nothing else about that account beyond what the enforcement needs.

Write to privacy@duat.gg and say what you want. Three requests cover almost everything.

To see your data, ask for a copy. We send you everything we hold about you in a machine readable file, along with a plain description of where each part came from and who else has processed it.

To correct your data, tell us what is wrong. Most fields, including your display name and your settings, you can change yourself in the game or on your platform account, which is faster.

To delete your data, ask us to close your account. We delete your characters, progression, stash, session history, ratings, and diagnostics within 30 days. Deletion is permanent and we cannot restore a deleted account, so we will confirm once before we act. If you only want off the newsletter, the unsubscribe link in any email does that on its own and does not touch anything else.

To protect your account we have to know a request is really yours, so we may ask you to send it from the email address on file or to confirm something only the account holder would know. We ask for the least we can. If we cannot verify a request we will say so rather than act on it.

Europe, the United Kingdom, and Switzerland. You have the right to access your data, correct it, erase it, restrict or object to how we process it, receive it in a portable format, and withdraw any consent you gave. You also have the right to complain to your national supervisory authority, and you may do that without contacting us first, though we would rather fix the problem ourselves. We take no automated decisions that produce legal effects about you.

California. Under the CCPA and CPRA you have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing, and to limit the use of sensitive personal information. Two of those need no action from you: we do not sell or share personal information, and we do not collect sensitive personal information as the CPRA defines it. We will never treat you differently for exercising a right.

Elsewhere. Several other jurisdictions, including Virginia, Colorado, Connecticut, Brazil, and Canada, grant comparable rights. Rather than run a different process per jurisdiction, we extend the access, correction, and deletion process above to everyone who asks, wherever you live.

We are based in the United States and our providers store data in the United States and the European Union. If you are outside those places, using the website or the game moves your data across a border. Where we send personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision covering the destination.

This website is not directed at children, and DUAT is intended for players aged 13 and over. We do not knowingly collect personal information from a child under 13, or under 16 in the European Economic Area and the United Kingdom where local law sets that higher age.

If you are a parent or guardian and you believe a child has given us data, write to privacy@duat.gg and we will delete the account and everything attached to it. We do not require proof beyond enough to identify the account.

We encrypt data in transit with TLS, we restrict access to production systems to the people who need it, and we choose providers that maintain recognised security certifications. No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will notify you and the relevant supervisory authority within the deadlines the law sets, which is 72 hours under the GDPR.

When this policy changes we post the new version here and update the effective date at the top. If a change materially affects what we collect or what we do with it, we announce it in the devlog and, where the law requires consent, we ask you again rather than assuming your silence.