Privacy.

Drakos ("we") operates this website, the account portal, and the license service the Drakos plugin connects to. For any question or request under this policy, contact support@drakos.gg from the email address on your account, or message us on Discord.

We store your email address, an Argon2id hash of your password, your login sessions and password-reset tokens, and the license keys and prepaid time blocks that belong to your account. We cannot recover the password itself.

If you are locked out of your account, we cannot recover it for you. You must reset your password through the email you registered.

We encourage users to use a secondary email address not linked to their identity when registering for Drakos.

We do not ask for a name, a phone number, or any other profile information.

If you link your Discord account for the beta, we store your Discord user ID with your account. We use it so that each Discord account unlocks only one beta key, and to give you the Beta Tester role in our Discord. We delete this ID when we erase your account.

Checkout happens on Stripe's hosted payment page. Card details go directly to Stripe and never reach our servers. None of our pages display a card field. Stripe tells us that a checkout completed, which product was bought, a payment reference, and the email address used. Stripe processes payment data under its own privacy policy.

When the plugin connects to the license service, it sends your license key, the plugin version, and a build number that is the same for everyone on that release. When it reconnects, it also sends a short-lived ticket our server issued for that connection. While connected, the plugin exchanges periodic keepalive messages that carry no information about you.

The plugin does not collect hardware identifiers, machine fingerprints, character names, or any other in-game identifiers. The protocol has no field for them. The plugin keeps a local folder for each of your characters to store that character's settings. Each folder is named by the game's numeric character ID. These folders stay on your PC, and we never see them.

Our servers see the IP address of each connection. We use IP addresses for rate limiting and abuse prevention. They also appear in server logs (§ 07). We exclude license keys from logs on both ends. When a log or a support conversation needs to refer to a key, we use its internal ID number instead.

We send only transactional emails. These contain your key after a purchase or password resets when you request them. We do not send marketing email, and we do not give your address to anyone else.

The account portal sets two functional cookies. One is a login session cookie. The other is a security token for CSRF protection. Neither tracks you. The rest of the site sets no cookies, and we run no analytics trackers and no ads.

• We keep account records, including email, keys, and time blocks, for as long as the account exists. We do not delete inactive accounts. The data stays until you request deletion (§ 08).
• We keep server logs for 14 days.
• We keep encrypted database backups at a separate provider for up to about 63 days. We keep four weekly backups, and each one stays recoverable for 35 days after we delete it.
• The purchase ledger records which blocks were bought, when, and under which payment reference. It is a financial record that we keep for accounting purposes.

Email us from your account address and we will erase the account. Erasure has the following effects:

• We immediately remove everything that identifies you, including your email, password hash, sessions, and reset tokens. Your keys stop working and can no longer be recovered.
• We keep the purchase ledger as a financial record, no longer linked to your email.
• Copies of your email expire from server logs within 14 days and from encrypted backups within about 63 days.
• Stripe keeps its own records of your payments under its own legal obligations. Any correspondence you sent to support stays in the support mailbox until closed out.

After erasure we can no longer verify who you are, so we cannot recover keys or purchases or help with the account in any way.

Under the GDPR (EU/EEA and UK) and the CCPA/CPRA (California), you may request access to the personal data we hold about you, correction, deletion (§ 08), and a copy in portable form. You may file complaints with your data-protection authorities. We do not sell or share personal information as the CCPA defines those terms. Send requests to support@drakos.gg from your account address or message us on Discord. We respond within one month.

Our servers are in the European Union, with a replica in the United States for failover and encrypted backups at a separate provider. Data on the EU primary is also present in the United States. The replica and the backups have the same protections as the primary.

This policy's version and date appear at the top. We announce material changes on the updates page.