← Home

Privacy Policy

This notice explains how we process personal data when you use Eldros (the website at eldros.app and the Windows game client). It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (2018:218).

Last updated: 2 September 2026. We will change the date when this notice changes.

1. Controller

The controller is Holo Koi AB, Hampvägen 4, Sweden. Contact for privacy requests: info@holokoi.shop.

We have not appointed a Data Protection Officer. Use the email above for all data-protection questions.

2. What this service is

Eldros is an online game. You can create an account on this website or in the game client. The same account is used in both places. After you install the Windows client, the game may download updates from Cloudflare R2. Gameplay is stored on a SpacetimeDB database (maincloud).

3. Personal data we process

We only process what is needed to run the game and this site. We do not sell personal data. We do not run advertising or marketing profiles.

Account

  • Account name
  • Email address (required to register and to reset a password)
  • Password: stored as a salted one-way hash. We do not keep a usable copy of your password after hashing
  • Whether the email field is marked verified in our database
  • Account creation time
  • Login session token (kept on our servers and in your browser or game client until it expires, currently 24 hours, or you log out)

Security and password reset

  • Failed-login counters and temporary lockouts tied to connection identity and account
  • Password-reset token hashes and expiry (reset links last one hour)
  • IP address on the forgot-password request (used only for a short in-memory rate limit on the website)

Game progress (tied to your account)

  • Characters (name, class, appearance type, level, position, inventory, equipment, quests, combat progress)
  • Actions in the world (combat, loot, chat, presence, corpses)
  • Local chat: nearby players can see the sender account name and the message
  • Online presence: other players in the world can see your character

Device storage on this website

  • localStorage keys for account name and session token so you stay logged in on this site. These are not advertising cookies. We do not use analytics cookies or third-party ad cookies

Hosting, updates, and email

  • Technical logs that our hosts may create (for example IP address, time, URL) when you visit eldros.app, download the installer, or the game fetches an update

Email is personal data. Account names and in-game chat can also be personal data if they identify you.

4. Why we process it (purposes and legal bases)

  • Provide the game and account (GDPR Art. 6(1)(b)) — contract: registration, login, characters, world sync, password reset. Without account name, email, and password we cannot create an account.
  • Security (GDPR Art. 6(1)(f)) — legitimate interests: rate limits, lockouts, hashed passwords, generic reset emails that do not confirm whether an email is registered. Our interest is to stop abuse. This does not override your rights.
  • Hosting and software updates (GDPR Art. 6(1)(b) and 6(1)(f)) — delivering the website, installer, and game files, and keeping the client up to date.

We do not rely on consent for the core account. Creating an account is optional; if you do not provide the required data, you cannot use the online features.

5. Who receives the data

We use processors that process data on our instructions:

  • Clockwork Labs / SpacetimeDB — account and game database (maincloud.spacetimedb.com)
  • Vercel Inc. — hosts eldros.app and the password-reset API
  • Cloudflare, Inc. — stores and serves game update files (R2), including the public update manifest
  • Resend — sends password-reset email when that feature is enabled

Other players see data that is part of multiplayer (character in the world, nearby chat). We do not sell or rent personal data. We do not share it for advertising.

6. Transfers outside the EU/EEA

SpacetimeDB, Vercel, Cloudflare, and Resend may process data in the United States or other countries outside the EU/EEA. Where that happens, we rely on the transfer tools those providers use (for example the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework). Ask us if you want more detail on a specific provider.

7. How long we keep data

  • Account and game progress: until you ask us to delete the account, or we shut down the service
  • Session tokens: up to 24 hours, or until logout
  • Password-reset tokens: one hour
  • Login lockout records: only as long as needed for the lockout window
  • IP rate-limit records on the website: in memory, about one hour
  • Hosting logs: according to each provider’s default, typically a short period for security and operations

8. Your rights

You may request:

  • Access to your personal data (Art. 15)
  • Correction of inaccurate data (Art. 16)
  • Erasure (Art. 17), including deletion of your account
  • Restriction of processing (Art. 18)
  • Data portability where it applies (Art. 20)
  • Objection to processing based on legitimate interests (Art. 21)

Email info@holokoi.shop from the address on the account if you can, and include your account name. We may need to verify that the request is yours. There is no self-serve “delete account” button yet; character deletion is available in the game and on the account page. Account deletion is done by us after your request.

You may lodge a complaint with a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection (IMY), www.imy.se. If you live in another EU/EEA country, you may contact that country’s authority instead.

9. Children

Eldros is not directed at children under 13. If you are under 16, the rules of your country may require a parent or guardian to agree before you create an account. Do not register if you are not allowed to. If we learn we hold an account for a child below the applicable age, we will delete it.

10. Security

Passwords are stored hashed with salt. Sessions expire. Password-reset emails use a one-time link. No method is perfect. Use a unique password.

11. Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects about you (Art. 22).

12. Windows installer and game updates

The installer is offered at eldros.app/downloads/EldrosSetup.exe. After install, the client may download files from Cloudflare R2 using the manifest URL above. Those downloads are game files, not extra account fields, but the connection may show your IP to Cloudflare.

13. Changes

If we change this notice in a material way, we will update the date at the top. The current version is always at https://eldros.app/privacy.