Privacy Policy

This page explains, in plain language, which personal data the browser game VEYDRIS at playveydris.com processes, why, and for how long. It was written from the game’s actual source code, not from a template.

Last updated: 17 October 2026

1. Who is responsible

VEYDRIS is a non-commercial hobby project run by a private individual living in Serbia. There is no company behind it, nothing is sold, and no advertising networks or data brokers are involved.

The operator is the controller (rukovalac) for the personal data described on this page. As permitted for non-commercial private websites in Serbia, no name or postal address is published; the operator can be reached by e-mail at any time:

kontakt@playveydris.com

Please use this address for all privacy questions and requests. See also the contact page.

2. Applicable law

Because the operator lives in Serbia, this site is subject to the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, “Službeni glasnik RS” no. 87/2018, “ZZPL”). For visitors located in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) also applies under its Article 3(2). Both laws are built on the same principles, and the legal bases named below exist in both (ZZPL Article 12 / GDPR Article 6(1)).

3. Hosting and server logs

All parts of this site run on a single dedicated server rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany (EU). Hetzner provides the hardware and network only and acts as a processor; the server itself is administered by the operator. Databases, files and backups stay on this server.

Like every web server, the nginx web server writes an access log entry for each request. An entry contains your IP address, date and time, the requested address, HTTP status and size, the referring page (if your browser sends it) and the browser identification string (user agent). Errors are written to a separate error log.

• Purpose: delivering the site, keeping it secure, detecting and defending against attacks and abuse, troubleshooting.
• Legal basis: legitimate interests (ZZPL Art. 12(1)(6) / GDPR Art. 6(1)(f)) in a secure, working service.
• Retention: the logs are rotated daily and deleted automatically after 14 days. Individual entries are kept longer only if they are needed to investigate a specific security incident.

4. Visitor statistics (Umami, self-hosted)

To see which pages are used, the site uses Umami, an open-source statistics tool that runs on the same server in Germany. It is not provided by a third party, and no data is sent to Umami’s developers or anyone else. The script is loaded from this site itself (https://playveydris.com/_u/).

• What is recorded: the page address, the referring page, browser, operating system, device type, screen size, language and the country derived from your IP address.
• What is not stored: your IP address. Umami uses no cookies and no local storage. To count unique visitors it computes an anonymised hash that changes every day, so visits cannot be linked across days or to a person.
• Do Not Track: if your browser sends a “Do Not Track” signal, the script records nothing. Blocking the script (for example with a content blocker) has no effect on how the site works.
• Legal basis: legitimate interests (ZZPL Art. 12(1)(6) / GDPR Art. 6(1)(f)) in understanding, in anonymised form, how the site is used. Because nothing is stored on or read from your device, no consent banner is needed.

The game itself additionally keeps its own operational records; these are described in sections 10 and 11.

5. Your account

When you register, the game stores:

• your e-mail address (used to sign in, for confirmation and password reset, and to identify you in privacy requests);
• your hero name (unique, public; you can also sign in with it);
• your password, only as a salted scrypt hash – the password itself is never stored;
• a recovery code, shown to you once and stored only as a salted hash. With it and your e-mail address you can set a new password without e-mail; using it replaces it with a new code;
• account metadata: creation date, whether your e-mail is confirmed, account role and status (for example a block after rule violations);
• your game state: class, level, items, inventory, storage, currencies, progress, guild and arena data, market listings and purchases, and similar game data.

Legal basis: performance of the user agreement, i.e. providing the game you signed up for (ZZPL Art. 12(1)(2) / GDPR Art. 6(1)(b)).

Deletion: there is no self-service delete button yet. Send a request from your account’s e-mail address to kontakt@playveydris.com, stating your hero name, and the account will be deleted together with your sessions, friend links, blocks and direct messages. Items you sold on the in-game market remain with the buyer as game items.

6. Account e-mails

The game can send two kinds of e-mail: a link to confirm your e-mail address (valid 24 hours) and a password reset link (valid 30 minutes). The tokens in these links are random, used once, and stored in the database only as SHA-256 hashes. No newsletters or marketing e-mails are sent.

At the time of writing, no external e-mail delivery service is connected. These messages are generated on the game server itself and stored there with restricted file permissions; they may therefore not reach your inbox. If you need help confirming your address or resetting your password, use your recovery code or write to kontakt@playveydris.com. Should an e-mail provider be connected in the future, it will be named here beforehand.

7. Browser storage – no cookies

VEYDRIS does not set cookies. To keep you signed in and remember settings, it uses your browser’s local storage. This is strictly necessary for the game to work and stays on your device; the sign-in token is sent to the server with each game request.

The installable app version registers a service worker that only caches an offline notice page; it does not cache personal data. You can clear all of this at any time in your browser settings; you will then need to sign in again, and a guest Chronicle without an account will be lost.

8. What other players see

VEYDRIS is an online game. Other players (and, for leaderboards and profiles, anyone using the game) can see:

• your hero name, class, level, power, ascension, title and profile frame;
• your public hero profile: currently equipped gear, active build (skills and passives), mount, companion, an aggregated collection summary, guild and arena summaries, and up to three showcase items you choose;
• your position on leaderboards, your entry in the hero directory (searchable by name), your name on market listings, and your name in guild member lists, guild chat and group play.

The public profile is built from a fixed whitelist. It never includes your e-mail address, internal ID, password or recovery data, session data, IP address, online status, login times, inventory, storage, currency balances, feedback or moderation data. Choose a hero name that does not reveal your real identity.

9. Friends, messages, guilds and groups

• Friends and blocks: friend requests, accepted friendships and blocks are stored between the two accounts.
• Direct messages (1–2,000 characters) can only be exchanged between accepted friends. They are stored with time of sending and read status so both participants can read the conversation. They are deleted when either account is deleted.
• Guild chat (up to 280 characters) and the guild activity log are visible to the guild’s members. Messages pass an automatic word filter.
• Groups for co-op battles: listings and membership expire after two hours.

The operator does not read private messages as a matter of routine. A message is only looked at when it is reported (section 13), when needed to investigate abuse, or at your request.

Legal basis: providing the community features of the game (ZZPL Art. 12(1)(2) / GDPR Art. 6(1)(b)); moderation is based on legitimate interests in a safe community (Art. 12(1)(6) / Art. 6(1)(f)).

10. Game operation, security and troubleshooting

All game logic runs on the server, which needs some operational records:

• Game and error events linked to your account ID, for example account created, first login, quests, crafting, raids, guild actions, page/screen changes and technical errors (with a cleaned-up error message and a request ID). These are used to fix bugs, keep the game balanced and detect abuse. They are deleted automatically after 90 days.
• Session statistics per browser tab: start time, last activity, entry and last screen, game build and highest level reached, linked to your account. Your last activity time is also used to show how many players are online (as a number only).
• Rate limiting: to block password guessing and spam, the server counts login and registration attempts per IP address and game actions per account in short time windows (15 minutes for logins). The counters for logins use your IP address as a key but are not linked to your account.

Telemetry is not sent to any third party. Legal basis: legitimate interests in a secure, working and fair game (ZZPL Art. 12(1)(6) / GDPR Art. 6(1)(f)).

11. Optional entry measurement (opt-in)

In the game’s settings you can switch on “Help improve the opening experience”. If enabled, visits to the entry screen, class selection, account form and guest trial are counted as daily totals. This sends no name, e-mail, password or persistent visitor ID. It is off unless you turn it on, and you can turn it off at any time in the same place. Legal basis: your consent (ZZPL Art. 12(1)(1) / GDPR Art. 6(1)(a)).

12. Guest play

You can try the game without an account. The guest progress is stored on the server under a random access key that is kept only in your browser; the server stores only a hash of the key. Guest access expires after 30 days. You can transfer the guest progress once to a registered hero; after that, the guest key no longer works.

13. Feedback, bug reports and message reports

• Feedback / bug reports from within the game store your account ID and hero name, the category, title and description you enter, and technical details to reproduce the problem: current screen, game build, window size, class, level, request ID and up to five recent error messages.
• Message reports: if you report a message, a copy of it, your reason and your account ID are stored for review by the operator as moderator.

These records are kept until they are handled and are deleted on request. Legal basis: legitimate interests in improving the game and in moderation (ZZPL Art. 12(1)(6) / GDPR Art. 6(1)(f)).

14. Where data is stored and who receives it

Personal data is stored on the server in Germany. Germany is an EU member state; under Serbian law, transfers to EU countries are considered to have an adequate level of protection. Data is not sold, rented or shared for advertising. Apart from the hosting provider and the cases named on this page, data is only disclosed when required by law (for example to a court or authority with a binding order).

VEYDRIS uses no third-party services for analytics, advertising, payment, chat or fonts: all scripts, fonts and images are served from this site, as enforced by its Content Security Policy.

15. Retention overview

After deleting an account, copies can remain in backups until those backups are rotated out.

16. Your rights

Under the ZZPL and, where it applies, the GDPR, you have the right to:

• access the personal data held about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted (“right to be forgotten”) or its processing restricted;
• receive data you provided in a common machine-readable format (data portability);
• object at any time to processing based on legitimate interests, for reasons arising from your particular situation;
• withdraw consent at any time with effect for the future, where processing is based on consent.

To use these rights, write to kontakt@playveydris.com. To protect your data, the operator may ask you to confirm that the account or data is yours. Requests are answered without undue delay and in any case within 30 days, free of charge.

For account data, please write from the e-mail address registered with the account and state your hero name. You can correct your e-mail address and password by contacting the operator; your hero name is public, so choose it carefully.

Right to complain

You can complain to the Serbian supervisory authority, the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs. If you live in the EU/EEA, you can also complain to the data protection authority in your country of residence. It would be appreciated if you got in touch first, so the problem can be fixed directly.

17. Children

VEYDRIS is a fantasy game with online communication between players and is not aimed at young children. In Serbia, a person aged 15 or over can consent to online services on their own; in EU countries the age is between 13 and 16. If you are a parent or guardian and believe your child has created an account without your permission, write to kontakt@playveydris.com and the account will be deleted.

18. Security

All connections use HTTPS. Server access is limited to the operator, services run separately from each other, and backups are stored with restricted file permissions. Passwords and recovery codes are hashed with scrypt, sign-in and e-mail tokens are stored only as hashes, login attempts are rate-limited, and the game container runs read-only with minimal privileges. No system is perfectly secure; if you notice a vulnerability, please report it by e-mail.

19. Changes to this policy

This policy is updated whenever the site changes in a way that affects personal data. The date of the current version is shown below.

Last updated: 17 October 2026