Privacy Policy

1. Who we are and what this policy covers

What Remains is operated by Joshua Lee Stroeher, who is the controller of the personal information described in this policy. This policy covers the game, its public and authenticated pages, account services, and messages sent through the service.

Questions and privacy requests may be sent to joshua.stroeher@ngpluscreative.com.

2. Information we collect

We collect information you give us, information created through play, and limited technical data.

Account and authentication information

• Your email address, character name, and optional referral code.
• Authentication records needed to register, verify an email address, sign in, keep a session active, and reset a password.
• Our server receives your password over HTTPS when you register, sign in, or change it, and passes it to Supabase Auth. Supabase stores a password hash, not a readable password. We do not save passwords in the game database.

Profile, gameplay, and economic information

• Your personal and Crew profile text, uploaded images and any embedded file metadata, Crew flag designs, Crew membership, friendships, blocks, and commendations.
• Rank, experience, talents, health, location, Cash, Bullets, inventory, vehicles, Compound contributions, Holdings, cooldowns, jail status, and other game state.
• Activities, combat, raids, reconnaissance, bounties, trades, transfers, gambling, lottery, referrals, Contracts, World Events, and the records those systems create.

Writing, communications, and safety records

• Forum posts, trade notices, public shouts, profile text, and other content you publish.
• Private messages, Crew-forum posts, message reports, friendships, and blocks.
• Feedback, bug reports, moderation actions, staff notes, and security or fraud signals.

Technical information

• Session identifiers, online and activity timestamps, and IP address and device or browser details made available to our hosting and authentication providers.
• For sign-in and other public requests, we hash submitted account or network identifiers into shared rate-limit buckets. Signed-in rate limits also use account identifiers. These counters protect the service; hashing does not make all technical records anonymous.
• Server diagnostics record request IDs, route paths, response status, timing, and, where available, account IDs. Errors and database timing records help us investigate faults.
• The website that sent you and any campaign tag in the link you followed, recorded once when your account starts. We keep the site’s name only, never the full address.

An email address, character name, and password are required to create an account. You can also play as a guest with only a character name and a password: a guest account holds no email address of yours until you save it with one. Profile decoration, uploads, referral codes, and public writing are optional.

Information usually comes directly from you or your browser. It can also be created by game rules, supplied by another player who interacts with you, or recorded by staff who review a report or enforce the rules.

3. Why we use information

We use personal information to:

• create and secure accounts, maintain sessions, and provide password recovery;
• run the persistent game world and carry out the actions players request;
• deliver messages, community features, notices, and account communications;
• prevent multi-accounting, spam, fraud, abuse, exploits, and unauthorized access;
• investigate reports, moderate content, enforce rules, and preserve the integrity of the game;
• learn which websites and links bring new players, so we know where to tell people about the game;
• diagnose faults, answer feedback, maintain the service, and meet legal obligations.

Where privacy law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating and protecting the service, compliance with law, and consent where a feature specifically asks for it. You may withdraw consent for optional processing without affecting processing that already occurred lawfully.

4. What is public and what is limited

What Remains is a persistent multiplayer world. Your display name, public profile, selected game statistics, Crew and Holding information, public forum posts, trade notices, shouts, ledger entries, pinned commendations, and character memorials can be visible to other players or to anyone who can reach the relevant public page. Online status and wealth-tier names are public in the game. Memorials may show the character’s exact Cash held at death. Paid reconnaissance can reveal location, defences, population, and estimates or exact amounts of carried Cash, depending on the tier.

Uploaded personal and Crew profile images are publicly accessible to anyone with the image URL as soon as the upload finishes, even before you save the profile. Removing an image tag from profile text does not delete the uploaded file; use the image library’s Remove control to delete it. Uploaded files may retain metadata such as camera or location details, so remove that information before uploading.

Do not put real-world contact details or other sensitive personal information in public text or images. Other people can copy information once it is public, and we cannot control copies made outside the service.

Email addresses, authentication data, friend lists, blocks, reports, feedback, and staff records are not published as profile information. Private messages are shown to the sender and recipient; Crew forums are shown to the relevant Crew members. These messages are stored on our servers and are not end-to-end encrypted. Staff may review reported content or access records when needed for safety, security, legal compliance, or enforcement.

5. Service providers and other disclosures

We use two principal service providers to operate the game:

• Supabase provides authentication, PostgreSQL database services, profile-image storage, realtime features, and authentication email services.
• Netlify provides website hosting, serverless execution, delivery, and infrastructure logging.

These providers process information to operate their services for us, subject to the applicable service terms and data-processing agreements. Their own notices describe their practices. We may also disclose information when required by law, to protect a person or the service, to investigate abuse, or as part of a genuine sale, merger, or transfer of the service. If ownership changes, this policy or a replacement notice will continue to govern the data.

6. Cookies and browser storage

We use necessary Supabase session cookies to keep you signed in and protect authenticated requests, plus verification cookies used by authentication flows. Our password-reset token and permission cookies each last up to 15 minutes and are cleared when used. Blocking authentication cookies prevents sign-in and password recovery from working properly.

When you change interface settings, tfc_theme, tfc_visual_theme, tfc_theme_override, tfc_motion, tfc_density, tfc_season_decor, and tfc_alerts cookies remember brightness, visual theme, motion, density, seasonal decoration and pop-up alert choices for up to one year. You can change them in Settings or clear them in your browser. Your account theme is also saved with your public appearance so other devices can follow it. The theme override keeps a different choice in this browser only.

When you open the game while signed in, our server sets a wr_returning cookie noting that this browser has signed in before, so the sign-in page opens on signing in rather than on guest play. It holds only the value 1, nothing about your account, and lasts up to 400 days.

The Holdings page can save your chosen column order in your browser’s local storage under tfc:holdings-order. It remains there until you change it, clear your browser data, or the application removes it.

While the game is open, pop-up alerts keep a note in this tab’s session storage under wr:alerts: followed by your survivor’s name: when the game last checked, which alerts it has already handled, and how many Epic and Exotic pieces you held. It is kept even with pop-ups switched off, so the Inbox signal stays current; it lets an alert show once, and it is cleared when you close the tab.

A few interface conveniences are kept in this browser’s local storage: your sound and vibration settings (wr:effects), the newest “Since your last visit” note you dismissed (wr:last-visit-dismissed), the latest patch note you read (wr:read-patch-note), the sidebar groups and Timers you folded (wr-nav-folded, wr-timers-folded), and each crafting station’s recipe filter (wr-recipes: followed by the station). They remain until you change them or clear your browser data. This tab’s session storage also keeps the text of unsent forum posts and messages (wr-draft:), the rank you last saw, so a rank-up is announced once (wr:seen-rank: followed by your survivor’s name), and the guest reminders you dismissed (wr:guest-note:); these are cleared when you close the tab.

Navigation shortcuts are stored in this browser under tfc:navigation-shortcuts. They contain only your chosen page links and remain until you change them in Settings or clear your browser data.

The game’s service worker stores a static offline page and app icons in browser Cache Storage under tfc-offline-*. It does not store game pages or API responses, or queue actions to send later. These static files remain until replaced, cleared, or removed by your browser.

We do not currently use advertising cookies, third-party analytics, marketing pixels, or cross-site behavioral tracking.

7. How long we keep information

Retention depends on the record and the reason it exists:

• Public shoutbox posts older than 14 days are removed during routine cleanup; removal is not instant.
• Account and active game data are generally kept while the account exists and while needed to operate the service.
• Character death or rebirth does not delete your account. Account-wide Contracts, rewards, referrals, and commendations can carry across lives. World-ledger entries, published testimonies, and memorials may remain as shared world history, subject to applicable privacy rights.
• Uploaded profile images remain in storage until removed; changing profile text or starting another life does not automatically remove them. Staff may remove images that break the rules.
• A guest account that has not been played for 30 days is removed, with its survivor, its game data and its uploaded images. Shared world records it appears in, such as ledgers and reports other players hold, may remain.
• A message deleted from one inbox is hidden there, not erased from storage, and may remain visible to the other participant. Reported-message snapshots, moderation records, support submissions, security records, and audit trails may be retained as needed to investigate abuse, establish what happened, and protect the service.
• Provider logs, database backups, and recovery copies are kept according to provider and operational schedules, then expire or are overwritten.

An account-deletion request may require review of historical and safety records. Where the law permits or requires it, we may retain limited information for legal obligations, fraud prevention, dispute resolution, or the rights of other players. Public-world history is not a blanket exception to privacy rights.

8. Your choices and privacy rights

Depending on where you live, you may have the right to request access, correction, deletion, restriction, objection, or a portable copy of personal information, and to withdraw consent. You may also complain to the privacy regulator where you live.

California residents may request the categories and specific pieces of personal information we hold, ask us to correct or delete eligible information, and receive equal service for using those rights. We do not sell personal information or share it for cross-context behavioral advertising, so there is no sale or advertising-sharing opt-out to exercise.

You can edit your current profile, remove uploaded images, and change interface settings in the game. The game does not yet provide a self-service account export or deletion control. Send a request to joshua.stroeher@ngpluscreative.com. We may need to verify that you control the account before acting. Limits or exceptions apply only where permitted by law.

9. Children and teenagers

What Remains is not directed to children under 13, and nobody under 13 may create or use an account. If you are under the age of legal majority where you live, use the service only with permission from a parent or guardian.

If you believe a child under 13 has provided personal information, contact joshua.stroeher@ngpluscreative.com. We will investigate and delete the information when required.

10. Security and international processing

We use access controls, row-level database restrictions, encrypted HTTPS connections, secure headers, authentication checks, rate limits, and staff audit records to protect the service. No method of storage or transmission is completely secure, so we cannot promise absolute security. Use a unique password and tell us if you suspect unauthorized access.

Supabase and Netlify may process information in countries other than your own. Where required, we and our providers use recognized legal safeguards for international transfers.

11. Automated game decisions

Game outcomes use configured rules and, in some systems, random rolls. Those automated results can change virtual Cash, items, rank, health, property, or a character’s life. They do not make decisions with legal or similarly significant real-world effects about you.

12. Changes to this policy

The service is in beta and its systems will change. We will update this page when our data practices materially change and revise the effective date above. If a change significantly affects your rights or how information is used, we will provide additional notice where practical or legally required.

13. Contact

Privacy requests, questions, and notices may be sent to Joshua Lee Stroeher at joshua.stroeher@ngpluscreative.com. Signed-in players may also send a private submission through the in-game Feedback page, but email is the public contact route for people who cannot sign in.