The site is run by its operator, named here before the site opens, who decides what is kept and answers for it under the EU General Data Protection Regulation. Write to the contact address, published here before the site opens about anything on this page.

Without an account

Reading the site, flying the world and watching a fight need no account, and nothing is kept about you. The site counts how often each page is opened and how many people visit a day, and where they came from (the referring site's name, such as reddit.com). To tell today's visitors apart it makes a one-way code out of your network address, your browser's name and a random value that changes every day; the address itself is not stored, and at the end of the day the random value and the codes are deleted, so after that nobody — us included — can link a visit to you. What stays is a number per day. There is no analytics service, no advertising and no tracking cookie.

Your browser keeps a few settings of its own (the theme, the graphics level, what the world view shows) in its local storage; they never reach the server.

With an account

• Your e-mail address and your password — the address to sign in with and to know a request about the account is yours; the password only as a salted scrypt hash, which cannot be turned back into it.
• The name you choose, and your characters with their names, builds and upgrades — shown to other players in the rooms, the fights and the boards.
• Your fights' results — each duel and deathmatch round you play, with the characters in it, because your upgrades are given from them and your history is shown from them.
• The days you were signed in (a date, not a time) — to see whether people come back after their first day; deleted with the account.
• A session cookie (srocodex_session) that keeps you signed in for up to 30 days, and one (srocodex_preview) for the preview characters you try items on, which ends with the browser session. Both are needed for the site to work, so no consent banner asks for them.

The legal ground is the agreement you make by signing up: the account cannot work without these.

What is held briefly

• Your network address, in memory only and never written down, for as long as a limit on sign-ins, sign-ups and fight requests needs it — at most a day — to stop password guessing and floods. A restart of the site forgets it.
• The day's visitor code described above, until the day ends, and when you last opened a page, for at most an hour — to show how many people are on the site right now.
• When a page breaks, the error, the page's path and your browser's name (for example “Safari on iPhone”) — with no address and no account — to find and fix it. The log keeps the latest 20 MB or so and drops what is older.
• When your browser reports a blocked script or style, the page address and what was blocked are kept, with nothing about who sent it, to find what the site itself breaks.

For how long

The account and everything on it stays until you delete it. Delete it yourself under Account → Delete the account: the account, its characters and their upgrades go at once; a duel or round somebody else fought against you keeps its result, with your name in it replaced by “deleted”. A nightly copy of the site's data is kept for fourteen days and one a week for eight weeks after, so a deleted account is gone from those too within about ten weeks.

Who else sees it

Nobody is sold or given your data. It lives on the site's own server; the nightly copy is stored with a storage provider, encrypted in transit. Nothing is sent anywhere else.

Your rights

You may ask for a copy of what is kept about you, have it corrected or deleted, object to its use, or take it elsewhere — write to the contact address, published here before the site opens from the address you signed up with. You may also complain to your data protection authority; in Lithuania that is the State Data Protection Inspectorate (vdai.lrv.lt).

Accounts are for people of 14 and over (the age Lithuanian law sets for agreeing to this on your own).