What we keep, why we keep it, and what we never do. Last updated 2026-08-17.
Account: your username and email address, held in AWS Cognito, our sign-in provider.
Payments: handled entirely by Stripe. Your card number never touches our servers; we store only Stripe's references (customer and session identifiers) and the amounts, so your treasury balances.
Operations: realm status, player counts (numbers only — never chat or gameplay content), and server logs needed to run and debug the service. Network logs can incidentally include IP addresses.
Contributions: when someone pays tribute to a realm, we store the name and note they chose to attach, the amount, and the Stripe session reference. The name and note appear on that realm's public court page — they are chosen at the moment of contributing, so put there only what you are happy to show.
No advertising trackers, no analytics cookies, no selling or sharing data for marketing. The only browser storage we use holds your sign-in session (AWS Amplify/Cognito tokens) — essential to keep you logged in, nothing else.
We do count visits, from server-side logs that record the page requested, the time, the country the request came from, the referring site, and the browser used. These records never contain your IP address — that field is switched off at the source — they set nothing in your browser, and they are never joined to your account.
Your court page is public to anyone who has its link or address: it shows the realm's name, the war chest's total and goal, the hearth status if you enable it, contributor names and notes as they were given, and — if you hold it — the Founding Steward mark and its founding number.
Housemates: members of a House you join can see your display name, role, join date, and the Founding Steward mark and its founding number if you hold it, plus the name, status, and player count of realms shared with the House and who last woke a shared realm. Leaving a House ends that visibility.
We send transactional email only: receipts for tribute, low-balance warnings, and invitations you ask us to send. Warning and tribute notifications can be switched off in Settings. We do not send marketing email.
Amazon Web Services hosts the entire service (US regions). Stripe processes payments. Both act on our instructions; neither is permitted to use your data for their own purposes.
Account and treasury records are kept while your account is active. World backups are kept so your realm can wake or be restored; you can export your worlds anytime. Server logs are kept on short rotation for operations and debugging.
We keep a rolling backup of our records so they can be recovered after a fault. If you ask us to delete your account, we remove it from our live systems straight away and it rolls out of those backups within 35 days.
If you joined the pre-launch waiting list: we held your email address only to send one opening notice, and the list is deleted as that notice goes out. Nothing from it is kept or joined to an account.
You can ask for a copy of your data, correct it, or have your account and data deleted — write to support@serf.games and we will handle it. This channel serves everyone, including EU/UK residents exercising GDPR rights.
If this policy changes materially we will say so by email or in the app; the date above always reflects the current version.
Privacy questions: support@serf.games.