Privacy Policy
Who we are (Data Controller)
The data controller for Coffer & Crypt is Eggon srl, VAT no. 04943770281, registered office at viale dell'Industria 19, 35129 Padova, Italy.
For any privacy request or question, contact us at privacy@eggonemail.com.
Coffer & Crypt is currently in Alpha. This policy may change as the game evolves; the effective date and version above are updated on each material change.
What data we collect
- Account data: email address and nickname (and, for Google sign-in, the email verified by Google). Passwords are stored only as a salted hash, never in clear text.
- Merchant profile: shop name, merchant and shop backstory (optional free text) and the avatar image you upload.
- Gameplay data: your in-game activity (inventory, prices, transactions, reputation, logs) generated while you play.
- Technical data: session identifiers, and standard server logs (e.g. IP address, timestamps) processed to operate and secure the service.
- Two-factor authentication data (only if you turn it on): the secret of your authenticator app, stored encrypted; the public key and identifier of any passkey you register — never a fingerprint or face, which stay on your device and are never sent to us; whether codes by email are enabled; and the hashes of your recovery codes, never the codes themselves. If you tick “remember this device”, we also keep a trusted device record with a label derived from your browser’s user agent (e.g. “Chrome · macOS”) and the dates it was created and last used.
- Analytics data: if you consent, aggregate usage data via Google Analytics 4 (see “Cookies” below).
Why we process it and on what legal basis
- To provide the game and your account — performance of a contract (Art. 6(1)(b) GDPR).
- Security, abuse prevention and service integrity — legitimate interest (Art. 6(1)(f) GDPR).
- Transactional emails (verification, password reset, account notices) — contract / legitimate interest.
- Analytics cookies — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Cookies and similar technologies
We use strictly necessary cookies to run the game; these do not require consent. Analytics cookies load only after you opt in via the consent banner, and you can decline or change your choice at any time (declining removes the analytics cookies).
Necessary (no consent required)
| Name | Purpose | Duration |
|---|---|---|
| coffer_and_crypt_session | Keeps you signed in (login session) | 30 days |
| coffer_and_crypt_session_google_oauth_state | CSRF protection during Google sign-in | 10 minutes |
| coffer_theme | Remembers your chosen visual theme | 1 year |
| cc_cookie_consent (local storage) | Stores your cookie consent choice | Until you clear it |
Analytics (only after consent)
| Name | Purpose | Duration |
|---|---|---|
| _ga | Google Analytics — distinguishes users | ~2 years |
| _ga_<id> | Google Analytics — maintains session state | ~2 years |
Third-party services (processors)
We rely on the following providers to run the service:
- Amazon Web Services (AWS) / CloudFront — hosting, content delivery and storage of avatars and export files.
- Google Analytics (Google Ireland/LLC) — usage analytics, loaded only with your consent, with IP anonymization enabled.
- Google Sign-In (OAuth) — optional authentication.
- Firebase Cloud Messaging (Google) — optional web push notifications, only if you enable them.
- Resend — delivery of transactional emails.
Some providers may process data outside the EU/EEA (e.g. in the United States). Where this happens, transfers are governed by appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
How long we keep your data
- Account and gameplay data: for as long as your account exists. You can delete your account (and export your data) from the account area; deletion removes your personal data, subject to any limited retention required by law.
- Server logs: kept for a limited period for security and troubleshooting.
- Two-factor data: kept while the method is enabled. Remove a method — or turn the second factor off — from Account → Security and the secret, the passkey and the recovery-code hashes are deleted with it. Trusted devices expire on their own after thirty days and can be revoked at any time from Account → Devices.
- Analytics: retained according to the Google Analytics data-retention settings configured for the property.
Your rights
Under the GDPR you have the right to:
- access your personal data and obtain a copy;
- rectify inaccurate data;
- erase your data (“right to be forgotten”);
- restrict or object to processing;
- data portability;
- withdraw consent at any time (e.g. analytics), without affecting prior processing.
To exercise these rights, email privacy@eggonemail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Children
Coffer & Crypt is not directed to children under the age required by applicable law to consent to online services. If you believe a minor has provided us personal data, contact us and we will take appropriate action.
Changes to this policy
We may update this policy as the service evolves. Material changes update the version and effective date shown at the top, and — where required — we will ask for your consent again.