Personal Data Processing Policy

1. Whose data we process

• registered users of the site (players);
• site visitors, as far as technical data (IP address, browser details) can identify a person.

2. What data

• Account: username, email address, password (stored only as an Argon2id cryptographic hash; the password itself is not stored), sign-up date, the inviting player if you signed up through a referral link.
• Technical data: IP address, browser and device details (User-Agent), the date and time of sign-ins and account actions.
• Game data: match participation and results, game statistics, rankings, achievements and badges, wardrobe items, in-game marks of ranked runs (graves and candles), recordings of ranked runs.
• Messages: the text sent through the feedback form and the browser details sent with it.

We do not ask for your real name, phone number, date of birth or payment details.

3. Purposes and legal bases

• Signing up, signing in, running the account, the game, the rankings and the profile, service emails (email confirmation, password recovery), replying to messages: the user's consent (Art. 6(1)(1) of Federal Law 152-FZ).
• Security, that is protecting accounts and preventing spam, abuse and unauthorized access attempts: the operator's legitimate interest (Art. 6(1)(7) of 152-FZ).
• Replying to personal data requests: the operator's duties under 152-FZ (Art. 6(1)(2)).

There are no marketing emails; the data is not sold and not used for advertising.

4. Who sees the data

Other registered players signed in to the game see: your username, your character's look (wardrobe items), game statistics, rankings, achievements and badges, the in-game marks of ranked runs (graves and candles). Without signing in, this data is not available. Nobody but the operator sees your email address, IP address or browser details.

5. Who receives the data

• The SMTP.bz service sends service emails on the operator's behalf; it receives the email address and the content of the service email.
• Beget LLC: hosting; the server with the site and the database is located in Russia.

The database is located in Russia. The operator does not entrust processing of personal data to foreign parties and does not transfer it to foreign recipients, except for delivering a service email to the email address the user gave.

6. How long it is kept

• Account and game data: until the account is deleted or the consent is withdrawn.
• Sign-in sessions: valid for 30 days at most, then deleted automatically.
• Account action log: the IP address and browser details are removed from the records after 12 months.
• Links in emails: 24 hours to confirm an email, 1 hour to reset a password.
• Messages: deleted entirely after 12 months.
• Technical server logs (IP address, request address, browser details): limited in size and overwritten automatically as they fill up.
• Database backups: no longer than 90 days. They are not used to run the site, only to recover from failures. The data of a deleted account may remain in backups made before the deletion until those backups are deleted. If the database has to be restored from a backup, deleted accounts are deleted again.

7. Cookies and browser storage

The site uses cookies and browser storage only to work: the sign-in service cookie, the sign-in token, a copy of your own account data (username, email) for a faster start, the language and game settings. There are no analytics counters, advertising cookies or third-party scripts.

8. Data protection

• the connection to the site is encrypted (HTTPS);
• passwords are stored only as Argon2id hashes; sign-in tokens and email links are stored in the database as hashes;
• request rates are limited, with protection against password guessing;
• server management and database access belong to the operator.

9. Your rights

You can find out what data about you is stored, correct it, ask for it to be deleted or withdraw your consent. Write to support@pitlords.com from the email linked to your account. You can change your email and password yourself in your profile. Terms:

• information about your data: within 10 working days, which may be extended by 5 more working days, and we will tell you so;
• correcting inaccurate data: within 7 working days of receiving the supporting information;
• after the consent is withdrawn: processing based on the consent alone stops; the account and its data are deleted within 30 days, except data for which there are other legal grounds.

10. Changes

A new edition of the policy is published on this page and applies from the date stated in it, unless Russian law provides otherwise. If continuing the processing requires a new or additional consent, we will ask for it as the law requires.

11. Operator

Personal data operator: Dmitriy Vadimovich Dzyuman, an individual. Website: pitlords.com. Email for questions and personal data requests: support@pitlords.com.