Automatically prepared template – a review by a lawyer is recommended before the public launch.
This policy explains which personal data we process in connection with the Veritera Online game and website, why, for how long and what rights you have. Effective from 2026-10-18.
Version: 2026-10-18
1. Data controller
The controller of your personal data is Veritera Online ("Controller", "we").
For data protection matters write to: support@veritera.online. We have not appointed a data protection officer (we are not required to).
Veritera Online is a non-commercial fan project: a Tibia 8.0 style game server and a website with an account, wiki, map, highscores and shop.
2. Which data we process
| Category | Data | Source |
|---|---|---|
| Account | account number, e-mail address, password hash (scrypt – we do not know your password), recovery key hash, encrypted two-factor secret (if you enable it), creation date, account type, shop points | you, at registration and in account settings |
| Characters and game | character names (including name history), level, skills, items, houses, guilds, deaths, play time, online status, house auction bids | created while you play |
| Logins and devices | IP address, login time, device and client installation identifiers (hashes computed by the official client), refused logins (e.g. characters-per-IP limit), failed logins | game client and website at login |
| Website sessions | IP address, browser (User-Agent), session times | website at login |
| CAM recordings | a full record of game sessions: movement, combat, chat, names and messages of other players visible on screen (details in section 4) | game server while you play |
| Anti-cheat | game events (e.g. healing and spell timing, steps, ping), computed indicators and alerts | game server and analyser |
| Bug reports | report text, category, in-game position, screenshot, character, IP address | you, via the bug report form |
| E-mails | e-mail address and message content (codes, verification links, recovery key) | created when you act on your account |
| Purchases (if available) | order, amount, package, transaction id at the payment provider, e-mail address, IP address | you and the payment provider |
| Technical logs and backups | web server logs (IP, page address, browser, time), game server logs, database backups | automatically |
| Cookie consents | random consent id, choice, version, time – no IP, no account | you, in the cookie banner |
We do not collect special categories of data (e.g. health) and do not ask for your name or address. We do not sell data or use it for advertising.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Creating and running your account, the game, characters, houses, guilds, highscores | Art. 6(1)(b) – performance of the contract (Terms) |
| Account e-mails (address verification, password reset, codes, recovery key, security alerts) | Art. 6(1)(b) – performance of the contract |
| Security of accounts and the server: login logs, lockouts after failed attempts, two-factor authentication, characters-per-IP limit, detection of unofficial clients | Art. 6(1)(f) – legitimate interest (protecting the service and players) |
| Anti-cheat (detecting bots and cheating) and enforcing the Terms | Art. 6(1)(f) – legitimate interest (fair play) |
| CAM recordings: reviewing reports, evidence of violations, watching your own sessions, sharing | Art. 6(1)(b) (game feature) and (f) (security, dispute resolution) |
| Handling bug reports, complaints and requests | Art. 6(1)(b) and (f) |
| Point purchases (if available): fulfilment, accounting, complaints | Art. 6(1)(b); (c) – legal obligations (e.g. tax, consumer protection) |
| Backups and technical logs | Art. 6(1)(f) – continuity and security of the service |
| Non-essential cookies and browser storage, external players | Art. 6(1)(a) – consent (you can withdraw it at any time) |
| Proof of cookie consent | Art. 6(1)(c) in connection with Art. 7(1) GDPR |
Giving your e-mail address and password is voluntary, but without them you cannot create an account. Where we rely on legitimate interest, you may object (section 9).
4. CAM recordings
The server automatically records game sessions (the CAM system). A recording is the data exchanged between the server and the client, from which the game screen can be replayed.
- What is recorded: movement, combat, items, channel messages and the player's private messages, as well as the character names, outfits and messages of other players who were on screen. The login packet with the password is never stored.
- Where: on the game server (hosting in Poland). Recordings are not downloaded to players' computers – watching happens in the client's memory.
- Who has access: the account owner (own recordings), the server staff (reviewing reports and violations) and people you share a recording with.
- Sharing: you can share a recording with chosen players or mark it as public (the "Public" list in the game). When others watch, we cut out private messages and private channels; character names and public channel messages remain visible. You can withdraw a share at any time.
- Recordings showing your character may also exist on other players' accounts (if you were on their screen). If another player shares or publishes such a recording and you object, write to us – we will consider your objection and can disable public access.
- Retention: [DO DECYZJI – proposed 30 days from recording, then automatic deletion; recordings secured as evidence in a violation case – until the case is closed]. Until this is decided, recordings are deleted manually by the staff.
- Deletion: you can ask for your recordings to be deleted or a public share to be withdrawn by writing to the address in section 1 (give your account number or character name).
- Legal basis: performance of the contract (game feature, Art. 6(1)(b)) and our legitimate interest – security, fraud detection and handling reports (Art. 6(1)(f)).
5. Anti-cheat, profiling and decisions
To detect bots and other unfair programs, the server stores selected game events (e.g. reaction times when healing, spell casting, steps, network delay), and an analyser computes indicators of similarity to automated play and creates alerts for the staff. This is profiling within the meaning of Art. 4(4) GDPR, based on our legitimate interest (fair play for everyone).
We do not take decisions based solely on automated processing (Art. 22 GDPR). The analyser result is only a hint – every alert is checked by a human staff member before any action (e.g. a warning or a ban). You can appeal any sanction (Terms).
Device identifiers are used to enforce the multi-client (MC) rules and the characters-per-IP limit and to recognise the official client.
6. How long we keep data
| Data | Period |
|---|---|
| Account and characters | until the account is deleted; you delete a character yourself (with a 30-day delay in case of mistakes) |
| Website sessions (IP, browser) | until logout or session expiry (up to 7 days, admin panel up to 12 hours) |
| Game login and device logs | [DO DECYZJI – proposed 12 months] |
| Failed website logins | until a successful login or the end of the lockout |
| Staff action log (IP, action) | [DO DECYZJI – proposed 24 months] |
| CAM recordings | [DO DECYZJI – proposed 30 days] (section 4) |
| Anti-cheat events and indicators | [DO DECYZJI – proposed: events 90 days, indicators and alerts 12 months; data in violation cases until the case is closed] |
| Bug reports | until resolved, then [DO DECYZJI – proposed 12 months] |
| E-mail queue | the content (code, link, key) is deleted right after sending or expiry; the delivery record up to 90 days |
| Orders and payments (if available) | 5 years from the end of the tax year (tax and accounting obligations) |
| Web server logs | 30 days (automatic rotation) |
| Database backups | 14 days (a backup every 6 hours, automatic deletion) |
| Cookie consent log | 3 years from giving or withdrawing consent |
| Acceptance of the Terms and Policy | for the life of the account and up to 3 years after its deletion (proof of the contract) |
After the period ends we delete or anonymise the data. Data from a deleted account may remain in backups for up to 14 more days.
7. Recipients and processors
- Hosting: ZINET (Łódź, Polska) – the server running the game, website, database and backups (data processing agreement).
- Google Ireland Ltd / Google LLC (Gmail, SMTP server) – sending e-mails to you. Data may be transferred to the USA (section 8).
- Payment providers (if purchases are available) – e.g. [NAZWA OPERATORA PŁATNOŚCI]: processing payments, as independent controllers of payment data.
- Streaming platforms (Twitch, YouTube, Kick) – only if you start a player on the streams page yourself; from then on the platform collects data (e.g. IP, cookies) as an independent controller.
- Other players – data that is public by the nature of the game: character name, level, vocation, guild, deaths, highscores, house, online status; CAM recordings you share.
- Public authorities – only where required by law.
8. Transfers outside the EEA
The server and database are in Poland. E-mails are sent through Gmail (Google), so your e-mail address and the message content may reach the USA. Google LLC participates in the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and also uses standard contractual clauses approved by the Commission. You can get a copy of the safeguards by writing to us.
9. Your rights
- access to your data and a copy of it (Art. 15),
- rectification (Art. 16) – you can change your e-mail address yourself in the account settings,
- erasure (Art. 17) – e.g. deleting the account, characters, recordings,
- restriction of processing (Art. 18),
- data portability (Art. 20) – account and character data in an electronic format,
- objection to processing based on legitimate interest, including anti-cheat profiling (Art. 21),
- withdrawing consent at any time (Art. 7(3)) – for cookies via the "Cookie settings" link in the site footer; withdrawal does not affect the lawfulness of earlier processing.
Send requests to support@veritera.online from the address linked to your account (or give your account number and character name). We will answer without undue delay, at the latest within one month. We may ask you to confirm your identity so that we do not disclose data to an unauthorised person.
10. Complaint to the supervisory authority
You have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl (the Polish data protection authority).
11. Minimum age
The game and website may be used by people aged 16 or over. A younger person may create an account only with the consent of a parent or legal guardian (Art. 8 GDPR), who accepts the Terms and this Policy on their behalf. At registration you confirm your age or the guardian’s consent.
If we learn that an account belongs to a person under 16 without a guardian's consent, we may block it and delete the data. A guardian can ask for the child's account to be deleted at any time.
12. Security
- passwords are stored only as hashes (scrypt), the recovery key as a hash, the two-factor secret encrypted,
- lockouts after failed logins, optional two-factor authentication (TOTP), e-mail security alerts,
- server access by SSH key only, firewall, security updates, database reachable only locally,
- encrypted connections to the website (HTTPS) – [DO WDROŻENIA: the website currently runs without HTTPS],
- limited staff access to data (only as needed to run the game and handle reports), a log of staff actions,
- backups every 6 hours.
We never ask for your password or recovery key – neither in the game nor by e-mail.
14. Changes to this policy
We may change this policy, e.g. when game features or the law change. We will announce significant changes on the website, and logged-in players will see the new version to accept. Previous versions are available on request.
Change log
- 2026-10-18 – The service and the controller were renamed from "Vetera Online" to "Veritera Online"; new contact address support@veritera.online.
- 2026-10-17 – First version of the privacy policy.