Privacy

This page is a draft. It says what the game really does today, in plain words, but a lawyer hasn't checked it yet, so it may change before it's final. If something here doesn't match what you see, tell us.

Draft of 8 November 2026.

What we hold

• Your account. Your email address, once you've proved it's yours. A name the game makes up for your account; an account made by a Casper Wallet is named by the wallet's public key instead, and holds a made-up address and a password nobody knows until you add your own. Your password, kept only as a hash that can't be turned back into it. With two-step verification on, your authenticator's key, encrypted, and your recovery codes, kept only as hashes.
• How you sign in. With Google: the number Google uses for your Google account, and from Google, your email address, whether Google has verified it and, for a work or school account, its domain. We don't ask Google for your name, your picture or anything else, and we keep nothing else Google sends us. With a Casper Wallet: its public key.
• The game. Your characters, their items and gold, your Dungeon runs, trades, Marketplace listings, sales and purchases, chests and Season Pass, NFT mints and transfers, your CSPR balance and claims.
• What other players see. Your characters' names, classes and levels, on the leaderboards, the Hall of Rolls, the player search and the list of who's online. Each character's own page also shows its gold, boss kills, deaths and equipped items, your account's total gold and experience, when you joined, and whether you're online. A rare find may be announced to everyone playing. A Marketplace listing shows every signed-in player the seller's character name, wallet public key and account number.
• Chat. The last 100 messages in each channel, which everyone in the channel sees. A message someone reports is kept for the game to read, among the last 500 reports.
• Security records. Each sign-in, failed sign-in and change to how your account is reached, with the time, your IP address and your browser. Changes waiting for your approval, and the emails we sent about them. The server also records the requests that change something, with the same three.

How long we keep it

• Your account, the game's records and the security records: as long as your account exists. When you delete it, see below for what you lose and what the game keeps.
• Links we email: a link to finish signing up lasts a day, a link to reset your password an hour, and a link to prove a new email a day.
• A change that waits for your approval ends after 7 days if nobody answers. A few changes wait 14 days instead, and we email you three times before they go ahead.
• After a wallet leaves an account, its public key stays on that account's records for 7 days, so it can't move straight to another account.

Who else sees it

• SendGrid sends our email, so it gets your email address and the message. We've turned off its link and open tracking.
• Google, only if you choose Continue with Google. Google tells us what's above, and knows you signed in to Ages Below.
• CSPR.click connects your Casper Wallet, on the pages where you connect or sign with it: your wallet page, the page where your wallet confirms it's you, the game, the Marketplace, your Inventory and the Chests. We serve its code from our own site, but it talks to CSPR.click's servers at accounts.cspr.click, sending the browser's own credentials for that site, so they see your wallet's public key and your IP address, and may keep cookies of their own.
• The Casper network. Payments you sign, CSPR the game pays you, and NFTs minted, listed, sold and moved are public on the chain, with your wallet's public key, for good. Nobody can delete them, the game included.
• CSPR.cloud. Our server asks it which NFTs a wallet holds, and about a wallet's staking, by the wallet's public key.
• Have I Been Pwned. When you choose a password, we check it against passwords leaked in data breaches, by sending the first 5 characters of a hash of it. That service never sees your password or your email.
• Google Fonts. When you open the game, your browser connects to Google's font servers, and the Dungeon loads two typefaces from them, so Google sees your IP address.
• Cloudflare carries the site's traffic to our server, so it sees your IP address and the pages you open.

Nobody else. We don't sell or rent what we hold, and we don't share it for advertising.

Cookies and your browser

The site uses only cookies it needs to work. None of ours follow you to other sites; CSPR.click's, above, are its own.

• Your session keeps you signed in for 14 days, renewed while you play.
• Remember this device, if you tick it at the second step, skips the code from your app on this browser for 30 days.
• A mark that this browser has signed in before, so we can email you when a sign-in comes from a browser we haven't seen. It lasts 400 days, and holds nothing about you but a check against your account.
• Short-lived ones for a sign-in, a change or an email in progress, from a minute to a day, and one that stops other sites sending forms in your name.
• In your browser's storage, the game keeps your settings (sound, motion, chat), which tips you've seen, the Dungeon you last chose in its lobby, payments it's waiting to see confirmed on the chain, and the email you typed, so it carries between Sign in and Register in the same tab. The game's art is kept in the browser's cache so it loads faster next time, and CSPR.click keeps the wallet account you last connected.

Taking your data

Your account page has Download your data. It gives you one file, in JSON, with your account and how you sign in, your Casper Wallet's public key, your characters and their items, your balances, your CSPR claims, your NFTs' mints and transfers with their fees, your trades, your Marketplace sales and purchases, your Dungeon runs, and your security activity. It never holds your password, your codes or anything about another player.

Deleting your account

Your account page has Delete your account. It takes 7 days and you can cancel until then, and if your account has an email, we write to you on the first day and the sixth. When it happens, what you lose:

• Your email, your password and your Google sign-in.
• Your link to your Casper Wallet. For 7 days after, that wallet can't be linked to another account.
• Your characters, their items and their gold: nobody can play them again.
• Two-step verification and your recovery codes.
• Your characters' places on the leaderboards, the Hall of Rolls, the player search and their public pages.
• Any CSPR waiting to be claimed: it can't be paid out once the account is gone. Claim it first if you can.

What we clear: your IP address, your browser and your account's name, from your account's security records.

What stays:

• The game's own records of your characters, with the names you chose, and of their items, runs, trades and sales. They're kept without your email, and out of every public list.
• Your wallet's public key stays on the game's records of past trades, sales and payments, as it does on the chain. Nothing else on them says who you are.
• What you wrote in chat, until newer lines push it out: the game keeps the last 100 lines of each channel, and a reported line among the last 500 reports.
• NFTs already in your Casper Wallet. They're yours, on the chain, and nothing here can take them.
• Your email address is free again. You can sign up with it later as a new account, with nothing carried over.

CSPR and NFTs

Today Ages Below runs on the Casper testnet, where CSPR is a test currency. The game never holds your wallet's keys and can't spend from your wallet: everything on the chain asks your wallet to sign, except a CSPR claim, where the game pays you. The Terms say more.

Changes, and reaching us

When this page changes, the date at the top changes with it. To reach us, write to the game's Telegram group, which is also at the foot of every page.