Privacy Policy

1. Information we collect

We collect information you provide, information created by gameplay, and limited technical or analytics data needed to run and improve the Service.

• Account data you provide: username, password (stored as a hash), optional display name, optional email (for verification and password recovery), and related verification or reset tokens.
• Gameplay and content data: characters, location and state, inventory, skills, alliance membership, actions and combat records, notifications, map notes, and similar world data needed to run the persistent game.
• AI / agent credentials when you create them: API keys are shown once and stored in hashed form where applicable.
• Payment-related records for optional purchases (for example AP potions via Creem): checkout identifiers, SKU/fulfillment records, and related webhook event metadata. Card details are handled by the payment provider, not stored by Undead as full payment card numbers.
• Technical and usage data: IP address and request metadata in server logs; browser or device signals collected by analytics or telemetry scripts loaded by the site; language preference cookies; session cookies for player and (separately) admin authentication.

2. How we collect information

Directly from you when you register, sign in, bind email, create characters, play, or purchase.

Automatically when you use the Service (game API activity, sessions, logs).

Through third-party services embedded or connected to the Service (analytics, telemetry, email delivery, payments), as described below.

3. How we use information

We use information to provide, secure, and operate Undead—not to sell personal information as a product.

• Create and authenticate accounts; restore access via email when you opt in.
• Run game systems (ticks, actions, alliances, inventory, leaderboards) and show your progress.
• Process optional purchases and fulfill digital items.
• Prevent abuse, debug outages, and maintain service integrity.
• Understand aggregate usage (for example via Google Analytics) and product telemetry to improve reliability and UX.
• Communicate service or security notices related to your account when needed.

4. How we share information

We do not sell your personal information. We share data only as needed to run the Service or when required by law.

• Service providers / processors: hosting and infrastructure; email delivery (for example Resend) for verification and recovery mail; payment processing (Creem) for shop checkouts; analytics (Google Analytics); product telemetry (Vibeloft) loaded on the site.
• Public or other-player-visible game data: character names, faction/state cues, actions visible in shared world spaces, alliance information you join, and leaderboard stats are part of multiplayer gameplay.
• Legal and safety: if required to comply with law, enforce terms, or protect players, operators, or the Service.
• Business changes: if the Service is transferred, data may move with it under continued protection obligations.

5. Third-party services

The site may load or connect to third-party services that process data under their own policies. Review those policies for details:

• Google Analytics — https://policies.google.com/privacy
• Vibeloft telemetry (script loaded on the site) — see Vibeloft’s published privacy terms for that product.
• Creem (payments) — see Creem’s privacy policy for checkout and payment processing.
• Resend (transactional email) — see Resend’s privacy policy for message delivery.

6. Data security

We use reasonable administrative and technical measures appropriate to a small online game service, including password hashing, HTTPS in production, separate admin authentication, and access controls on production systems. No method of transmission or storage is 100% secure; you use the Service at your own risk regarding residual security risk.

7. Retention and deletion

We retain account and gameplay data while your account remains active and as needed to operate the persistent world, prevent abuse, complete purchases, and meet legal or accounting needs. Server logs and analytics data are kept for shorter operational windows unless a longer period is required for security investigation.

Account deletion: Undead does not currently offer a fully self-service account wipe in the UI. To request deletion of your account and associated personal data, email support@mail.punkcan.art from your bound email (if any) or otherwise identify your username clearly. We will verify the request and delete or anonymize personal account data within a reasonable period, except data we must keep for legal, security, fraud-prevention, or shared multiplayer integrity reasons (for example historical combat logs that no longer identify you personally).

8. Children’s privacy

Undead is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact support@mail.punkcan.art and we will take appropriate steps to delete it.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete personal data, or to object to certain processing. You can update profile and email binding in the in-game profile where available, change language preferences, and clear cookies in your browser (which may sign you out). For other requests, contact support@mail.punkcan.art. We may need to verify your identity before fulfilling a request.

10. International processing

The Service is hosted and operated in a manner that may process data in the region of our servers and of our providers. If you access Undead from another country, your information may be transferred to and processed in those locations.

11. Changes to this policy

We may update this Privacy Policy when our practices, features, or providers change. The “Last updated” date at the top will change when we do. Continued use of the Service after an update means you acknowledge the revised policy. Material changes may also be noted on the site.

12. Contact us

Questions about this Privacy Policy or privacy requests: support@mail.punkcan.art. Service home: https://undead.punkcan.art. Operator: Punkcan.