Privacy Policy

Controller

The controller is Idle Universe Online. Contact: privacy@idleuniverseonline.com.

Account and service data

Email address used for authentication.

Supabase authentication user ID.

Gameplay state, save data, progression, settings, and account display name.

IP address in server, hosting, security, and error logs. Operational logs are intended to be retained for up to 7 days on Fly.io; Sentry event retention is intended to be 30 days.

Browser, device, and user-agent data in Sentry error reports.

Gameplay telemetry

Gameplay telemetry is enabled by default for new users. You can opt out at any time in Settings. It helps IUO understand game starts, tutorial and gameplay checkpoints, limited action categories, session-duration milestones, save-load/sync results, and structured community or feedback prompts. It is first-party data stored by IUO in PostgreSQL; raw gameplay events are not forwarded to Discord.

Telemetry does not include email, display name, Discord ID, IP address or IP hash, full user-agent, full URL, query string, raw referrer, Supabase token, save contents, inventory, typed free text, or arbitrary asset identifiers.

A guest session uses a random session ID only for its current browser session and has no telemetry identifier that persists across sessions. To preserve a campaign’s first-touch attribution through an email magic-link round trip, IUO may store a low-cardinality channel label (for example, a campaign source) on the device for up to 30 days. This label is not a session or account identifier and does not identify a person. If the player signs in during the same session, that session journey becomes technically linkable to the account. It is therefore pseudonymous, not anonymous. IUO does not add email or display name to past events.

Why We Use Data

We process account and gameplay data to provide the game service. This is necessary to perform the service requested by beta players. We process security, anti-fraud, tamper, and error data based on legitimate interest in keeping the closed beta secure, stable, and fair.

Why we use telemetry

We use gameplay telemetry to find broken or confusing gameplay paths, evaluate tutorial and feature outcomes, improve reliability, and produce aggregate product reports. We do not use it to identify players across guest sessions.

Subprocessors and services

IUO uses Supabase in Frankfurt for authentication and database storage, and Fly.io in Frankfurt for the server. Cloudflare provides web delivery, security, and web analytics for overall visits and performance; its processing is separate from IUO gameplay telemetry. Sentry receives error telemetry and sampled replay according to its configuration. Discord is used for community communication and human feedback; it is not the storage destination for raw gameplay events.

Invite requests and processors

For invite requests, IUO uses Supabase for database storage, Cloudflare for web delivery and request handling, and Resend for beta invitation email delivery as processors of the request data.

The legal basis for processing the email address submitted with an invite request is consent. The consent text version is consent-2026-07. Pending invite requests that have not been invited within 12 months are deleted. You may request deletion by contacting privacy@idleuniverseonline.com.

Retention

Raw gameplay telemetry is retained for up to 90 days and purged using the server receipt timestamp, not the client event time. IUO may retain numerical aggregates without identifiers beyond that period, and maintains an anonymized author archive for longitudinal analysis. Gameplay and account data are kept while the account is active. Supabase backups may retain deleted data for up to 7 days. Tamper/security audit events are intended to be retained for no more than 90 days. Sentry event data is intended to be retained for 30 days on the free tier.

When you delete an account, IUO deletes the full telemetry journey for sessions that can be linked to that account, including guest events from those same sessions, before removing the account. A guest session that was never linked to an account cannot be individually located later; opting out prevents future collection and its raw events expire under the 90-day retention period.

Cookies and Local Storage

IUO uses only essential technical storage for login, consent acknowledgement, settings, game operation, your telemetry choice, and a first-touch campaign channel label retained for up to 30 days. No persistent analytics cookie, browser fingerprint, IP hash, or raw user-agent is used for gameplay telemetry.

Your telemetry choice

For new users, limited gameplay telemetry is enabled by default. In Settings, choose "Do not share gameplay events" to stop collection and discard unsent events. You can re-enable collection later by choosing "Keep sharing limited gameplay events". Changing the choice never backfills earlier gameplay.

Your Rights

Depending on applicable law, you may request access, rectification, erasure, portability, objection, or restriction. IUO provides save export, telemetry choice, and account deletion in the account settings. You may also contact the controller by email. EU users may lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

Children

IUO is not intended for users under 16 in the European Union. Do not use the closed beta if you are under 16.

Changes

This policy may change during beta. Material changes will be announced with reasonable notice when possible.