Privacy Policy

Last updated 29 September 2026

This policy explains what personal data Xebeka collects, why, who helps us process it, and what rights you have. We collect only what the game needs. There are no ads, no tracking and no analytics, and we never sell data.

Who is responsible

The controller of your data is akApp Studio. For anything about your data, write to kontakt@xebeka.com.

What we collect

Your account: your email address and your password. The password is stored only in hashed form, so nobody can read it, us included. If you sign in with Google, we receive from Google only your email address and the ID Google uses for your account, instead of a password.
Your characters: their names, sex, world and progress in the game, with the dates they were created and last saved.
Technical data: when you use the site or the game, our providers record your IP address, your browser and the requests it makes, to keep the service secure and to fix problems.
Messages: whatever you write to us by email.

You do not have to give us your email address, but without it we cannot create an account for you.

Why, and on what legal basis

To create and run your account and characters, and to send the emails that come with them: confirming your address, resetting your password, and important notices about your account or the game. This is needed to provide the game you signed up for (Article 6(1)(b) GDPR).
To keep the game secure, prevent abuse and enforce the rules of play. This is our legitimate interest in a safe and fair game (Article 6(1)(f) GDPR).
To answer your messages. This is our legitimate interest in replying (Article 6(1)(f) GDPR).
To keep or hand over data when the law requires it (Article 6(1)(c) GDPR).

We do not send newsletters or marketing email.

What is stored on your device

The site and the game keep a few things in your browser's local storage: your sign-in session, your game settings and window layout, and the game data the game needs while you play. The game cannot work without them, so we do not ask for consent. The forms for creating an account, logging in and resetting a password also run Cloudflare's bot check, which uses only what it needs to tell people from bots. There are no advertising or tracking cookies.

Who processes your data for us

Supabase stores accounts and characters and handles signing in. Our database is in Frankfurt, Germany.
Vercel hosts the website and the game.
Cloudflare checks that the forms for creating an account, logging in and resetting a password are used by people, not bots. For this it looks at technical signals such as your IP address and browser. Cloudflare also uses these signals on its own account to improve the check, as itsTurnstile privacy noticeexplains.
SEOHOST, in Poland, handles our email.
Google, only if you choose to sign in with Google. Your Google account itself is covered by Google's own privacy policy.

Apart from what Cloudflare does on its own account, they process data only on our instructions. Supabase, Vercel and Cloudflare are US companies, so some data may be processed outside the European Economic Area. Those transfers are protected by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

How long we keep it

Account and character data: until your account is deleted, 7 days after you ask, the time you have to change your mind.
A character you delete: 7 days, the time you have to change your mind.
Technical logs: for the short time our providers keep them, usually days to weeks.
Emails: as long as it takes to deal with your matter.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to send it to you in a portable format. You can also object to what we do on the basis of our legitimate interests. Write to kontakt@xebeka.com and we will answer within one month. You can delete your account yourself at any time.

You can complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (uodo.gov.pl), or the authority in the country where you live. If you live outside the European Union, for example in Brazil, you have the rights your own law gives you, and we honour them the same way.

Children

Xebeka is for players aged 13 and over. If we learn that an account belongs to a child under 13, we delete it. A parent who thinks their child has made an account can write to us.

Security

Connections to the site and the game are encrypted, passwords are stored only in hashed form, and each player can reach only their own account and characters.

Changes to this policy

When this policy changes, the new version appears here with a new date, and significant changes are announced on the site.