Privacy

Last updated: 3 November 2026

Who we are

Ashenfall is run by Ashenfall Studios Limited, Ireland. To ask anything about your data, write to privacy@playashenfall.com.

This website

This website sets no cookies, keeps nothing in your browser, and has no analytics, adverts or trackers. To send you a page our server sees your IP address and what your browser asks for, and keeps neither.

Your account

Your account holds your login name, your e-mail address, when it was made and last signed in to, and whether it is banned or closed. Your password never reaches us: the account site and the launcher turn it into a record that our server checks you against and cannot turn back into your password. We record each sign-in, each failed sign-in and each change to your account, with its time and IP address, to protect accounts and stop abuse. Signing in on the account site sets one cookie, which keeps you signed in for 15 minutes and does nothing else. The launcher keeps a sign-in token in Windows' Credential Manager on your PC for up to 30 days.

In the game

To run the game we keep your characters and what they own and have done, your guild and your friends list, and logs of play: when you log in and out and from which IP address, and events such as trades, item changes and messages shouted to the whole server. We use them to run the game, settle disputes and catch cheating.

Who else handles it

Cloudflare runs our domain's names and sends our e-mails. Its Turnstile checks that a registration or a password reset comes from a person, which gives it your IP address and details of your browser. The game and its updates download from Cloudflare's network, which sees your IP address. Our servers are run by Netcup GmbH in Germany. Cloudflare may handle data outside the EU under its data processing terms. We sell nothing and share nothing else.

How long we keep it

Your account and characters, until you ask us to delete them. IP addresses, in sign-in records and game logs, for 90 days, after which they are erased from them. A registration whose e-mail is not confirmed within 24 hours is deleted. A confirmation link works for 24 hours, a password link for 30 minutes.

Why we may

We use your data to give you the account and the game you signed up for (GDPR Article 6(1)(b)), and to keep them secure and fair (Article 6(1)(f)). You must be at least 16 to make an account.

Your rights

You may ask for a copy of your data, to correct it, to delete your account and its data, to limit or object to how we use it, and to have it in a form you can take elsewhere. Write to privacy@playashenfall.com; we answer within a month. You may also complain to a data protection authority: in Ireland, where we are based, the Data Protection Commission; in Turkey, the KVKK.

Changes

When this page changes, the date at its top changes with it.