Privacy notice
Effective October 20, 2026. Version: 2026-10-20-beta-1.
Who operates the service
Unbought Games LLC operates the official unbought games account service and Orbit Imperium. Contact ethan@unbought.games for privacy questions or requests.
This notice covers our official website, account service, hosted game and support communications. An independently hosted copy of the software has its own operator and privacy practices.
Information we handle
| Information | Why we use it |
|---|---|
| Email, shared username, account identifiers and policy acknowledgment | Create and manage your account, identify you to games and contact you about account actions |
| Password hashes, linked provider identifiers and authentication tokens | Authenticate sign-in, link your chosen sign-in methods and protect sessions |
| Verification/reset requests and email delivery records | Deliver requested account messages, limit abuse and troubleshoot failures |
| Session dates, IP address, browser information and security events | Maintain sign-in, rate-limit requests, investigate abuse and protect the service |
| Gameplay orders, progress, timestamps, coordinates, alliance/community content and reports | Run the shared game world, display authorized information and investigate disputes |
| Support and moderation correspondence | Respond to requests, investigate reports and document decisions |
| Administrator MFA and recovery information, where enrolled | Protect privileged access |
When you choose Google or Discord sign-in, we receive the provider's account identifier, email and verification status, plus profile information returned by that sign-in flow. The app uses your chosen shared username for its player identity instead of automatically publishing a provider's name or avatar. Provider credentials needed for the connection may also be stored. We do not receive your Google or Discord password.
We do not operate advertising, purchased mailing lists or a marketing newsletter in this launch. The current application does not ask for payment-card information, a home address or precise device geolocation.
Purposes and legal bases
We use account and gameplay information to provide the service you request. We use appropriate security and operational information to prevent abuse, maintain reliability and investigate incidents. We also process information when necessary to meet legal obligations or respond to valid legal requests.
Where applicable, the legal bases for these uses are performance of the service contract for necessary account and game operation, legitimate interests in proportionate security and abuse prevention, and compliance with legal obligations. Acknowledging this notice is not blanket consent to every use of data.
If we later introduce optional processing that requires consent, we will explain it and obtain the required choice before starting it. Choosing a social sign-in provider does not enroll you in marketing.
Who receives information
Other players see information permitted by the game's rules, such as your shared username, public rankings, alliance information and visible gameplay events. Your account email and authentication credentials are not public profile fields.
Our service providers process information needed for their functions: AWS for application/database hosting, backups and transactional email; Cloudflare for the public website and DNS; and Zoho for business/support email. Google and Discord process their own sign-in and community services when you use them. Their own notices also apply: Google, Discord, AWS and Cloudflare.
Access by staff or authorized operators is limited to their operational responsibilities. We may disclose information when legally required, to address fraud or safety/security incidents, or as part of a lawful business transfer with appropriate notice and safeguards. We do not sell personal information or share it for targeted advertising in this launch.
Cookies and browser storage
We use functional cookies and browser storage for sign-in, request security and reliable game interactions, including avoiding duplicate commands. Blocking these mechanisms may prevent sign-in or gameplay from working. The current website and app do not include advertising trackers or a third-party product-analytics integration. Google or Discord may use their own cookies when you visit their services; those choices are governed by their notices.
Retention and deletion
We keep account information while needed to operate your account and the shared world, and retain limited records where necessary for security, disputes or legal obligations.
Some short-lived behavior already exists: verification links expire after 24 hours, password-reset links after 30 minutes, and account sign-in sessions after seven days. Expiration prevents use of a credential; it does not necessarily erase every database record at that moment. Email message payloads are cleared by the delivery worker after provider acceptance, a non-retryable provider failure or expiry. Exhausting automatic retries can retain an encrypted payload for possible manual retry until expiry. Limited delivery metadata can remain for troubleshooting.
Current RDS automated backups retain a seven-day recovery window. Separately retained manual snapshots, disaster-recovery copies or historical backups need their own retention decisions; they are not covered by that seven-day statement. When data is removed from active systems, protected backup copies may remain until their retention period ends. If a backup is restored, deletion and session-revocation decisions must be reapplied before the service reopens.
Account closure and deletion requests are handled manually. We will explain any information that must be retained and why. A beta universe reset does not by itself close your shared account or erase every account, security or support record.
Location and safeguards
The current account/game deployment is in the United States, primarily AWS Ohio. Website, email, identity providers and other operational services may process information in other locations. We use encrypted transport, encrypted database storage, scoped access and separate application credentials. No system can guarantee absolute security.
Your choices and requests
You can manage supported sign-in connections and sessions through your account. Contact us to request access, correction, an export, account closure or deletion where applicable. The first release handles requests that lack a self-service control manually; it does not promise a deletion/export button that is not implemented.
Depending on the law that applies to you, you may also have rights to restrict or object to processing, receive portable data, withdraw consent for consent-based uses, and complain to a data-protection authority. We will explain any applicable exception or limitation. We may need proportionate proof that a request concerns your account, but we will not ask you to send a password or recovery code by email.
Game rules and technical abuse controls operate automatically. Moderation decisions can be appealed for human review under the conduct rules.
Age eligibility and changes
The official hosted services are for people aged 18 and over. We ask you to confirm this eligibility when creating or completing an account. Contact us if you believe we hold information about someone who does not meet this requirement.
We will date updates to this notice, explain material changes and obtain any additional choice required before using information for a new purpose.