Privacy Policy

1. Who controls your data

Chronyx Studios, operating Sands of Avalon, is the controller of the personal data described in this policy. Privacy requests can be sent to privacy@chronyxstudios.com.

2. Data we process

• Account information: email address, display name, PlayFab player ID, account status, and authentication session. Passwords are transmitted securely to Microsoft PlayFab and are not stored in our website database.
• Alpha access: PlayFab ID, assigned Steam key in encrypted form, assignment time, and claim audit records required to enforce one key per account.
• Playtest feedback: ratings, comments, feature ideas, bug details, playtime, optional system specifications, optional name and email, whether you permit follow-up contact, and your PlayFab ID when you submit while signed in.
• Feedback rewards: PlayFab ID, related feedback record, virtual-currency code and amount, grant status, and grant time required to enforce one reward per account.
• Mobile playtest registration: PlayFab ID and a registration tag stored with your PlayFab player record so we can manage invitations and contact registered testers through their account email.
• Security and technical data: request time, browser-provided request data, IP address received by our hosting provider, and keyed hashes derived from IP address or account email for abuse prevention and rate limiting.
• Communications: information you include when you request account recovery, support, or exercise a privacy right.

3. Why we use it

• To create and operate player accounts and provide requested Alpha access under our contract with you.
• To secure the service, prevent abuse, enforce claim limits, and maintain reliable operations based on our legitimate interests.
• To evaluate Alpha feedback and improve the game based on our legitimate interests in product development.
• To award the advertised one-time feedback reward, prevent duplicate grants, and maintain an audit record under our contract with you and our legitimate interests in operating the Alpha programme.
• To contact you about feedback only when you provide optional permission; you may withdraw that permission at any time.
• To register your requested interest in mobile testing, manage participation, and send mobile playtest invitations to the email linked to your PlayFab account.
• To comply with legal obligations and protect legal rights.

4. Service providers and recipients

We use vetted providers to operate the website and game services:

• Microsoft PlayFab for player identity, account recovery, and virtual-currency balances.
• Vercel for website hosting, delivery, and operational logs.
• Neon, a Databricks company, for the protected website database.
• Google Workspace for operational email delivery.

Steam is an independent third-party service. If you follow a Steam link or activate a key, Valve processes information under its own terms and privacy policy. We do not sell personal data.

5. International transfers

Some providers may process data outside the European Economic Area. Where required, transfers are protected by an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism.

6. Retention

• The essential PlayFab session cookie expires after 12 hours.
• Short-term rate-limit records are automatically removed after no more than seven days.
• Alpha feedback is normally retained for the Alpha programme and no longer than 24 months after collection, unless a longer period is needed for support, safety, or a legal obligation.
• Feedback-reward records are retained while needed to honour the grant, prevent duplicate rewards, resolve disputes, and meet legal obligations.
• Mobile playtest registrations are retained while the mobile testing programme remains active or until you ask us to remove your PlayFab registration tag, subject to legal and security requirements.
• Steam-key assignments and their audit history are retained while needed to honour the assignment, prevent duplicate claims, resolve disputes, and meet legal obligations.
• PlayFab account information remains until the account is deleted or retention is otherwise required by law.

7. Your GDPR rights

Depending on your circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent without affecting earlier lawful processing. We will verify identity before exporting or deleting account data.

You may also complain to the data-protection authority in the EU/EEA country where you live, work, or believe an infringement occurred.

8. Security and automated decisions

We use access controls, encryption, short-lived sessions, request limits, and audit records. No automated decision on this website produces legal or similarly significant effects. No online service can be guaranteed completely secure.

9. Children

The website is not directed to children under 16. Where local law requires parental authorisation for a younger player, a parent or guardian must provide it. Contact us if you believe a child supplied personal data without appropriate authorisation.

10. Changes and contact

We may update this policy as the game and its services evolve. We will update the date above and provide an additional notice when a change materially affects your rights. Questions and rights requests may be sent to privacy@chronyxstudios.com.