All Shall Fall
This policy explains what personal data the game All Shall Fall (https://allshallfall.io) processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). We collect as little as possible.
1. Playing without an account
You can play without an account. Then we store nothing about you on our server. To run a multiplayer game, the server temporarily keeps in memory the name you entered and your IP address (to limit abuse, e.g. one player joining the same game many times). This disappears when the game ends. Technical server logs (errors, refused connections) may contain an IP address and are deleted after 14 days at the latest. Legal basis: our legitimate interest in running the game securely (Art. 6(1)(f) GDPR).
2. Player account (optional)
| Data | Why | How long |
|---|---|---|
| E-mail address | Confirming the account, password reset, security notices (e.g. "your password was changed"). Never shown to other players, never used for marketing, never sold or shared. | Until you delete the account, or after 3 years without logging in (you get a warning e-mail 30 days before). Registrations that were never confirmed are deleted after 7 days. |
| Nickname | Your name in the game, reserved so nobody else can play under it. Visible to other players. | |
| Password | Logging in. Stored only as a one-way hash (scrypt) – nobody, including us, can read it. | |
| Dates of registration, e-mail confirmation, last login, password/nickname change, accepted policy version | Security, deleting inactive accounts, proving which policy you accepted. | Same as the account. |
| Discord account – only if you connect it: Discord user ID and username, time of connecting and of the membership check | Checking that you are a member of our Discord server and giving you the reward for it. Shown only to you. | Until you disconnect Discord or delete the account. |
| Login sessions (random identifier, creation and last-use time) | Keeping you logged in. | 30 days after last use (max. 180 days), or until you log out. |
When you connect Discord, we ask Discord only who you are and whether you are a member of our server (permissions identify and guilds.members.read). We never get your Discord password, e-mail, messages or friends, and we do not keep the access token – it is revoked right after the check. So the reward cannot be claimed twice, we keep a one-way fingerprint (keyed hash) of Discord accounts that already received it; it cannot be turned back into a Discord ID.
Encrypted backups of the account database are kept for at most 30 days, so a deleted account disappears from them within 30 days as well.
Legal basis: providing the account you asked for (Art. 6(1)(b) GDPR) and securing it (Art. 6(1)(f)). We do not store IP addresses, chat messages or payment data with your account. There is no profiling and no automated decision-making.
3. Security
All traffic is encrypted (HTTPS). E-mail addresses are stored encrypted (AES-256-GCM) and the key is kept separately from the database. Passwords are hashed with scrypt. Login attempts are rate-limited. Links in our e-mails are single-use and expire after 1–48 hours.
4. Who else processes the data
- Hosting: OVH SAS (Roubaix, France) – runs our server.
- E-mail delivery: Cloudflare, Inc. (USA) – sends our account e-mails on our behalf.
All of them process data only on our instructions under a data processing agreement. Cloudflare is a US company; transfers of data to it are protected by its certification under the EU-US Data Privacy Framework and by the EU Standard Contractual Clauses. Nobody else gets your data unless the law requires it.
Discord (Discord Inc., USA) is involved only if you choose to connect your Discord account: you log in on Discord's own page and Discord's privacy policy applies to your Discord account.
5. Cookies
Logging in sets one cookie that contains only a random login identifier. It is strictly necessary for the account to work, so it does not need consent. It disappears when you log out. Analytics cookies (Google Analytics) are used only if you allow them in the cookie bar of the game – you can change that choice any time with "Cookie Settings" at the bottom of the main page. If you play the game embedded on another website (e.g. y8.com), that website's own privacy policy applies to what it collects.
6. Your rights
You can at any time:
- see and download your data – "Download my data" in your account (Art. 15 and 20 GDPR),
- correct it – change your nickname, e-mail or password in your account (Art. 16),
- delete it – "Delete account" removes everything immediately and permanently (Art. 17),
- ask us to restrict processing or object to it (Art. 18 and 21) – write to support@allshallfall.io.
We answer requests within one month. You also have the right to lodge a complaint with a supervisory authority – in the Czech Republic it is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz), or the authority in your EU country.
7. Age
You must be at least 15 years old to create an account. If you are younger, you can still play as a guest without an account.
8. Changes
If this policy changes in an important way, we will tell account holders by e-mail before the change takes effect. The version date is at the top of this page.
9. Who is responsible
Data controller: Michal Balcar.
Contact for anything about your data: support@allshallfall.io. You can also reach us on our Discord server, but please send requests about your personal data by e-mail.