Privacy Policy

Last updated: 30 August 2026 · Data controller: Oleksii Rotar

1. Who we are

This policy explains how Oleksii Rotar ("we", "us") handles your personal data when you use the Alerot Studio website, the Abyss Floors account portal, and the Abyss Floors game. We are the data controller. Abyss Floors is currently in an alpha test.

We have written this policy to describe what our systems actually do, rather than to cover every possibility. Where something does not exist yet, we say so.

2. What we collect

  • Account data — your email address and your password, which is stored only as a cryptographic hash and never in a form we can read or recover. We also store whether your email has been confirmed, and counters used to lock an account temporarily after repeated failed sign-in attempts. If you link Steam, we store your numeric Steam ID and the fact that the account is linked. We do not retrieve or store your Steam profile, display name, avatar, or friends list.
  • Your choices at sign-up — whether you ticked the optional updates box. We no longer ask for alpha access; accounts created during the earlier invite-only period still carry the request they made then, and we still store it.
  • Gameplay data — your characters and their names, progress, inventory and items, in-game currency, market and trading activity, clan membership, and similar records created by playing. This is tied to your account.
  • Private messages — see section 7, which describes exactly what is stored and for how long.
  • Technical data — your IP address and basic request information. We use these to sign you in, to apply rate limits, and to detect and stop abuse. Section 9 explains where IP addresses end up and for how long.
  • Visitor statistics — see section 6. These are deliberately designed so that they are not linked to you or to your account.
  • Support messages — anything you send us by email.

We do not ask for, and do not intentionally collect, special categories of data such as health, biometric or political data. We do not ask for your real name, postal address, date of birth, or phone number.

3. How we use your data

  • To create and operate your account and sign you in.
  • To run the game — to save your characters and progress, and to provide a shared, server-authoritative world and economy.
  • To keep accounts and the service secure: confirming that you own your email address, letting you reset a password, applying rate limits, blocking abusive traffic, and detecting cheating and fraud.
  • To send you essential service emails. There are exactly three: confirm your email address, reset your password, and — for accounts that asked for alpha access during the earlier invite-only period — a message telling them that access has been granted. We no longer send that third message to new accounts.
  • To understand, in aggregate, how many people visit the website (section 6).
  • To fix problems, and to comply with our legal obligations.

We have not sent any marketing or newsletter emails. The sign-up form offers an optional updates box; if you ticked it, we have recorded that preference and nothing more. If we ever begin sending such emails, we will include a one-click unsubscribe link in every one. You can withdraw the preference at any time by emailing us (section 15) and we will clear it.

We do not sell your personal data, and we do not use it for advertising or profiling.

4. Legal bases (GDPR / UK GDPR)

  • Performance of a contract — to provide the account and the game you asked for.
  • Legitimate interests — to keep the service secure and available, to prevent abuse, cheating and fraud, and to measure website visits in a way that does not identify anyone. We have weighed these against your rights, which is why, for example, our visitor statistics are designed so that they cannot be traced back to a person.
  • Consent — for the optional updates preference, which you can withdraw at any time.
  • Legal obligation — where the law requires us to keep or disclose something.

5. Cookies and browser storage

We set three cookies, all strictly necessary, and no advertising, analytics or third-party cookies of any kind. Because all three are strictly necessary for a service you asked for, no consent banner is required.

  • Sign-in cookie — keeps you signed in. Expires after 8 hours of inactivity.
  • Steam sign-in cookie — a short-lived cookie that exists only while you are being redirected to Steam and back. Expires after 10 minutes.
  • Security-token cookie — protects forms against cross-site request forgery. Expires when you close your browser.

All three are marked Secure and HttpOnly, so they are only ever sent over an encrypted connection and cannot be read by scripts in your browser.

The game client additionally uses two values in your browser's per-tab session storage: a one-time token used to hand you from the website into the game, and a token that lets you rejoin your session if your connection drops. Both are cleared when you close the tab, and neither is sent to anyone but us.

Our website loads no third-party content and makes no third-party requests. There are no external fonts, scripts, analytics tags, embedded videos or advertising networks. Your browser is instructed to enforce this with a Content-Security-Policy, so it is not merely a promise. Links to Steam are ordinary links that only contact Steam if you click them, and they pass no information about you when you do.

6. Visitor statistics

We count how many people visit the website each day. We do this without cookies and without storing anything that identifies you, as follows.

When a page is served, your IP address and browser user-agent are combined with a secret that changes every day and converted into an irreversible hash. We store only that hash and a daily count. Your IP address and user-agent are never written to our analytics database — they exist only for the instant the hash is computed. Because the secret changes daily, the same visitor produces a different hash tomorrow, so we cannot follow anyone across days, build a profile, or connect a visit to an account. What we can see is "how many distinct visitors did the site have on this day", and nothing more granular than that.

These statistics are visible only to us. They are not shared with anyone, and no third-party analytics service is involved. Requests that identify themselves as bots or crawlers are excluded.

7. Chat and private messages

Different kinds of message are treated differently, and we want to be precise about it:

  • Public chat (global, zone and clan channels) is not stored. It is delivered to the players who are online and then gone.
  • Private messages (whispers) are stored on our servers, so that a conversation survives you reconnecting. We keep them for 7 days, and a maximum of the most recent 5,000 messages per character. A whisper sent to a player who is offline is held for up to 30 days so it can be delivered when they return, and is deleted once delivered.
  • Our operational logs never contain message text — of any kind, public or private. They record only that a message was sent, on which channel, by whom, and how many characters long it was. This is enforced in the code itself.

8. Who we share it with

We do not sell your personal data. We share it only where necessary to run the service:

  • netcup GmbH (hosting) — our servers and database run on their infrastructure, in Germany. They do not use your data for their own purposes.
  • Brevo (email delivery) — receives your email address and the contents of the three service emails listed in section 3, in order to deliver them. Nothing else about you is sent to Brevo.
  • Steam (Valve Corporation) — only if you choose to sign in with or link Steam. We exchange the minimum needed to verify that you control that Steam account, and we receive your numeric Steam ID in return. We do not send Valve anything about your Abyss Floors account, and we do not request your Steam profile.
  • Authorities — where we are legally required to, or where it is necessary to protect our rights, our players, or the security of the game.

There is no payment processor, because there is currently no way to buy anything. We take no payments and hold no payment or card data of any kind. If that changes, this policy will change first.

9. How long we keep it

  • Account and gameplay data — for as long as your account exists. See section 11 for deletion.
  • Private messages — 7 days, or up to 30 days if undelivered (section 7). Deleted automatically.
  • Sign-in and hand-off tokens — these expire within minutes and are deleted automatically once used or expired.
  • Server logs — our application logs roll over and we keep only the most recent files, so they cover roughly the last few days to weeks depending on activity. They may contain IP addresses and character names. They never contain passwords, authentication tokens, password-reset links or message text; these are excluded structurally, not by convention.
  • Blocked addresses — if an IP address is blocked for abuse, that address is kept until the block is lifted.
  • Backups — database backups are kept for 14 days and then deleted.
  • Visitor statistics — the daily hashes described in section 6 are currently retained indefinitely. They contain no identifier that can be linked to you or to any account, and they cannot be linked across days.

10. How we protect it

  • All traffic is encrypted in transit with TLS.
  • Passwords are stored using industry-standard, deliberately slow password hashing, designed so that even we cannot recover them.
  • The database is not reachable from the internet. Only the web server is exposed; everything else is reachable only from inside the server itself.
  • Administrative interfaces are not published to the internet at all and require a separate credential.
  • We apply layered rate limits to sign-in attempts and connections to make brute-force and abuse impractical.
  • Logs are automatically stripped of passwords, tokens, reset links and API keys.
  • Changing your password immediately invalidates your other active sessions.

No online service can be completely secure, but we work to keep the risk low and to respond promptly to any incident.

11. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you, and receive a copy;
  • correct data that is inaccurate or incomplete;
  • have your data deleted;
  • restrict or object to certain processing;
  • receive your data in a portable form; and
  • withdraw consent where we rely on it.

How deletion works today, stated honestly: we do not yet have a self-service "delete my account" button. If you ask us to delete your account, we will do it manually and confirm when it is done. We aim to complete requests within 30 days, which is the period the GDPR allows. Some records may be kept where the law requires it. We are building a self-service option, and this section will be updated when it exists.

To exercise any of these rights, email privacy@alerotstudio.com. You also have the right to complain to your local data-protection authority.

12. International transfers

Your account, gameplay and message data is stored on servers in Germany, and our email provider is based in the European Union. If you choose to use Steam sign-in, that verification involves Valve Corporation, which is based in the United States; this happens only if you use Steam, and only to confirm that you control that Steam account. Where data is transferred outside your region, we rely on appropriate safeguards.

13. Children

Abyss Floors is not intended for children under 13, and you must be at least 13 to create an account. We do not ask for your age and we do not verify it, so this is a condition of use rather than something we check. In some countries a parent's consent is required for anyone under 16 to use a service like this. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

If we change how we handle data, we will update this page and the "Last updated" date above. For significant changes — for example, if we introduce purchases or begin sending newsletters — we will say so clearly rather than quietly editing the text.

15. Contact

For any privacy question or request, email privacy@alerotstudio.com. For help with your account or the game, email support@alerotstudio.com.

Oleksii Rotar · Rejeb Nidzharadze 17, Batumi, Georgia