Privacy Policy

Effective date: 03.07.2026
Website: https://playhalcyon.com
Service: Halcyon-7
Contact: contact@playhalcyon.com

Halcyon-7 is a browser-based 2D social hangout game set on a retro space station. It is built as a small passion project with no advertising, no loot boxes, no premium currency, and no pay-to-win mechanics.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what choices and rights you have.

1. Summary

Halcyon-7 collects only the data needed to run the game, keep accounts secure, provide social features, and moderate public spaces.

In plain language:

• We do not sell your personal data.
• We do not show third-party ads.
• We do not use advertising cookies.
• We do not use loot boxes, premium currency, gambling mechanics, paid gameplay shortcuts, or pay-to-win systems.
• Public chat and public profile details are visible to other players.
• We may log chat, reports, and moderation actions to keep the game safe.
• You can request access, correction, deletion, or export of your personal data.
• Halcyon-7 is designed to keep primary hosting in the European Union.

2. Where data is hosted

Halcyon-7 is designed to keep its primary infrastructure in the European Union.

Current planned hosting regions include Germany and France. Some trusted service providers may process limited data in other locations when needed to provide their services. Where required, we use appropriate safeguards such as data processing agreements and standard contractual protections.

3. What data we collect

3.1 Account data

When you create or use an account, we may collect:

• Email address
• Login provider information, such as a Discord account ID if you choose Discord login
• Account ID
• Login and account creation timestamps
• Account status, such as active, banned, or deleted
• Security and session information

We do not store your raw password in the game database.

3.2 Profile and character data

Halcyon-7 uses one account, one character, and one visible username. We may collect:

• Username
• Character and profile details
• Profile creation date
• Last seen time
• Short profile bio, if you add one
• Avatar appearance and equipped cosmetics
• Credits balance
• Inventory
• In-game purchases made with earned credits
• Badges earned
• Friend requests and accepted friendships
• Blocked users
• Privacy and messaging settings

Your username, avatar, public profile information, badges, public chat, and visible in-game presence may be shown to other players.

3.3 Chat and messages

Halcyon-7 includes public chat and may include direct messages.

We may collect:

• Message text
• Sender and recipient information, where relevant
• Room or conversation context
• Timestamps
• Moderation and safety signals related to messages

Public chat is visible to other players in the same public space. Direct messages are not public, but they are not end-to-end encrypted and may be reviewed if needed for safety, moderation, legal compliance, or support.

Do not share passwords, private addresses, financial information, or other sensitive personal information in Halcyon-7.

3.4 Moderation and safety data

To keep Halcyon-7 safe and manageable, we may collect:

• Player reports
• Report reasons and context
• Mutes, kicks, bans, and related reasons
• Moderation notes
• Safety and abuse-prevention logs
• Records of important account or moderation actions

Moderators and administrators may review this information when needed to enforce rules, investigate abuse, protect users, debug problems, or operate the service.

Some moderation information may be kept confidential. For example, data exports may redact reporter identities, moderator identities, internal notes, or other users' private information where disclosure would compromise safety, confidentiality, or abuse prevention.

3.5 Gameplay and progression data

We may collect data needed to run the game, including:

• Rooms you join while playing
• Gameplay actions needed to operate the service
• Minigame activity and results
• Credits earned
• Items purchased or equipped
• Badges earned
• Seasonal event participation
• Invite-code or access-request activity, where applicable

3.6 Support, contact, and access requests

If you contact us, request access, submit a form, or ask for support, we may collect the information you provide, such as your email address, message, and any related account information needed to respond.

3.7 Technical and security data

When you use Halcyon-7, we may process:

• IP address
• Browser and device information
• Request and connection logs
• Error and crash information
• Rate-limit and anti-abuse information
• Security events
• Session metadata

This data is used to run the service, fix bugs, prevent abuse, secure accounts, and understand whether the game is working.

3.8 Cookies and local storage

Halcyon-7 may use cookies, local storage, or similar browser technologies for:

• Login sessions
• Account security
• Keeping you connected to the game
• Remembering interface preferences
• Basic technical operation

Halcyon-7 does not currently plan to use non-essential tracking cookies, advertising cookies, or third-party behavioral advertising.

If optional analytics, marketing cookies, or similar non-essential technologies are added later, this policy will be updated and consent controls will be added where required.

4. Why we use your data and legal bases

We process personal data only when we have a valid reason to do so.

| Purpose | Examples | Legal basis | | ---------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | Provide the game | Accounts, login, profile, character, inventory, rooms, chat, friends, minigames | Contract | | Keep the service safe | Rate limits, abuse prevention, reports, mutes, bans, safety logs | Legitimate interests | | Moderate public spaces | Chat logs, report context, user lookup, moderation actions | Legitimate interests | | Provide privacy controls | Blocks, message settings, location visibility | Contract and legitimate interests | | Communicate with you | Password reset, account emails, support, privacy requests, important notices | Contract or legitimate interests | | Improve and debug the service | Error logs, crash reports, operational logs | Legitimate interests | | Comply with law | Legal requests, record keeping, abuse investigations | Legal obligation | | Optional future supporter features | Cosmetic donations or supporter badges, if ever added | Contract, legitimate interests, or consent depending on the feature |

Where we rely on legitimate interests, we balance those interests against your rights and freedoms.

5. How long we keep data

We keep personal data only as long as needed for the purposes described above.

Planned retention periods:

| Data type | Retention | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Account, profile, character, inventory, credits, badges, and friends | For as long as your account exists | | Public chat messages | Up to 30 days, unless needed longer for reports, safety, legal reasons, or abuse prevention | | Direct messages | TODO: define retention before launch | | Report and moderation records | As long as reasonably needed for moderation, appeals, safety, and abuse prevention | | Support and access-request messages | TODO: define retention before launch | | Technical logs | Usually short-term, unless needed for security, debugging, or abuse investigations | | Data export files | Temporarily available, then deleted or expired | | Backups | Retained for a limited backup cycle and then overwritten or deleted |

If you request account deletion, some information may be retained where necessary for legal obligations, fraud prevention, safety, moderation integrity, or preventing abuse.

6. Who can see your data

Other players

Other players may see:

• Your username
• Your avatar and equipped cosmetics
• Your public profile bio
• Your badges
• Your public room chat
• Your visible presence in public rooms
• Your online status or room location where the game allows it and your privacy settings permit it
• Direct messages you send to them

Moderators and administrators

Moderators and administrators may access information needed to run and moderate the service, including account status, reports, recent chat or message context, moderation history, safety logs, and relevant account details.

Service providers

We use trusted service providers to operate Halcyon-7, such as providers for hosting, authentication, storage, email, error monitoring, and security.

These providers may process personal data only as needed to provide their services to Halcyon-7.

7. International transfers

Halcyon-7 is designed to keep primary hosting in the European Union.

If personal data is transferred outside the European Economic Area, we will use appropriate safeguards where required, such as:

• Standard Contractual Clauses
• Data Processing Agreements
• Adequacy decisions
• Equivalent lawful transfer mechanisms
• Service provider security and privacy commitments

8. Your privacy rights

Depending on where you live, you may have rights to:

• Be informed about how your personal data is used
• Access your personal data
• Correct inaccurate or incomplete data
• Delete your personal data
• Restrict processing
• Object to processing
• Receive a copy of your data
• Withdraw consent where processing is based on consent
• Complain to a data protection authority

To make a request, email:

contact@playhalcyon.com

We may need to verify your identity before fulfilling a request.

If the operator is established in the EU, add the relevant supervisory authority here before launch.

9. Children and age limits

Halcyon-7 is intended for users who are at least 16 years old, unless a different minimum age is set in the Terms of Service or required by applicable law.

Users under the minimum age must not create an account or use the service.

If you believe a child has created an account without the required permission, contact TODO: privacy@playhalcyon.com and we will review the account.

10. Account deletion

You can request account deletion by emailing:

contact@playhalcyon.com

Account deletion may remove, anonymize, or restrict access to your account, profile, character, and related personal data.

Some information may be retained in limited form where necessary for legal obligations, moderation integrity, safety, abuse prevention, dispute handling, or to preserve the meaning of other users' conversations and reports.

11. Security

We use reasonable technical and organizational measures to protect personal data, including:

• Encrypted connections
• Access controls
• Account authentication
• Short-lived sessions where appropriate
• Rate limits and anti-abuse controls
• Moderator and admin permission checks
• Private storage for sensitive files
• Backups
• Audit and security logs

No online service can be perfectly secure. If you believe you have found a vulnerability, contact:

contact@playhalcyon.com

12. Changes to this policy

We may update this Privacy Policy as Halcyon-7 develops.

If changes are important, we will try to provide reasonable notice, such as by updating the website, showing an in-game notice, or emailing account holders where appropriate.

The latest version will always be available at:

https://playhalcyon.com/privacy

13. Contact

For privacy questions or requests:

contact@playhalcyon.com