Privacy and your data

Site and shared-chat counts

We use a first-party random browser cookie to count daily site visitors and returns on later days. Our database stores only a hash of that random value and the UTC days seen; it does not store an IP address, page URL, or browser details for these counts. The cookie expires after 90 days, and these count records are deleted after 90 days without a visit. Blocking or clearing cookies may make the counts less accurate.

For the staff dashboard, we also keep the last time a signed-in member used the Colossari website, so we can show a count active in the past ten minutes. Plugin activity on exchanges does not count as a Colossari website visit. A verified chat embed records only its exchange ID and first and most recent load times, so staff can see which approved exchanges are using the shared room; it does not send chat visitors’ exchange usernames or email addresses for this count.

Improving signup

We record anonymous signup steps: opening a promotion or registration page, following its Join button, submitting the form, a fixed error category and a completed account. A random value in the necessary browser session connects these steps; only its keyed hash is stored in these count records. A short-lived signed Join link carries this anonymous value when a traffic exchange frame cannot use Colossari cookies.

These records can include the Colossari promotion type, an approved exchange’s public domain or verified plugin exchange ID, and a broad browser or automated-request classification. They do not contain names, email addresses, passwords, IP addresses, full page URLs, raw browser details or account IDs. Authorized staff see aggregate reports. Activity older than 30 days is removed through bounded cleanup; inactive sites may complete cleanup on their next visit. These observations are not a count of verified people and cannot reconstruct earlier signup journeys. Existing account and security records are separate.

Account and private records

We store your sign-in username, public display name, email, optional first and last names, hashed password, verification and security records, preferences and linked exchange accounts. Display names are used in public play; sign-in usernames are intended for login and staff account administration. Passwords are stored as hashes, not readable passwords.

Activity records include credited views, strikes, damage, XP, ichor, gear, rankings, badges, titles, event progress and claims. Purchase records include invoice references, processor identifiers, amount, status, funding source, subscription terms, refunds and commissions. Payout records include your selected Skrill or Wise payout email and payout history. Historical records may retain an earlier PayPal destination for reconciliation; that address is not automatically reused for another provider. Any bank details Wise requests are provided directly to Wise, not entered in Colossari. Support messages and attached images are stored so staff can investigate requests.

Your Captain’s Log contains exchange links and private notes. Do not store exchange passwords, payment credentials or other sensitive secrets in notes. Profile messages, styles and saved settings are also stored. Private records are accessible to authorized staff where needed for support, security or financial administration; they are not public leaderboard data.

Exchange plugin reports and access

The exchange’s plugin sends limited validated activity, including a per-exchange hashed member handle, credited-view/strike information and integration status. Supported LFMTE reports also include a numeric exchange member ID for connected-account referral links. That ID is saved on a linked account’s connection; its automatic referral use can be overridden or disabled in the Downline Builder’s My referral IDs section. Ordinary reports do not send exchange passwords, member email lists or full database copies.

Connection and invitation records can include a signed invitation’s first opening, Colossari signup, connection and first credited surf. These use hashed exchange handles and Colossari IDs. Owners see activity and reports for their own exchanges. They are not verified customer-sale reports or a record of unrelated browsing.

The PHP plugin runs with the exchange hosting account’s permissions. Setup and updates can read local configuration and write integration settings. Colossari does not claim this is a sandbox or zero-access integration. Updated ordinary surfing does not scan ASR promotion tables or files, and new automatic cross-promo schedule reports are no longer accepted. Previously earned awards and historical records remain.

Reports use HTTPS for encryption in transit and signatures to verify their source. Signatures are not encryption. Colossari can read and process received reports; stored records are not end-to-end encrypted against Colossari.

Downline Builder referral links

Saved or supported connected exchange referral IDs are used in public share links. New-account discovery links prefer the shared builder’s member or your existing Colossari referrer. When no usable ID is available, a verified active member who opted into the equal-share rotation may be shown. Rotation is off by default and can be disabled in My referral IDs.

Before leaving, you can see the public display name of the member whose referral link is offered. Existing linked accounts open directly. Each exchange decides its own referral credit; this does not change an existing exchange referrer or your Colossari signup referrer.

We store the referral beneficiary, destination exchange, link source, opening time and an opaque deduplication value when you confirm a referral link. This click record does not contain the visitor’s Colossari ID, IP address or browsing history. Members see counts for their own links, not visitor identities or unverified signup claims. Short-lived offers are kept in the necessary browser session. These records are separate from ordinary server security logs and Colossari commissions.

Security, cookies and fair play

We record signup and recent sign-in IP addresses, sign-in attempts, session and trusted-device records, presence-check times and review flags to protect accounts and investigate abuse. A flag or shared connection alone is not proof of cheating. Necessary session cookies and stored preferences support login, security and display choices; disabling them may prevent those features working.

Payment, account and support pages require appropriate access. We use restricted staff permissions and protected backups, but cannot promise that any online service has zero security risk. Do not include secrets in public profiles, messages, URLs or support screenshots.

Public game information and expeditions

Public pages may show your display name, avatar, level, ranks, badges, titles, crew, strikes, lifetime statistics and tournament placings. An exchange’s name, public URL, promotional images, expedition hosts, dates, goals, prize terms and combined progress can also be public.

Expedition claims and host-credit vouchers require member and host identifiers and progress records. Authorized hosts can see the information needed to honor their own offers. Colossari does not automatically write those credits into a partner’s member database. Personal email addresses, payout destinations and private notes are not intended for public game displays.

Payment, email, hosting and avatar services

Stripe handles card payments and monthly billing. Skrill and Wise handle the available manual payout transfers. Historical payment and payout records may include PayPal or another earlier method. These providers receive information needed to process the relevant transaction under their own privacy policies. Colossari does not store full card numbers or card security codes; card entry is handled by the payment provider.

Hosting and email-delivery services process the records or messages needed to provide those services. Providers may process data outside your province or country under the laws applying there. We do not sell or rent personal records to advertisers.

Optional Gravatar images are fetched by Colossari’s server and served through our domain, so the image request does not send your browser directly to Gravatar. Gravatar receives an email-derived hash from our server. The avatar URL also contains that hash; hashing is not encryption and does not guarantee anonymity. Turn Gravatar off in Account if you prefer the display-name initial.

Colossari Lookout extension

Lookout fetches the public Colossari news, event and tournament feed without sending your Colossari login cookies. It stores cached public updates, selected filters, reminder preferences and seen/read markers locally in browser extension storage. Polling Colossari still makes a network request, so the service can receive ordinary connection information such as an IP address.

Notifications are optional and can be disabled in the extension or browser. Lookout does not require access to your exchange passwords, private balances or unrelated browsing history. Clicking a feed link opens its destination and that site’s normal privacy rules apply. Uninstalling the extension removes access to it; local storage is managed by your browser.

Retention and your choices

We keep records while needed for account operation, security, support and financial reconciliation. The configured retention period for closed-account financial records is 7.0 years. Some operational records have shorter cleanup periods; backups can retain earlier copies until those backups are retired. We do not promise every record is immediately erased when an account is closed.

Contact us to request access to your personal information, a correction, account closure or deletion. We verify identity before disclosing or changing private records. Records required for accounting, disputes, fraud prevention or other legal duties may need to be retained; we will explain an applicable limitation. Contact support with privacy questions or complaints.

Use Account’s available email preferences and announcement unsubscribe links to stop optional marketing. Essential security and transaction messages may still be necessary to operate your account. Public profile and avatar choices can be managed through their controls. For Canadian privacy information, see the Office of the Privacy Commissioner of Canada.

Contact Colossari

Colossari is a trading name of Longboat Interactive.
3196 Prospect St
Burlington, ON L7N 2P7, Canada

help@colossari.com