What we keep about you

What is stored

Your username

Shown publicly on leaderboards and crew rosters.

Your email address

To sign you in, reset your password, and tell you when money moves.

Your password

Only ever as a hash. Nobody here can read it, including us.

Where to pay you

The PayPal address or bank detail you give us, used only to send you money.

What you have done

Strikes, damage, levels, items, ichor, placings and what you have won.

Two IP addresses

The one you signed up from and the one you last used, plus failed sign-in attempts. Used to stop one person running twenty accounts to take a prize pool that belongs to twenty people.

Two things worth knowing that you would not guess

The exchanges you surf do not tell us who you are. Their plugin sends a one-way hash of their own member id, never a username or an address. We cannot turn it back into a person, which is deliberate — an exchange installing this hands over nothing about its members. It also means we cannot tell you which account on their site is yours; only you can.

Your avatar does not tell Gravatar you were here. If you use one, our server fetches the image and serves it from this domain. An ordinary site puts a gravatar.com URL in the page, which tells Gravatar every page you looked at; this one cannot, because the browser is never asked to go there. Worth knowing either way: an avatar shown publicly is matched on a scrambled form of your email address, and a determined person could work the address back out of it. That is how Gravatar works everywhere, which is why it is a switch on your Account page.

Who else sees it

Payment processors, and nobody else. Stripe or PayPal handle the money and see what they need to for that; we never hold a card number, and one never reaches this server.

Nothing is sold, rented, or handed to advertisers. There is no advertising network on this site, no third-party analytics, and no tracking pixels. What we know is what you did here.

Public by design: your username, level, placings and crew. That is the game. Your email address, your balance and where you get paid are not, and never appear on a page anybody else can load.

How long

While the account is open, and then 7.0 years after you close it. Not because we want it: money that has moved has to be accounted for, and a payout record has to outlive the account it paid.

Email you have already read is cleared out after a few months. Failed sign-in attempts and expired password-reset links are cleared out continuously — they are useful for hours, not years.

What you can ask for

A copy of what we hold, a correction, or deletion. Write to help@colossari.com and say which.

Deletion has one limit and we would rather say it here than in a reply: records of money that actually moved are kept for the period above. Everything else goes.

You can also stop the email without asking anybody — both kinds have their own switch on your Account page, and every announcement carries a one-click way out.