Privacy Policy

Last updated: 1 October 2026

This policy explains what personal data Dead Sector (the online game at playdeadsector.com) collects, why, and what rights you have. We collect only what the Game needs to work and to stay fair. We do not sell your data, show ads or use analytics or tracking.

Who is responsible

Dead Sector is run by an independent developer based in the Czech Republic, who is the controller of your personal data. Contact for every privacy question or request: contact@adscaled.media.

What we collect and why

Account data: your username, email address and password. The password is stored only as a salted scrypt hash, never in readable form. The username and email are stored encrypted. We use them to create your account, let you log in, send you verification and password-reset codes, and answer your requests. Legal basis: performance of our contract with you (the Terms of Service).
Sign in with Google (only if you choose it): Google sends us an identifier of your Google account and your email address. We store the identifier encrypted and use it only to log you in. We receive nothing else from your Google account. Legal basis: contract.
Game data: your nickname, public player id, inventory, stash, progress, quests, statistics, friends and ignore lists, and the messages you send to other players (kept up to 200 messages per conversation). Your nickname and level are visible to other players, for example in the friends list, in raids and on dogtags. Legal basis: contract.
Security and fair play: while you are connected we use your IP address to limit login attempts and abuse. The server logs the IP address of failed or rate-limited logins; these logs are deleted after 30 days. To enforce bans we keep, per account, the last 10 network addresses and device identifiers only as irreversible keyed hashes (never the addresses themselves), for 90 days. Moderation actions (such as mutes and bans) are recorded in an audit log. Legal basis: our legitimate interest in protecting the Game and its players from cheating, abuse and attacks.

Who processes data for us

netcup GmbH (Germany) hosts the game server and its data, inside the EU.
Brevo (Sendinblue SAS, France) delivers our verification and password-reset emails. It receives your email address and the email's content.
Google: only if you use Sign in with Google. The login page then loads Google's sign-in button, and Google processes your sign-in under its own privacy policy.

These providers act on our instructions and are bound by data protection agreements. We do not transfer your data outside the EU ourselves; if Google does so for its sign-in, it relies on the legal safeguards described in its policy.

How long we keep it

Account and game data: while your account exists.
Security logs: 30 days. Address and device hashes: 90 days.
Remember me login token hashes: until the token expires (at most 90 days after you last entered your password); hashes of replaced or cancelled tokens until they would have expired.
Encrypted hourly backups of the game database are kept for about one day. Copies of the database taken before each game update are kept until three newer updates have replaced them. Deleted data disappears from these copies as they are replaced.
Records of bans and moderation actions are kept as long as needed to enforce them and to handle appeals.

Stored in your browser

We do not use cookies. The Game stores a few things in your browser's local storage: your settings, a session token so a dropped connection can resume, which patch notes you have seen, and the position of the messenger window. You can clear them at any time in your browser.

Remember me is optional and off by default. If you tick it when you log in, your browser also keeps your username and a random login token, never your password, so the login form can be filled in for you next time. On our server we keep only an irreversible hash of that token, with when it was created and last used. A token stops working 30 days after it was last used and at the latest 90 days after you last entered your password or signed in with Google, and it is replaced with a new one when it is used more than 12 hours after it was issued. Logging out (if you are offline, as soon as you next connect) or logging in with Remember me unticked cancels it on that device. Changing or resetting your password (also when we reset it at your request), a ban, an account reset, or a sign that a token was copied and used twice cancels it on all your devices; in the last case we also end the game session that copy started. A remembered login of an account that uses Sign in with Google works only while we offer Google sign-in. To detect copied tokens we keep the hash of a replaced or cancelled token until it would have expired, and for each account the time its tokens were last cancelled. Legal basis: contract (you asked us to remember you).

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. To use any of these rights, including deleting your account, write to contact@adscaled.media from the email address of your account. We answer within one month. You can also complain to a data protection authority; in the Czech Republic this is the Office for Personal Data Protection (uoou.gov.cz).

Security

Connections to the Game are encrypted (HTTPS/WSS). Passwords are hashed, sensitive account fields and backups are encrypted, and access to the server is restricted to the developer.

Children

The Game is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Changes

We will update this policy when the Game or the way we handle data changes; the date at the top shows the current version. Important changes will be announced in the Game.