PRIVACY POLICY
Last updated: 22 July 2026
This Privacy Policy explains how TibiaOT ("we", "our", or "us") collects, uses, stores, and protects your personal data when you use our website and online game service (together, the "Service"). TibiaOT is a non-profit, educational fan project and is not affiliated with CipSoft GmbH or the official Tibia game.
The Service is operated from the United States and is governed by the laws of the United States and the applicable state, without regard to conflict-of-law rules. If you access the Service from another region, such as the European Union, additional local rules (for example, the GDPR) may also apply to you. By using the Service, you acknowledge that you have read and understood this Policy.
WHO IS RESPONSIBLE FOR YOUR DATA
The party responsible for your data is the TibiaOT team. For any privacy request or question, you can contact us at [email protected].
WHAT DATA WE COLLECT
We only collect what we need to run the game and the website:
• Account data: the email address you register, your password (stored only in hashed/encrypted form), your account name and the names of your characters.
• Technical and security data: your IP address, browser and device information, login timestamps and login attempts. We use this to keep accounts secure, prevent fraud and abuse, and enforce our Rules.
• In-game data: information generated while you play, such as characters, progress, purchases of virtual coins, and moderation history. This is required for the game to function.
• Donation/payment data: when you make a voluntary contribution, the transaction is processed by an external payment provider (see "Third-party processors" below). We receive and store only the transaction result (amount, currency, status, provider reference and the account it credited). We never receive or store your full credit card number or banking credentials.
• Usage data: anonymous/aggregated statistics about how the website is used, collected through Google Analytics.
• Communications: any information you send us by email or through the website when you contact support or report a rule violation.
We do not knowingly collect sensitive personal data (such as racial origin, political opinions, health or biometric data), and you should not send us any.
HOW WE USE YOUR DATA
We use your personal data to:
• create and maintain your account and let you play the game;
• provide customer support and answer your requests;
• process voluntary donations and credit virtual coins to your account;
• protect the Service, detect and prevent fraud, abuse and rule violations, and keep accounts secure;
• understand and improve how the website and game are used;
• comply with legal obligations and respond to lawful requests from authorities.
THIRD-PARTY PROCESSORS
We share the minimum data necessary with trusted third parties that help us operate the Service. Each processes your data under its own privacy policy:
• PayPal – payment processing for donations.
• Stripe – card payment processing for donations.
• GoUrl (Cryptobox) – cryptocurrency (Bitcoin) payment processing for donations.
• Google Analytics (Google LLC) – website usage statistics.
• Our hosting provider – stores the servers and databases that run the Service.
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We may disclose data when required by law, court order, or to protect the rights, safety and security of TibiaOT, our players, or the public.
COOKIES
A cookie is a small file stored by your browser. We use:
• Essential cookies – needed for login sessions and security (for example, the session cookie and the anti-CSRF token). The Service does not work correctly without them.
• Preference cookies – remember choices such as your cookie-consent selection and, if you were invited by a friend, a referral token.
• Analytics cookies – set by Google Analytics to measure usage. These are non-essential cookies and you can decline them through the cookie banner or your browser settings.
You can block or delete cookies in your browser at any time, but essential cookies are required to log in.
HOW LONG WE KEEP YOUR DATA
We keep your account data for as long as your account exists. Security logs and donation records are kept for as long as necessary for security, accounting and legal purposes, and then deleted or anonymised. If you ask us to delete your account, we will remove or anonymise your personal data, except where we are legally required to keep certain records.
HOW WE PROTECT YOUR DATA
We use reasonable technical and organisational measures to protect your data, including hashed passwords, restricted access and secure (HTTPS) connections. However, no method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your own password safe – please read our Rules and never share your account.
YOUR RIGHTS
Depending on where you live, you may have the right to access the personal data we hold about you, to correct inaccurate data, to request its deletion, to learn with whom we share it, to withdraw consent where processing is based on consent, and to opt out of non-essential analytics. To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.
CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we collect and how we use it, to request access to or deletion of that information, and to not be discriminated against for exercising these rights. We do not sell the personal information of our users. To make a request, contact us at [email protected].
CHILDREN
The Service is not directed to children under 13, and we do not knowingly collect personal data from them, in line with the U.S. Children's Online Privacy Protection Act (COPPA). Donations by anyone under 18 require the consent and assistance of a parent or legal guardian, as described in our Terms of Use. If you believe a child has provided us with personal data, please contact us and we will remove it.
INTERNATIONAL USERS
The Service is hosted in the United States. If you access it from outside the United States, you understand that your data will be processed in the United States, where data-protection laws may differ from those of your country. By using the Service, you consent to this transfer and processing.
CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and, for significant changes, announce it on the website. Your continued use of the Service after an update means you accept the revised Policy.
CONTACT US
If you have any questions about this Privacy Policy or how we handle your data, contact us at [email protected].
| 
