Ancient Online: Remastered Privacy Policy

1. Data controller

The data controller for the game is Astronaut Entertainment, an independent game studio founded in Türkiye in September 2019.

For any privacy question or request, write to ground@astent.games.

2. What we collect

We collect only the data needed to run an online game. The game contains no advertising and no third-party analytics or crash-reporting tools. It does not access your location (GPS), contacts, calendar, photos, files or camera, and it does not read device identifiers such as the IMEI, MAC address, Android ID or advertising ID. Some Google Play services libraries are added to the Android version by the game engine; the game does not collect any data through them.

• Ancient ID account: your email address, account name, password (stored only as an Argon2id hash, never in readable form), interface language, the version and time of the terms you accepted and, if you turn it on, two-step verification (the authenticator secret is stored encrypted, recovery codes only as one-way hashes). We do not ask for your real name, date of birth, address or phone number.
• Sign-in with another service (optional): if you sign in with or link an external account such as Google, Apple, Facebook, X, Discord, Microsoft, Twitch, Steam or Epic Games (the services offered depend on your platform), we receive your account identifier at that service and, where the service provides them, your email address and display name. We never receive your password for that service.
• Device and connection: a random installation identifier created by the game and the public half of a security key generated on your device (on Android the key is kept in the Android Keystore and cannot be exported); your IP address, and the network operator (ASN) and country derived from it using a database kept on our own servers; the time and result of sign-ins.
• Game data: your characters and their names, levels, items, in-game currency, quests, friend and block lists, guild and party membership, trades, market stalls and other in-game actions. We record these to run the game and to detect cheating, fraud and lost items.
• Messages and voice chat: see section 3.
• Purchases: see section 4.
• Player reports: if you report a player or a problem, the category, your description, the accounts and characters involved, an optional video link and up to five in-game screenshots you choose to attach.
• Security checks: when an action needs a human check (for example registration or repeated failed sign-ins), the game shows an hCaptcha challenge; the result and your IP address are verified with hCaptcha. On Android the check opens in your browser on ancient.astent.games.
• Emails: we send only service emails to your address: verification and reset codes, security notices, confirmation of deletion requests and purchase receipts. We do not send marketing emails.
• Discord status (Windows only): if the Discord app is running on your PC, the game shows your character name, level, current map, guild and party size in your Discord status through the Discord app on your computer. This feature does not exist on Android.

3. Chat, whispers and voice chat

Text chat and whispers are delivered through our servers. So that we can investigate harassment, fraud and abuse and handle reports, we store messages (general, guild, party and private messages) encrypted (AES-256-GCM) together with the sender, recipient, channel and time; a masked copy of private messages is also kept in our security logs. Chat is checked automatically for profanity and spam; when a rule is triggered, a masked excerpt is kept. Message contents can be opened only by authorised team members, for a specific moderation case and with a recorded reason; every opening is logged and closes automatically after 15 minutes.

Voice chat is optional and works as push-to-talk by default. The game asks for microphone access only when you use voice chat. Your voice is encoded on your device and relayed in real time through our game server, over the encrypted connection, to the players in your channel; it is not recorded or stored, and no third-party voice service is used.

Chat translation is done by a local translation model running on our own server; messages are not sent to any outside translation service, and translations are kept only briefly in the server’s memory.

4. Purchases

The game is free to play and offers optional in-game purchases. We never see your card details.

Android: purchases are made through Google Play Billing. Google processes your payment under its own privacy policy; we receive the purchase token, the Google order number, the purchase time, the country/region code and any refund status, and verify them with Google to deliver your items. We pass Google only a pseudonymous identifier derived from your account with a keyed hash, not your email address or account name.

Windows PC: purchases are made on our payment page through PayTR, a licensed payment institution in Türkiye. PayTR receives the name, phone number and email address you enter on the form, your IP address and the order details; card details are entered on PayTR’s own form and never reach us. We do not store your name or phone number; we keep the order, the amount and the receipt.

For every purchase we keep a record (order number, date, package, amount and receiving character) and send a receipt to your email address. See also our Purchase Agreement and Refund Policy.

5. Why we process data and on what legal basis

We do not sell personal data, use it for advertising or build advertising profiles. Automatic protections such as rate limits or a security check can pause an action temporarily, and automatic anti-cheat checks can flag an account for review; account sanctions are decided by our team.

• Providing the game and your account (account, game data, messages, voice chat relay, translation, delivery of purchases): performance of our contract with you — KVKK art. 5/2-c; GDPR art. 6(1)(b).
• Security, fair play and fraud prevention (IP address, ASN/country, device key and installation identifier, sign-in history, hCaptcha, chat moderation, in-game logs, VPN/proxy and multiple-account checks): our legitimate interest in a safe and fair game — KVKK art. 5/2-f; GDPR art. 6(1)(f).
• Service emails (codes, security notices, receipts): performance of the contract and our legitimate interest — KVKK art. 5/2-c and f; GDPR art. 6(1)(b) and (f).
• Payments, tax and other legal obligations (purchase records, receipts, records we are required to keep): our legal obligations — KVKK art. 5/2-ç; GDPR art. 6(1)(c).
• Reports, disputes and legal claims (player reports, moderation cases, audit records): establishing, exercising or defending legal rights — KVKK art. 5/2-e; GDPR art. 6(1)(f).
• Microphone: used only when you turn on voice chat and allow microphone access on your device; you can withdraw the permission at any time in your device settings.

6. How long we keep data

• Account and game data: for as long as your account exists; if you delete your account, the rules in section 9 apply.
• Sign-in history (method, result, IP address, device): 180 days, then deleted automatically.
• Email verification and reset codes: 15 minutes. Registration and verification flows: 1–7 days. Rate-limit counters: 3 days. Emails in the sending queue: 30 days.
• Screenshots attached to reports: 30 days, then deleted automatically. Report texts and moderation cases: as long as needed to resolve the case and to defend against possible claims.
• Security check (hCaptcha) relay data: 1 hour. Email address entered on the PayTR payment form: deleted after the receipt is sent, at the latest within 3 days.
• Chat messages, device and network records, session, security and in-game logs: for as long as your account and the service exist, and as long as needed for security, moderation and our legal obligations.
• Purchase, payment and receipt records (including Google Play and PayTR transaction data): for the period required by tax and commercial law; deleting your account does not delete these records.
• Backups: deleted data may remain in backups for up to 12 months until it is overwritten.
• Data held by Google, PayTR, hCaptcha and Cloudflare: under their own policies (links in section 7).

7. Who receives your data

We share data only with the service providers we need to run the game. Other players see only what the game shows them by design (for example your character name, your guild, the messages you send and your voice in voice chat). We never sell data. Public authorities receive data only where the law requires it.

If you sign in with another service, that service learns, under its own privacy policy, that it was used to sign in to our game. The Discord status on Windows (section 2) is shared only through the Discord app and only while it is running.

8. International transfers

The game servers and game databases run on our own servers in Türkiye; game traffic goes directly to them. Service emails are sent from our own mail server hosted in Germany (EU). Google, hCaptcha and Cloudflare operate worldwide, including in the USA, so some data (for example your IP address when you download game files or complete a security check, and the purchase data Google processes) may be processed outside Türkiye and the European Economic Area. These transfers rely on safeguards permitted by KVKK art. 9 and GDPR art. 44–46, such as the standard contracts offered by these providers and, where the provider is certified, the EU–US Data Privacy Framework.

9. Deleting your account and data

You can delete your account at any time from inside the game: character selection screen or ESC menu → Account → Account Deletion. Your request waits 14 days, during which you can cancel it. If you cannot access the game, write to ground@astent.games from the email address registered to your account. The steps are also described at ancient.astent.games/account-deletion. When the 14 days are over:

• Deleted: your characters and their items, quests, friends and guild membership; your email address, password and two-step verification data; your recovery codes and open sessions. Links to external sign-in services are revoked.
• Kept: a de-identified record of the account (account name, dates, empire and balance) so that names and transactions stay consistent; the account identifier, email address and display name received from an external sign-in service; records of the terms you accepted; purchase, payment and receipt records we are required by law to keep; security, sign-in, moderation and in-game logs and stored chat messages. These are kept for the periods in section 6.

If you want only part of your data deleted, or a copy of your data, see section 10.

10. Your rights

Depending on the law that applies to you, you have the right to:

• learn whether we process your data and receive a copy of it (GDPR Art. 15; KVKK Art. 11);
• have inaccurate or incomplete data corrected (GDPR Art. 16);
• have your data deleted (GDPR Art. 17; KVKK Art. 7);
• restrict processing (GDPR Art. 18);
• receive your data in a portable format (GDPR Art. 20);
• object to processing based on legitimate interest (GDPR Art. 21);
• learn the purpose of processing and the third parties in Türkiye or abroad that received your data, and claim compensation for damage caused by unlawful processing (KVKK Art. 11).

To use these rights, email ground@astent.games from the email address registered to your Ancient ID account, so that we can verify that the account is yours. We reply free of charge within 30 days. You may also complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or to the data protection authority of your EU country of residence.

11. Children

Ancient Online: Remastered is not directed at children under 16, and we do not knowingly collect personal data from them. The game does not ask for your age. If you believe a child under 16 has created an account, contact us and we will delete it.

12. Security

The game connects to our servers only over TLS 1.3 and verifies our server’s certificate (certificate pinning), so the connection cannot be intercepted and read unnoticed. Passwords are stored only as Argon2id hashes; two-step verification secrets and chat messages are stored encrypted; one-time codes and recovery codes are kept only as keyed hashes. Your device key never leaves your device. Only authorised team members who use two-step verification can access player data, and administrative access is logged.

13. Changes to this policy

We update this policy when the game, the data it processes or the law changes. The date at the top of the page shows the current version; we may also announce significant changes in the game or on ancient.astent.games.