Privacy policy

Your data in Steel Shall Speak

Effective 6 October 2026, updated 26 October 2026. This policy covers the Steel Shall Speak game (iOS, Android, Windows and macOS) and this website, steelshallspeak.com. In short: we collect what the game needs to run your account and keep the world fair, we show no ads, we use no third-party analytics or tracking, and we never sell your data.

Who we are

Steel Shall Speak is an online role-playing game published by dataTamer LLC (datatamer.ai), which is the controller of your personal data. For any privacy question or request, write to [email protected].

What we collect

Your account. Your email address and your password. The password is never stored as written: we keep only a one-way bcrypt hash of it. We also record when the account was created, when you last signed in, when you were last in the world, your total time played and number of visits, and your account role (player or staff).

Your character. Its name and look (body, skin, hair, facial hair, eyes), its position in the world, health, mana and stamina, skills, spells, inventory, equipment and gold, fame and karma, the religious order it has joined, and its progress through the tutorial. Other players see your character’s name, title, look, clothing, position and actions while you play: that is what a shared world is.

Your time in the world. For each visit to the world (a “play session”) we record when it started and ended, how long it lasted, why it ended (you logged out, the connection dropped, you were removed by staff, or the server stopped), the IP address you connected from, and the platform and app version your device reported. We use this to run the service, investigate cheating, abuse and technical problems, and understand how much the game is played. Only staff administrators can see IP addresses.

Kept sign-ins. If you tick “Keep me signed in”, our sign-in service gives your device a sign-in token and keeps only a one-way hash of it, with your device’s model and platform and when the token was created, last used and expires. A token lasts 60 days from its last use and is replaced by a new one each time it is used. Logging out from the game menu, or signing out on the character screen, cancels it. Token records are deleted 30 days after they expire, and all of them when you delete your account.

Help pages and reports. When you contact staff from the game’s Help menu, we keep your message, the replies, its category and status, and where your character stood when you sent it. If you report another player, the report also keeps that player’s name and account, and a copy of the chat you heard in the last ten minutes or so before reporting, so staff can see what happened.

Trades with other players. When a trade between two players goes through, we keep a record of it: when it happened, the two characters’ names and accounts, and what each side handed over (items and gold). Staff use it to sort out disputes, scams and lost-item reports. Trades that are cancelled are not kept.

What you say to AI players. Some characters in the world are played by our software, not by people (see the terms). When you talk near one of them in local or party chat, your character’s name and those words are sent to the language-model provider below so it can answer, and we keep the lines it heard and said for seven days so staff can check how it behaves. Nothing else about you is sent: no email, account, IP address or position.

Invite codes. Every account has an invite code. If you enter a friend’s code, we keep which account invited yours, when, when you first reached Sunford and when you had played enough for the free skill points, and we show your friend your character’s name and how far you have come. We never pay anything for signing up or installing. These records are deleted with either account.

Error reports. When the game hits an unexpected error, it sends the error message and where in the game’s code it happened to our own server, with the game’s version and the kind of device (for example Android or iOS). If the game closed unexpectedly the last time (a crash), it says so at the next launch and sends the last lines of its own log from that time, which can include names of characters and places on screen. No account and no IP address is kept with these reports. We use them only to find and fix bugs.

Security logs. Our servers write short-lived technical logs of requests, including sign-in attempts with the email address and IP address used. These help us stop password guessing and fix problems.

Staff actions. When a staff member acts on an account (for example removes a player from the world or changes a character), the action is written to an audit log with the affected account’s identifier.

What we do not collect

• Chat is not stored. Local (“say”) and party chat are passed to the players who should see them and are not saved on our servers. The exceptions are the chat copied into a player report and the words said near an AI player, both described above.
• Voice is not recorded. Party voice chat is relayed live between party members through our own voice server. It is never recorded or stored. The game uses your microphone only while you have joined voice; with push-to-talk, only while you hold the talk button. Voice is optional, and the game works fully without microphone access.
• No advertising, analytics or tracking. The game contains no advertising and no third-party analytics or tracking SDKs. We do not track you across other companies’ apps or websites, and we do not sell, rent or share your personal data for advertising.
• No payments. The game does not currently sell anything. If purchases are added, they will be processed by Apple or Google; we would never see your card details.
• We do not collect your contacts, photos, precise location, or advertising identifier.

Stored on your device

The app saves your settings on your device (volume, controls, see-through distance, which tutorials you have seen and similar choices). If you tick “Keep me signed in”, it also saves your email address and a sign-in token (never your password), scrambled with a key tied to your device, so the game can sign you in by itself. Logging out from the game menu cancels the token and removes it from the device; unticking the box or uninstalling the app removes it too. While it is kept, anyone using your device can enter the game as you, so do not use “Keep me signed in” on a shared device.

When you play in a browser (steelshallspeak.com/play), the same things are saved in that browser’s storage for this site, together with a copy of the game’s files so it starts faster next time. Clearing the site’s data in your browser removes them. Do not use “Keep me signed in” in a shared browser.

Why we use it

• To provide the game you asked for (performance of a contract): your account, character, sessions, help pages and voice relay.
• To keep the game secure and fair (our legitimate interest, and that of other players): IP addresses, security logs, reports, trade records and staff audit records.
• To understand and improve the game (our legitimate interest): totals such as time played and the number of players online, looked at on our own servers.

Who processes it

The game runs on our own servers (a database, the sign-in and game services, and the voice server) on rented hardware that we administer. We do not use outside analytics, advertising, or customer-support services.

Traffic to our game, sign-in service and website passes through Cloudflare, which protects us from attacks and acts as a network proxy. Cloudflare therefore handles your IP address and the requests your device makes, and operates data centres around the world, including outside the European Union, under its own data-processing terms and safeguards such as the EU Standard Contractual Clauses. Party voice audio travels directly to our voice server.

The words said near an AI player (and that character’s name) are sent to Anthropic, which provides the language model that writes the AI player’s answers, under its commercial terms, which do not let it train its models on them; it keeps them only for a limited time, for safety and abuse monitoring. Anthropic processes them in the United States.

Apple and Google process your app download under their own privacy policies. We may disclose data if the law requires it, for example to answer a valid request from an authority.

How long we keep it

• Your account, character, play sessions (including IP addresses) and help pages are kept for as long as your account exists, and deleted when you delete it.
• Trade records are kept after an account is deleted, because each one is also the other player’s record of what they gave and received. They hold the account’s internal identifier, the character’s name and the items and gold exchanged.
• The lines heard and said by AI players are deleted after seven days.
• Security logs are kept only briefly: they are rotated by our servers and discarded when the services are restarted or updated.
• Database backups are taken nightly and kept for 14 days, so deleted data disappears from backups within 14 days.
• Staff audit-log entries are kept after an account is deleted, as a record of moderation and administration. They hold the account’s internal identifier and what was done, which can include a character name (and, for changes to a staff member’s role, that staff member’s email address).

Deleting your account

In the game, open Menu → Account → Delete account and confirm. This permanently deletes your account, your character, its items, your play sessions and your help pages. It cannot be undone. If you can no longer sign in, email [email protected] from the address of your account and we will delete it for you.

Your rights

Wherever you live, you can ask us to:

• give you a copy of the personal data we hold about you (access), in a portable, machine-readable form if you wish (portability);
• correct data that is wrong (rectification);
• delete your data (erasure), or limit or object to how we use it.

Write to [email protected]. We may ask you to confirm the request from your account’s email address, and we answer within one month. You also have the right to complain to a data-protection authority; in the EU that is the authority of the country where you live (in France, the CNIL: cnil.fr).

Children

Steel Shall Speak is not directed at children under 13, and we do not knowingly collect data from them. Where local law sets a higher age for consenting alone (15 in France), younger players need a parent’s permission. If you believe a child has given us personal data, write to [email protected] and we will delete the account.

This website

steelshallspeak.com has no accounts, forms, analytics, advertising or tracking, and sets no cookies of its own. Fonts and artwork are served from our own server, not from Google or another outside service. Cloudflare, which delivers the site, sees your IP address and may set a strictly necessary security cookie if it needs to check for automated traffic.

Changes

If we change this policy, we will update it here and change the effective date at the top. If a change is significant, we will also tell players in the game.

Support and account help · Terms