Privacy Policy

Last updated: July 5, 2026

This policy explains what grailward collects and why. grailward is an unofficial fan project operated from Brazil and follows the Brazilian data-protection law (LGPD).

1. What we collect

• Account: your email address and a hashed password.
• Your saves: the raw bytes of the .d2s/.d2i files you (or your local backup agent) upload, and the parsed data we derive from them (characters, items, stats).
• Technical: your IP address and browser user-agent, used for your login sessions and security, plus timestamps.
• Devices: the named API tokens you create for the local backup agent.

2. Why we collect it

To provide backups and the armory; to sign you in and confirm your email address; and to keep your sessions secure and prevent abuse.

3. Legal bases (LGPD)

Providing the service you requested, your consent, and our legitimate interest in keeping the service secure.

4. Who we share with

We don't sell your data. We rely on a few service providers to run grailward: hosting (Hetzner, Germany), network/CDN and email routing (Cloudflare), and transactional email delivery (Resend). They process data only to provide their part of the service. We currently run no ads and no third-party tracking.

5. Your rights

You can access, correct, export, and delete your data. Both exporting your data and deleting your account are available self-service under Settings — no need to ask us. Deleting your account removes your account and all associated saves and data from our systems. You can also email [email protected] to exercise any right.

6. Retention

We keep your saves while your account exists so you can browse your history. You can delete individual data or your entire account at any time — account deletion is self-service under Settings.

7. Cookies

We only use cookies that are necessary or reflect a choice you made: a strictly necessary session cookie to keep you logged in, a cookie to remember your language, and a cookie that remembers when you dismiss an in-page notice so we don't show it again. Cloudflare, our infrastructure provider, may also set strictly necessary security cookies (such as __cf_bm) for bot mitigation. No advertising or cross-site tracking cookies.

8. Security

Passwords are stored hashed and traffic is encrypted in transit (HTTPS). No method is 100% secure, but we take reasonable measures to protect your data.

9. Children

grailward is not directed at children. Don't use it if you are under the age required by your local law to consent to the processing of personal data.

10. Changes

We may update this policy; the date above reflects the latest version.

11. Contact

Email [email protected].