Endless Worlds
Play now
Legal

Privacy

What Endless Worlds keeps about you, and what it does not.

Last updated 1 November 2026.

Endless Worlds is run by Devinci Web Solutions (ABN 75 235 287 002), of 15 Dayboro Road, Petrie QLD 4502, Australia. Nothing about you is sold, and nothing is collected for advertising, because there is no advertising.

This website

These pages keep no account and nothing about you of their own. The fonts and icons are served from here rather than from somebody else's site.

Registering your interest

Before launch, you could register your interest. The email address you typed was sent in one email to us, through an email delivery service (Resend). The website itself stored nothing: our inbox is the list. It is used only to tell you about the game, and nothing else. Ask us and it is deleted. The form is closed now that the game is open.

The form is protected by Cloudflare Turnstile, which is loaded only once you start filling the form in. From then on Cloudflare receives information about your browser and your IP address, to judge whether you are a person. Cloudflare's own privacy policy applies to that. Reading the page without touching the form contacts nobody.

Analytics, only if you say yes

The first time you visit, the site asks whether it may count your visit with Google Analytics. If you say no, or do not answer, nothing is sent to Google and no cookie is set: reading these pages then contacts nobody at all.

If you say yes, Google Analytics sets cookies whose names start with _ga and tells us which pages were read, roughly where from, on what kind of device and browser, and how visitors moved between pages. We use it to see which pages are useful and nothing else: it is not used for advertising, Google's signals and ad personalisation are switched off, and it is not linked to a game account. Google receives your IP address to do this; its own policy says how Google handles it.

You can change your mind at any time with Cookie settings at the bottom of every page. Saying no clears the cookies and stops anything more being sent. The game itself is not tracked.

What the game keeps

When you make an account to play, this is what is stored:

  • Your username, and a scrambled (hashed) form of your password. Never the password itself: it cannot be read back, by us or by anybody who obtained the database.
  • Your email address, used for two things: getting you back in if you forget your password, and confirming it is yours before you can buy anything.
  • If you sign in with Google, the number Google uses for your Google account and the email address Google gives us, kept as confirmed because Google confirmed it. Not your name, your picture or your contacts, and never your Google password, which we never see. You can unlink Google in Settings once your account has a password.
  • Which version of the terms you accepted, and when.
  • A code made from the network address you made the account from, scrambled with a secret key so the address cannot be read back from it. It lets us limit how many accounts one place makes in a day, and nothing else.
  • Your characters: their names, what they look like, where they are standing, what they are carrying and have banked, what they have learned, who they are in a guild with, what quests they have done, how much gold they have and where it came from, and how long you have played.
  • Letters you send other players, including anything attached to them, until they are claimed or returned.
  • Who you have chosen to ignore, so their chat, invitations and letters stop reaching you. They are not told.
  • Reports. A report you make about another player (who, why, and anything you add), and a report made about you, with what you said in chat in the quarter hour before it. Operators read reports and record what they decided. A player you report is not told it was you.
  • Actions an operator takes about you (a warning, a mute, a suspension), with the reason, in an append-only record. This is what makes a decision answerable rather than arbitrary.

Buying Sparks

If you buy Sparks (Terms of Sale), the game keeps a record of each purchase: the account and the character it was started from, the pack, the price and currency, what happened to it (paid, refunded and so on), the version of the Terms of Sale you accepted, when you agreed to have the Sparks delivered straight away, and the payment provider's reference for it. It also keeps every movement of your Sparks, what you bought with them and who any gift was for, the promo codes you used, and any spending limit you set.

  • We never receive your card details. On the web the sale is made by Link, Stripe's checkout service, which collects your card, your name, the email address your receipt goes to and, to work out the tax, your billing address. Link's own privacy policy applies to that.
  • In the apps, Google Play or the App Store takes the payment through your account with them. We receive a token proving the purchase and a random identifier our server made for the order, never your account details with them.
  • To show prices in your currency, the shop reads the country our network provider works out from your IP address. It decides which currency is shown and is not stored.

Purchase records are kept for five years, because Australian tax law requires a business to keep its records that long.

What the game does not keep

  • Chat is not stored. There is no chat table in the database. A line is delivered to the people it was addressed to and is gone. The one exception: the server holds each player's last few lines in memory for fifteen minutes, and if somebody reports that player, those lines are kept with the report so an operator can see what was said. Nothing is kept of anybody nobody reports.
  • Your IP address itself is not stored in the database. It is used while you are connected, to limit how many connections one address may open and how often anybody may be wrong about a password, and it appears in the server's own log alongside a connection. Those logs live on the server and rotate away. The one thing kept is the scrambled code above, made when an account is.
  • Password reset codes are stored scrambled, expire after fifteen minutes, and do not survive a restart.
  • No location data beyond what an IP address implies, no device fingerprinting, no contacts, no third-party identifiers.

What is published

The leaderboards are public, and they are the only place anything about you appears outside the game. They show a character name and the number being ranked (a level, a fame score, a gold total, a count of dungeon runs, hours played) and nothing else. Not your username, not your email address, not what you are carrying, not where you are standing, not who you play with.

They are a snapshot taken when the site was last built, not a live feed. If you would rather not appear on them, ask us.

Crash reports

When the game goes wrong it reports the fault so it can be fixed. Anything that looks like a password, a key or a token is stripped out before that report leaves, matched by shape over the whole text rather than by field name, and chat is dropped outright. Not because it is secret, but because it is somebody else's words.

Who else sees any of it

Only the services it takes to run a game, each doing one job and none of them given anything for their own purposes:

  • the company renting the server the game and its database run on;
  • a content delivery network, which sits in front of the site and the game and therefore sees your IP address and which pages you asked for;
  • an email delivery service, which sees your address and the message sent to it;
  • Cloudflare Turnstile, when you make an account or register your interest, which sees your browser and IP address to check you are a person;
  • Google, if you choose to sign in with Google, which tells us who you are and sees that you signed in to Endless Worlds;
  • if you buy Sparks, whoever makes the sale (Link on the web, Google Play or the App Store), which sees what it needs to take the payment, as above;
  • an error reporting service, which sees the scrubbed crash reports above;
  • object storage, which holds the database backups.

Some of those are outside Australia, which means your information is stored and processed overseas. Nothing is passed to anybody else, and nothing is sold, ever.

How long it is kept

Your account and characters are kept while the account exists. Backups are kept for thirty days and then deleted. Server logs rotate away on their own. Letters expire and are returned to the sender if nobody claims them. Purchase records are kept for five years, as above.

Deleting things

You can delete a character from the character screen, and everything it was carrying goes with it, in one action that cannot be half-finished.

To delete your account, or to ask what is held about you, email admin@devinciweb.online. An account is removed with its characters and everything they held. Three things survive it: the operator action record, if there is one, because a record of a decision is not something the subject of it can erase; the records of anything you bought, for the five years tax law requires; and backups, until they age out within thirty days.

Children

This game is not aimed at children under 16, and no account should be created by one without a parent or guardian.

Changes

If what is kept changes, this page changes with it, and the date at the top moves. A change to what the terms require you to agree to is a new terms version, which you will be asked to accept.