This describes what Plotopia actually stores, file by file. It was written from the code, not from a template — so where something is uncomfortable, it says so instead of leaving it out.
The controller for your data under the GDPR:
ByteBuzz Creations
,
,
Everything about your data reaches a person, not a queue.
Not because you consented. Playing Plotopia means we run a service for you, and that is the legal basis:
Where consent is the basis, it is asked for separately and you can withdraw it. That applies to exactly one thing today: the e-mail address, which is optional.
This is the complete list. Everything sits on our own server; there is no third-party database and no data broker.
sessions.json): your address, a
session token and the times it was issued and last used. It is what keeps you signed
in. It expires 30 days after it was issued, after which you sign in
again; signing out ends it immediately.plots.json): which plots you own, what you
built on them, your citizens and their assignments, your resources, your quest
progress, your display name and chosen avatar, the marker for "what happened while you
were away", your open buy orders, and your chat messages.achievements.json): derived from your own
history — nothing new is collected for it.world_stats.json): hourly totals for
the whole world. Aggregate figures, not a record about you.wallet_ledger.json and its rotated
archives wallet_ledger-pre-reset-*.json): every movement of Topia and of
resources for your address, as an unbroken balance chain — deposits, payouts, purchases,
fees, payouts of dividends. This is the file that makes "where did my balance go"
answerable, and it is a bookkeeping record.Two append-only files. Nothing in them is ever rewritten — a file whose lines can change afterwards proves only its last state.
onboarding_consents.jsonl: your address, your country of
residence, your e-mail if you gave one, the two confirmations you ticked (terms, and
being 18 or older), the timestamps, the version and SHA-256 of the exact text you were
shown, and your IP address in truncated form.deposit_consents.jsonl: before every deposit — the
amount, the version and SHA-256 of the purchase terms you were shown, the timestamp,
your truncated IP, and later a second line linking it to the transaction that arrived.The hash is there for your benefit as much as ours: it means "you confirmed this text" is a fact that can be checked years later, not a claim someone makes.
Copies of the world state (backups/) and of the account history, taken
before risky operations so that a bad day does not cost anyone their progress. They contain
the same data as the originals.
They are not on an automatic schedule and nothing deletes them by itself: they accumulate until someone removes them by hand. We say that plainly because the alternative — writing "they are rotated" — would describe a routine that does not exist. When a deletion is carried out, clearing them is part of that work; see section 8.
No cookies. Ten entries, all named plotopia.*, and every one of them is
either your sign-in or a setting you chose yourself.
Eight of them are in local storage and survive closing the browser:
plotopia.siwe, plotopia.token — your sign-in. Both carry
the address of the server they belong to, so a sign-in on one world is not a sign-in on
anotherplotopia.chat.room, plotopia.chat.size,
plotopia.chat.font — how you left the chat windowplotopia.quests.minimized, plotopia.hint.utility — panels
and hints you dismissedplotopia.assets.plotsort — the sort order you chose for your own plotsTwo are in session storage and are gone when the tab closes:
plotopia.overlay, plotopia.district.shades — which map
layers you had switched onNone of them is sent anywhere except your sign-in, and clearing your browser data removes all of them.
The game server never stores a full IP address. Where one is written down at all — with
your onboarding and with each purchase confirmation — it is shortened first: IPv4 to its
first three blocks (/24), IPv6 to its first three groups (/48).
That is enough to tell a wave of fake accounts from a normal player and not enough to point
at a household.
Our own web server keeps an access log, and it is easier to say what a line contains than what it does not: time, method, host, path, status, duration, size. That is the whole line. It is rolled and discarded after at most 7 days — a setting in our configuration, not an assumption about a default — and it is used for nothing else: no analysis, no export, no profile.
Request headers are not written at all. That is deliberate and it is the reason your address is not in the log: every request reaches us through Cloudflare (section 7), which passes your address along in a header, and we drop the whole set before anything is stored. The address the connection itself shows is Cloudflare's, not yours.
So the full address exists in exactly one place outside your own device: at Cloudflare, whose retention is its own. Our game server reads it from that header — and truncates it before anything is written down, as described above.
Plotopia is a shared world, so some of your data is the point:
Not visible to other players: your wallet address, your balance, your account history, your country, your e-mail, your IP. Public routes are checked against a list of what may leave the server, and a shortened address counts as an address there.
Chat messages are unmoderated and other players read them as you type them. Nothing you would not put on a postcard.
Deposits and payouts are transactions on a public chain. They carry your address, the amount and the time, they are readable by anyone forever, and no one can remove them — including us. This is not a policy we chose; it is what a blockchain is.
To see whether your deposit arrived, our server asks a public node of that chain about your address. The operator of that node sees the request. Deleting your data on our side does not reach either the chain or that node's own logs.
One transfer outside the EU, and it is this one. Cloudflare is a US company. Your IP address and your requests are therefore processed in a third country within the meaning of Chapter V GDPR — everything else in the list above stays where it says it stays, and our own server holds no full IP address at all (section 4).
We name it as a fact of how the service is built, not as a footnote: it is the single point at which data about you leaves the EU, and it applies to every visit, including the ones where you only watch.
Your e-mail address, if you gave one, is stored with your onboarding record. Today nothing is sent to it: the receipt feature it was collected for does not exist yet. When it does, this section will name the provider that sends it — and you can have the address removed at any time, which costs you nothing but the receipts.
We do not sell data, and we do not share it for anyone else's purposes.
This is the part that a template would smooth over. Deletion means three different things in Plotopia, and one of them is "nothing".
Display name, avatar, settings, chat messages, your session: on request, gone. Fully and for good.
The account history, the payout requests and the two confirmation files are bookkeeping records of real-money transactions. Tax and accounting law requires them to be kept — up to ten years for accounting records, counted from the end of the year in which they arose. Until then we block them: they stay untouched, are used for nothing but that legal purpose, and are not part of the game any more. This is the restriction of processing that Art. 18 GDPR describes, and it is a genuine limit on your right to erasure under Art. 17(3)(b) GDPR — not a preference of ours.
A deletion request reaches our records. It cannot reach the chain. Before your first deposit you were told this, because afterwards it is too late to decide differently.
Beyond that: a session expires on its own after 30 days. Chat lines roll off the end of the room as new ones arrive. Snapshots of the world state are kept for recovery, and clearing the ones that still contain your data is part of carrying out a deletion — done by hand, because no routine does it (section 3). Aggregate world statistics contain nothing about you and stay.
Deletion here is a person doing it, not a button: there is no self-service route in the game. Write to the address in section 9 and it is carried out.
One message through our Contact page is enough, and it does not have to be formal. We answer within a month; if we need longer, you hear from us before the month is up.
You can also complain to a data protection authority; the one competent for us is . You do not have to talk to us first.
Plotopia involves real money and is for adults. You confirm being 18 or older before you start, and we do not knowingly keep accounts for anyone younger.
When this notice changes, the date below changes with it, and a change that affects you is shown in the game rather than left here to be discovered.