Last updated: 3 November 2026, version 1 (app game.nyrathen.mobile, Android and iOS)
The controller under the General Data Protection Regulation (GDPR) is:
Ali Amuri Alnasag
Im Vogelsgesang 9
60488 Frankfurt am Main, Germany
E-mail for privacy requests: aa.amuri@icloud.com
No data protection officer is appointed, as there is no legal obligation to do so.
3.1 Guest account and login. When you tap "Play", the server creates a guest account with an account number and gives your device a random secret key. The key stays on your device; the server stores only a hash. Each login issues a time-limited session token, of which the server again stores only a hash with issue, expiry and last-use times. Other players see you under a display name ("Wächter#1234"). There is currently no registration with an e-mail address.
3.2 Characters and progress. Your character's name (3 to 16 characters), class, level, state, current zone, play time, items, vault, gold, story progress, fame and Glut values.
3.3 Deaths and obituary. When a character dies we store name, class, level, time, zone, cause, play time and deeds. The name appears as a lantern in the Nexus and is visible to other players.
3.4 Chat, parties, friends, reports and blocks. Chat messages (zone, party, whisper) are filtered automatically before delivery (links removed, profanity masked). The server keeps them in memory for 5 minutes only so that a report can include context, and does not store them otherwise. If you report a message we store the time, your account number, the sender's account number, the reason, the reported message and up to 20 previous messages of the same channel. The reported player is not told who reported them. Reports are reviewed by the operator; on violations of the Terms we may mute the chat or suspend the account. If you block a player we store whom you blocked. Friendships and friend requests are stored with both account numbers and the time. Party membership is held in memory only.
3.5 Trading between players. For every trade, listing and settlement we store both account numbers, the items involved (id, item level, rarity), gold amounts, fees, timestamps and a hash of your IP address and device. Purpose: detecting fraud and real-money trading, resolving disputes. Retention: 90 days.
3.6 Purchases (Google Play Billing, Apple In-App Purchase). Purchases of Soulglass, bundles and cosmetics are processed exclusively by Google Play or the Apple App Store. We do not receive payment details (card, PayPal etc.). We receive a purchase receipt from the store (product, transaction or order id, time, purchase state; from Google the purchase token, from Apple the signed transaction) and verify it on our server to grant the content and prevent duplicate grants. For this we keep a ledger of your Soulglass balance with every entry (purchase, spend, refund). If the store refunds or cancels a purchase we revoke the granted content; if the Soulglass has already been spent, a negative balance results and is offset against later grants. Google's and Apple's privacy policies also apply.
3.7 Game telemetry. The server logs technical game events (character number, zone, time, level reached, play time, death with cause and whether the server caused it) for operations and fairness. Without your consent these rows carry no account number. Further analysis to improve the game happens only if you have agreed in the app (age 16 or over); you can withdraw at any time under Settings > Privacy. No third parties.
3.8 Connection data. Your IP address is needed to connect to the server (TLS-encrypted). The game server keeps it in memory only, to limit abuse through excessive connection and login attempts. The account event log (logins, sanctions) stores only a truncated hash of the IP address for 90 days.
3.9 On your device. The guest key and your settings live in the app's private storage and are not transmitted, except the key at login.
3.10 Support requests. If you e-mail us, we process your e-mail address and the content of your request to answer it. We delete them after the request is closed, at the latest after 12 months, unless a retention duty applies.
Not collected: date of birth, real name, phone number, postal address, advertising IDs, contacts, precise location, biometric data.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the game, account, progress | 3.1, 3.2 | Art. 6(1)(b) GDPR (contract) |
| Shared world: obituary and lanterns | 3.3 | Art. 6(1)(b); towards other players Art. 6(1)(f) GDPR |
| Chat, parties, friends, trading | 3.4, 3.5 | Art. 6(1)(b) GDPR |
| Protecting players: filter, reports, moderation, trade fraud detection | 3.4, 3.5 | Art. 6(1)(f) GDPR (safe community, enforcing the Terms) |
| Purchases, grants, refunds | 3.6 | Art. 6(1)(b) GDPR; receipt retention Art. 6(1)(c) GDPR (German tax and commercial law) |
| Operations and fairness | 3.7 without account number, 3.8 | Art. 6(1)(f) GDPR |
| Analysis to improve the game | 3.7 with account number | Art. 6(1)(a) GDPR, Section 25(1) TDDDG (consent) |
| Support | 3.10 | Art. 6(1)(b) or (f) GDPR |
We make no automated decisions within the meaning of Art. 22 GDPR and build no advertising profiles. The automatic chat filter masks words and removes links; it never bans anyone without human review.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent with effect for the future (Art. 7(3) GDPR). Contact aa.amuri@icloud.com. You may lodge a complaint with a supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information (datenschutz.hessen.de).
A copy of your data: on request to aa.amuri@icloud.com with the subject "Data access" (GDPR Art. 15).
Delete your account: tap "Delete account" on the character list in the app and confirm. The account is locked at once; for 14 days you can take the request back with "Cancel deletion" when you log in; then it is deleted for good. What is deleted and what is anonymised is listed at play.nyrathen.com/legal/delete-account.en.html. Unspent Soulglass is forfeited with the deletion.
Nyrathen is intended for persons aged 16 and over and is not directed at children. The game does not ask for a date of birth; the store age rating is the age limit. If we learn that an account is used by a person under 16, we revoke any analytics consent and delete the related telemetry.
The connection between app and server is TLS-encrypted (wss://play.nyrathen.com). The server stores keys and tokens only as hashes. Backups
are encrypted. Only the operator can access player data, through a logged administration tool.
We update this policy when the game or the law changes. The current version carries a date and version number and is available at play.nyrathen.com/legal/privacy.en.html; we announce material changes in the game.