Privacy Policy

Overview

This Privacy Policy explains how Avatar Genie LLC, a Delaware limited liability company doing business as Earth Games ("Earth Games", "we", "us") collects, uses, shares and protects personal information when you use https://playearth.games, the 3D world and its games, our Discord bot and related services (the "Service"). We are the "controller" of your personal information. Capitalized terms not defined here have the meanings in our Terms of Service.

The short version: we collect what we need to run a multiplayer game. We don't sell your personal information, we don't share it for targeted advertising, we don't use advertising or cross-site tracking cookies, and our own analytics don't record who you are.

1. What we collect

Information you give us

• Account: email address, a password (we store only a salted scrypt hash, never the password itself), optional display name, your record of accepting our terms (version and time), and your settings (such as notifications and whether your profile is public).
• Discord sign-in or linking: your Discord user ID, username or display name, and email address if Discord has verified it. We don't receive your Discord password, messages or friends list.
• Muninn linking and drone contributions: your Muninn user ID and name, the attribution name you choose, and the imagery, elevation data, capture dates and property boundaries you contribute, plus our review notes.
• Content: chat messages, tour names and routes, votes, friend requests and anything else you submit.
• Contact form: your email address, the topic, and your message.

Information collected automatically

• IP address: used briefly in server memory to limit abuse (rate limiting). When you vote or create an invite, we store a one-way hash of your IP address, salted with a value that changes daily, plus the name of your network (its "ASN", for example a home internet provider or a VPN or data center), to detect duplicate and automated voting. Your IP address is also sent to Cloudflare Turnstile when you complete a challenge.
• Gameplay data: your position in the world, the area you're in, when you were first and last seen, roads you've driven, places you've visited (which earn badges, some hidden), and "first visitor" records.
• Guest identifier: if you play without an account, a random identifier stored in your browser, linked to your saved position and votes.
• Usage analytics: counts of anonymous events, such as a page view, a shared link being opened, a vote cast or a sign-up, with limited context (page, referring source, town). These events contain no account ID, guest ID, IP address or precise location.
• Technical data: our hosting provider's server logs, which can include IP addresses, request details, browser type, errors and, while our email service isn't active, the email address a sign-in link was requested for.

Device location

On some pages you can choose to share your device's location, for example to find places near you. Your browser asks for permission first. That location is used once, to pick or sort nearby places, and is never stored on our servers.

Information we don't collect

We don't knowingly collect information from children under 13 (see Section 10), and we don't ask for sensitive information such as government IDs, health or financial data. We don't currently take payments.

2. How we use it, and our legal bases

We don't use your personal information for automated decisions that have legal or similarly significant effects on you, and we don't sell it or use it to profile you for advertising.

3. What other people can see

• Other players nearby see your display name (or a guest name), your character's position and movement in real time, and your chat messages. Chat is relayed live and isn't stored by us, but other players can screenshot or record it.
• Friends can see when you're online and invite you to parties.
• Tours you create are public at their link, including their name and stops.
• Your profile page (display name, member-since date and badges) is public only if you turn it on.
• Drone contributors are publicly credited by their chosen attribution name.
• Discord: roles our bot gives you are visible to members of that Discord server.

4. Who we share it with

We share personal information only as described here:

• Service providers who process it on our behalf under contract: Railway (application hosting, database, logs); Wasabi (file storage for map tiles and contributed imagery); Cloudflare (domain, DNS, network security, and Turnstile bot challenges); MailerSend (email delivery, once enabled).
• Services you choose to connect: Discord (sign-in, our bot, direct messages and roles) and Muninn (account linking and contributions).
• Map and search providers: when you search for a place by name, the text you type is sent to the OpenStreetMap Nominatim service. Your browser loads map and terrain images directly from OpenFreeMap (tiles.openfreemap.org) and Amazon Web Services (open elevation tiles), which receive your IP address as part of any normal web request.
• Legal and safety: when we believe in good faith it's needed to comply with law, legal process or a government request; to protect the rights, property or safety of Earth Games, our users or the public; to report child sexual exploitation to NCMEC; or to enforce our Terms.
• Business transfers: to a buyer or successor in a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy.
• With your consent or at your direction.

We don't sell personal information and don't "share" it for cross-context behavioral advertising, as those terms are defined in California and other U.S. state privacy laws, and we haven't done so in the past 12 months. We honor Global Privacy Control signals, though because we don't sell or share, there's nothing to switch off.

5. Cookies and browser storage

We use only cookies and browser storage that are strictly necessary for the Service or remember your own preferences. We don't use advertising, social-media or cross-site tracking cookies, and we don't use third-party analytics, so we don't show a cookie banner.

Cloudflare Turnstile may set its own strictly necessary data when a challenge runs. You can clear cookies and browser storage any time in your browser settings, but you'll be signed out and lose guest progress.

6. How long we keep it

• Account data: until you delete your account.
• Sign-in sessions: up to 30 days after last use. Sign-in links: 15 minutes, single use.
• Guest records (saved position): 12 months after last seen.
• Votes: kept to calculate rankings and to recognize founding visitors. Their influence fades over about six months. The IP hash and network name on each vote are erased after 180 days.
• Anonymous analytics events: 13 months.
• Contact form messages: 2 years, or longer if needed for a legal claim.
• Rate-limiting data: held in memory for about a minute.
• Drone contributions: as described in the Contributor Terms (they become part of the world and are kept after account deletion, credited by attribution name only).
• Server logs and backups: kept by our providers for a limited period, typically 30 days or less.

We may keep information longer when the law requires it, or to resolve disputes, prevent fraud or abuse, or enforce our agreements.

7. Your choices and rights

Everyone can, in Account settings:

• download a copy of their data (Account → Download my data);
• delete their account (Account → Delete account). This deletes your account, sessions, saved position, friends list, badges, tours, invites and driving history, and cancels your votes. Contributions you made stay in the world as the Contributor Terms describe, and anonymous analytics can't be linked to you;
• change their display name, turn notifications and the public profile on or off, and unlink Muninn.

Depending on where you live, you may also have the right to access, correct, delete or port your personal information, to restrict or object to how we use it, to withdraw consent, and not to be discriminated against for exercising these rights. This includes residents of the EU, EEA, UK and Switzerland, and of U.S. states such as California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon. To make a request, use the contact form (topic "Privacy request") or email [email protected]. We may need to verify your identity, usually by asking you to write from your account email. An authorized agent may act for you with proof of authority. We'll respond within the time the law requires, usually 30 or 45 days. If we deny your request, you can appeal by replying to our decision, and if you're still unsatisfied you can complain to your state attorney general or, in the EU or UK, to your data protection authority.

8. Security

We use reasonable technical and organizational measures to protect personal information, including encrypted connections (HTTPS), salted password hashing, hashed session tokens, cross-site request forgery protection, rate limiting and limited access to production systems. No system is perfectly secure, and we can't guarantee the security of information you send us. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.

9. International transfers

We're based in the United States, and our providers store and process information in the United States and possibly other countries. If you're outside the U.S., your information will be transferred to and processed in countries whose data protection laws may differ from yours. Where the law requires, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum.

10. Children

The Service isn't directed to children under 13, and we don't knowingly collect personal information from children under 13 (or under 16 in the EU, EEA, UK and Switzerland). Everyone confirms their age when creating an account. If we learn we've collected information from a child below the minimum age, we'll delete it and close the account. Parents or guardians who believe their child has given us information can contact us through the contact form or [email protected], and we'll delete it.

11. Emails and Discord messages

We send sign-in links and messages needed to run the Service. If you vote for a town, we may tell you when it goes live, by Discord direct message if you've linked Discord, or otherwise by email. You can turn this off in Account settings or with the unsubscribe link in any such email. We don't send marketing email without your consent.

12. Changes to this Policy

We may update this Policy. We'll change the date at the top, and for material changes we'll ask signed-in users to review and accept the new version before continuing.

13. Contact

Questions or requests about privacy: Use our contact form or email [email protected], or by mail to PO Box 3, Madison, ME 04950. Controller: Avatar Genie LLC, a Delaware limited liability company doing business as Earth Games.