Privacy policy
What we keep about you when you use the Crownlands Roleplay website and play on the server, why we keep it, how long for, and what you can ask of us. We keep as little as we can, we never sell it, there are no adverts, and analytics run only if you accept them.
Last updated 21 October 2026
1. Who we are
Crownlands Roleplay (“we”, “us”) is a volunteer-run community that runs a roleplay server for Kingdom Come: Deliverance II through the KCD:MP multiplayer modification, and this website at https://crownlandsrp.com. The website and the game server share one account and one database, so this policy covers both. We are the controller of the personal data described here under the UK General Data Protection Regulation, the Data Protection Act 2018 and, for players in the European Economic Area, the EU General Data Protection Regulation.
For anything about your data, including the requests in Your rights, contact the staff on our Discord (opens in a new tab).
2. What we keep and why
Each line below says what we keep, what we use it for, and the legal basis that allows it under the GDPR.
| What | What it is for | Legal basis |
|---|---|---|
| Your account: email address, username, password (stored only as a salted hash we cannot read), when it was made and when you last signed in | Signing you in on the website and in the game, and telling accounts apart | Contract: it is how we provide the account you ask for |
| An identifier of your game install, and the account it last signed in to | Letting the game remember your account between sessions | Contract |
| Your characters and everything they own or do in the game: names, money, items, horses, wagons, properties, factions, play time, in-game letters | Running the shared game world and showing your characters to you on the website | Contract |
| The game’s event log: what characters do in the world (purchases, trades, faction changes, letters sent and so on) and staff actions | Settling disputes, investigating rule breaks and putting mistakes right | Legitimate interests: keeping the game fair and working |
| Your website sign-ins: when each started and was last used, whether you chose “Remember me”, your IP address and your browser’s description (user agent) | Keeping you signed in, and spotting and stopping misuse of an account | Legitimate interests: the security of your account and the site |
| Your IP address and email address, briefly, when you sign in or create an account | Limiting how many wrong passwords and new accounts can come from one place, against password guessing and spam | Legitimate interests: security |
| The moderation record: bans, kicks and staff notes on an account, with the reason, the staff member and the dates | Enforcing the server rules, keeping bans in force and keeping the community safe | Legitimate interests: a safe, well-run community |
| Your linked Discord account: its id and username, and when you linked it | Matching your game account to your Discord account and giving you the Whitelisted role in our Discord server | Consent: only if you link it, and you can unlink it at any time |
| How you use the website, if you accept analytics cookies: the pages you visit, clicks, scrolling and mouse movement, your device, browser, screen size and rough location, and a random identifier in a cookie | Seeing how the website is used, through Microsoft Clarity’s heatmaps and recordings of visits, so we can fix what is confusing or broken | Consent: only if you press Accept, and you can withdraw it at any time |
We do not use your data for advertising, we do not sell it or share it with anyone for marketing, and we make no automated decisions about you that have legal or similarly significant effects. Bans are decided by people.
We need your email address, username and password to make an account; without them you can still read the public pages but can’t play or sign in.
3. Visiting the website
As with any website, your browser sends your IP address and a description of itself with every request so that the page can be sent back. We use these only to deliver the site and keep it secure; outside the sign-in records above we don’t keep them in a database. Our web server and hosting may keep short technical logs for the same purposes.
There are no advertising scripts on this site. The only script from another company is Microsoft Clarity, our analytics, and it loads only if you press Accept in the cookie banner. If you do, Clarity records how you use the public and account pages (pages visited, clicks, scrolling and mouse movement) along with your device, browser and rough location, and sends it to Microsoft so that we can look at heatmaps and recordings of visits. What you type into forms is hidden, all the text on your account pages is hidden, and Clarity never runs in the staff control panel. We don’t use it to identify you or to advertise to you.
Microsoft runs Clarity under its Clarity terms (opens in a new tab) and the Microsoft privacy statement (opens in a new tab), and may store the data in the United States, under the EU–US Data Privacy Framework and its UK extension. You can withdraw your consent at any time with Cookie settings at the bottom of every public page.
We don’t load fonts from other companies. The coats of arms of the realm’s houses are served from our own image host. The cookies and the small settings this site stores in your browser are described in the cookie policy.
4. Discord
Our community, the whitelist and much of the help live on Discord, which is run by Discord Inc. under its own privacy policy (opens in a new tab). What you post in our Discord server is visible to its members and is kept by Discord.
If you choose to link Discord in your account’s Settings, you are sent to Discord to agree. We ask Discord only for your Discord id and username and, where the role is switched on, permission to add you to our Discord server; Discord then gives the Whitelisted role to you there. We don’t keep the key Discord gives us for this once it is used. Unlinking in Settings deletes the link from our records straight away; leaving our Discord server or removing the role is done in Discord.
If you open a support ticket in our Discord server, our staff may read, answer, close and delete it from the website’s control panel, and their answers are posted in the ticket by our bot. The website reads your ticket’s messages from Discord only while a staff member has it open, holds them in memory for ten minutes at most and never saves them. It keeps the staff’s own answers, with which staff member wrote each one, and any short title staff give the ticket for their own use.
Discord is based in the United States. Data you share with Discord is transferred there under Discord’s own safeguards, such as the EU–US Data Privacy Framework and its UK extension.
5. Who sees your data
- Other players see what the game shows them: your characters’ names and what they do in the world. They never see your email address. The public website shows the realm’s houses and factions, not players’ accounts.
- Our staff (the server’s administrators and management) can see accounts, their email addresses, characters, play time, the event log, the moderation record and the Discord support tickets you open in the control panel, so that they can run and moderate the server. The changes staff make there, such as bans and notes, are logged under their name. The control panel does not show the contents of in-game letters.
- Our hosting providers store the database and run the website and game server for us, and process the data only to do that.
- Discord, only as described above, if you link your account.
- Microsoft, through Clarity, only if you accept analytics cookies, as described in Visiting the website.
- Authorities, only if the law requires us to share something, or where it is needed to protect someone from serious harm.
6. How long we keep it
| What | How long |
|---|---|
| Your account, characters and game install identifier | Until you delete your account. Deleting it in Settings removes your email address and sign-in at once, and the game deletes your characters within seconds (or when it next starts, if it is down). |
| Website sign-ins (with IP address and user agent) | Until you sign out, or the sign-in runs out after going unused for 12 hours, or 30 days with “Remember me”. Expired ones are deleted within the hour. Deleting your account removes them all; changing your password removes those of your other browsers. |
| Sign-in and sign-up limits | In memory only, for 15 minutes. |
| Your Discord link | Until you unlink it or delete your account. An unfinished link attempt is deleted after 10 minutes. |
| Staff answers to Discord tickets | For as long as the server runs, so that staff can see who answered what. Your own ticket messages are never saved by the website; they stay in Discord. |
| The moderation record | For as long as the server runs, including after an account is deleted, so that a ban cannot be escaped by making a new account and staff can see a player’s history. You can ask us to review or remove an entry that is no longer needed. |
| Analytics, if you accepted them | Microsoft keeps Clarity’s recordings of visits for 30 days, and the heatmaps and totals made from them for up to 13 months. Recordings we mark to keep are kept up to 13 months. |
| The game’s event log | For as long as it is useful for settling disputes and moderation. Once an account is deleted, its entries no longer lead to an email address. |
7. Your rights
You have the right to:
- See your data and get a copy of it. Much of it is in your account already: your characters, your moderation history and your settings.
- Correct it if it is wrong. You can change your password in Settings; ask us to change anything else.
- Have it deleted. You can delete your account yourself under Settings; it takes effect at once.
- Take it with you: ask, and we’ll send your account and character data in a common, machine-readable format.
- Object to what we do on the basis of legitimate interests, such as keeping a moderation note, and ask us to restrict it while we look into a complaint.
- Withdraw your consent to the Discord link at any time, by unlinking it in Settings, and to analytics, with Cookie settings at the bottom of every public page.
To ask for any of these, contact the staff on our Discord (opens in a new tab). We may need to check that the account is yours before we act. We will answer within one month, and it costs nothing.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the UK’s Information Commissioner’s Office at ico.org.uk (opens in a new tab), or, in the European Economic Area, to the data protection authority of the country where you live.
8. Keeping it safe
The website is served only over an encrypted connection. Passwords are stored as salted, stretched hashes, never as the password itself. Your sign-in cookie can’t be read by scripts, and we store only a fingerprint of it, not the cookie itself. The control panel is open to staff alone, and the website’s own access to the database is limited to the tables it needs. No system is perfectly secure; if a breach put your data at risk, we would tell you and the regulator as the law requires.
9. Children
The website and the server are not meant for children under 13, and we don’t knowingly keep data about them. If you believe a child under 13 has made an account, contact us and we’ll delete it.
10. Changes to this policy
If we change what we keep or why, we’ll update this page and its date, and announce larger changes on our Discord.