Gravhold · Privacy Policy

Privacy Policy

Last updated: 13 October 2026

This policy explains what personal data Gravhold collects, why, and what your rights are. The data controller is the Gravhold team, reachable at the contact address that will be published on this page (until then, through the staff in the game).

What we collect

Account: email address, account name, password (stored only as a salted hash, we cannot read it), date of registration and last login, the IP address used to register, and the date you accepted these terms.
Characters and play: character names, level, experience, skills, items, position in the world, guild, friends, outfits, shop purchases and Gravhold Points movements.
Language: when you open a page, we look at your IP address and the language of your browser to show the site in Portuguese to visitors from Brazil. This is used only for that page and is not stored. If you pick a language with the flags, a cookie remembers it.
Game sessions: when each game session starts and ends and how it ended (for example a lost connection), the type of device (phone, tablet or computer), operating system and browser, screen size, whether the screen is a touch screen, and how smoothly the game ran (frames per second).
Security: login sessions (with IP address and browser), failed login attempts (kept for one day), entry tickets to the game, and technical logs of connections (IP address, browser, time).
Moderation: reports sent by players and the actions taken by the staff.
News by email — only if you ask for it: whether you want news about Gravhold, and a record of each time you said yes or no (when, where — registration, your account or an unsubscribe link — from which IP address, and the exact wording you were shown), so we can prove your choice.
Emails you send us: if you write to an address @gravhold.com, we keep your message, its attachments, the sender address and the technical data of its delivery, to read and answer it.
Payments: if you pay for Gravhold Points, the amount and date of the payment. We do not store card data.
Visit statistics, without cookies — for every visitor: the page you open and when, the website or campaign link that brought you (only the name of the site, for example google.com or a TikTok campaign), the type of device, browser, operating system and language. To count visitors within a day without recognising them, each visit gets a code computed from your IP address and browser mixed with a random secret that changes every day and is deleted after two days: we do not store your IP address for this, nothing is saved on your device, and you cannot be followed from one day to the next. If you create an account, we keep with it the website or campaign of the visit just before you registered, so we know which channels bring players. If your browser sends Do Not Track or Global Privacy Control, we do not count your visits.
Where you came from — only if you accept statistics cookies: a random identifier, the pages you visit and when, the website or campaign link that brought you (for example a TikTok video, a YouTube creator or a search engine), and, if you create an account, the link between that history and your account, so we can see which campaigns bring players who stay. We do not use fingerprinting, and we do not share this with advertising networks.

Why, and on what basis

To create and run your account and the game, and to deliver what you buy — performance of the contract (the Terms of Service).
To protect accounts, prevent cheating and abuse, and enforce the rules — legitimate interest.
To make the game work well on phones, tablets and computers, using the game session data above — legitimate interest.
To keep accounting records of payments — legal obligation.
To count visits and see which websites and campaigns bring visitors and players, with the cookie-free statistics described above — legitimate interest (understanding and growing our audience, with data that cannot follow you across days). You can object at any time by writing to us, or by turning on Do Not Track or Global Privacy Control in your browser.
To follow your visits across days with the statistics cookie and improve our campaigns — your consent, which you can withdraw at any time.
To send you news about Gravhold by email — your consent, given by ticking the box at registration or in your account. Nobody is subscribed by default. You can stop at any time with the link at the bottom of every news email or from your account.
To answer the emails you send us — legitimate interest (and, when it is about your account, the contract).

Public information

Character names, levels, vocations, guilds, deaths and kills are part of the game and are shown publicly on the site (rankings, character pages, the live feed). Your email and account name are never shown to other players.

Who processes the data

Our servers are rented from Hetzner Online GmbH in Germany, where the website, the game pages (play.gravhold.com), the database, the game server and our incoming email run.
The fonts of the site are loaded from Google Fonts, which receives your IP address when a page loads.
We do not sell personal data, and we do not use third-party advertising or analytics trackers.

How long we keep it

Account and characters: while the account exists. If you ask us to delete it, we delete it, except what we must keep by law (payment records) or need for a short time to handle a dispute or a ban.
Sessions: until they expire. Failed logins: one day. Connection logs: a limited period, after which they are overwritten.
Game sessions: 13 months.
Cookie-free visit statistics: 13 months; the daily secret used to count visitors is deleted after two days. The source of the visit before registering stays with the account while it exists.
Statistics cookie and visit history: up to 13 months for the cookie; if you withdraw consent before creating an account, the history is deleted.
News by email: we stop as soon as you unsubscribe; the record of your choices is kept while the account exists, as proof of consent.
Emails you send us: as long as needed to handle them, and deleted with your account if you ask.

Your rights

You can ask to access your data, correct it, delete it, receive a copy, restrict or object to its use, and withdraw consent at any time (from Cookies, for the statistics cookie; from your account or the link in every news email, for the news). Write to the contact address that will be published on this page (until then, through the staff in the game) from the email of your account. You also have the right to complain to the data protection authority of your country (in Italy, the Garante per la protezione dei dati personali).

Cookies

Name	What it is for	Type	Lasts
`gh`	Keeps you logged in	Necessary	Session, or 30 days with "remember me"
`gh_csrf`	Protects forms from being sent by other sites	Necessary	1 day
`gh_ok`	Remembers your choice about cookies	Necessary	6 months
`gh_lingua`	Remembers the language you chose with the flags	Necessary	1 year
`gh_v`	Random identifier to measure where visitors come from and which campaigns bring players	Statistics — only with consent	13 months

The game also stores a few preferences in your browser (local storage), such as display settings. They never leave your device.

Children

Gravhold is not meant for children under 16 without a parent's permission. If you believe a child has given us data without it, write to us and we will delete it.

Changes

If this policy changes in an important way, we will announce it on the site and, where needed, ask for your consent again.