Privacy Policy (English)

Last updated 18 October 2026 · Operator: Sigil Online team · The Thai text above is the main version.

This page explains what Sigil Online (sigil-online.shop) stores, why, for how long, and how to ask for deletion. We keep only what the game needs.

1. What we store

• Account: account name, creation date and a password hash (scrypt); we never store your password itself. Guest accounts have no password.
• Sign-in: your login token lives in your browser; the server keeps only its hash, valid 30 days, at most 20 per account.
• Sign in with Google: we receive your Google user id (sub) and email and store them to link your game account. We never receive your Google password and do not store your name or picture. New Google accounts get a random account name (g_…), not the email.
• Game data: characters and saves (level, class, items, gold, position, etc.), crystals and their history, achievements, card album, storage, guild, friends, partner, in-game mail, market listings, trade history (last 50 per character), PvP and mini-game ranks.
• Chat: chat and whispers pass through the server; it remembers about the last 400 lines in memory only (gone on restart). When a player files a report, the recent chat of the people involved is saved with the report for the team to review. In-game mail is kept until it is taken or deleted.
• IP address: used in memory for rate limits (e.g. rapid sign-ups or logins), not written to the database. The site runs through Cloudflare, which sees IP addresses as part of its service.
• Error reports: when the game page hits an error, the browser sends the error text, file and line, browser/device type, map, version and account number. Stored as daily files, 50 MB in total, oldest first out.
• Moderation: mutes, bans, team notes, player reports and cheat flags.
• VIP top-ups: amount, crystals, VIP level, transaction reference and time. If slip upload is used, the slip picture is sent to SlipOK (slipok.com) for checking, and SlipOK keeps a record to stop reuse; our server does not save the picture.
• Totals: server-wide daily gold in/out and online counts, not tied to a person.

2. Why

To let you play and save progress; to run multiplayer features (chat, party, guild, trade, market, mail); to stop spam and cheating and keep the community safe; to fix bugs and watch the game economy in totals; and to keep VIP and crystal records correct. We do not sell, rent or trade your data, and there are no ads or ad trackers.

3. How long

Account and character data are kept while the account exists, plus server database backups for recovery. Login tokens expire after 30 days, chat in memory is gone on restart, error reports roll off when the folder is full. Closed beta (CBT): when the CBT ends, all game data (characters, levels, items, crystals) is wiped; we keep only the list of CBT accounts to give a keepsake at launch.

4. Cookies and browser storage

localStorage holds your login token, last account name, language, sound, zoom, game settings, skill combos and offline save, in your own browser; clear the site data to remove them. Cookies: only a short HttpOnly cookie (10 minutes) during Google sign-in to stop forged requests, and the team's admin-page cookie. No ad or tracking cookies. Page fonts load from Google Fonts, which sees your IP address as part of that service.

5. Access and deletion

Delete a character yourself on the character screen (type its name to confirm); a character still tied to a guild, partner, market listing or unclaimed mail must be freed first. To delete the whole account, unlink Google or get a copy of your data, email [email protected] with your account or character name; the team checks that you own the account first.

6. Changes

If the game starts keeping something different, we update this page and its date. Contact: [email protected]