Arkhelm Online Privacy Policy
Last updated: 1 November 2026 (card reference ID from Stripe · chargeback tracing · encrypted backups on Cloudflare R2) · 31 October 2026 (added Sign in with Google) · Effective date: 1 November 2026
1. Data Controller
Arkhelm Studio runs the game; it is maintained by SD, the developer of Arkhelm Online. For accounts and personal data contact: email [email protected] · the “Report a problem / Suggestion” button in-game (Menu > System) · or Discord https://discord.gg/FFwXN7d8m if you can’t log in
2. Data We Collect
| Data | Purpose |
|---|---|
| Username and password stored as a hash, never as readable text | To log in and to keep your account secure |
| Only for those who choose to sign in with Google: the Google account ID (a numeric account identifier sent to us by Google) and the email address of that Google account We do not store your Google password, name, profile picture, or any other data in your Google account | To sign in with Google and to verify that you own the account when you request account recovery (your email is not used to send advertising) |
| Character and gameplay data (level, items, in-game money, quests, friends, in-game mail) | To provide the game service |
| In-game purchase/sale and trade history | Investigating bugs and lost items, and preventing cheating · when a refund is requested through a bank/card issuer (chargeback), the team traces which accounts the items from that payment went to (using trade history and login IP/device ID) to recall them under Terms section 3; the team makes every decision itself |
| Access history: IP address, a randomly generated device ID created by the game, time, and connections | To investigate gameplay problems and account security, and to prevent cheating and rule-breaking use of multiple accounts |
| Character names and chat messages sent to other players in the game | To show your identity and communicate in the game. Other players may see this data |
| Top-up history (diamond top-ups/packs): account, amount, date and time, the transaction reference number from Stripe, status (pending/received/failed/refunded/distributed), and a record of your acceptance of the terms (version, time, amount) We do not store card numbers, bank account details, or the name or email you enter with Stripe · Card payments: we store the payment method (card/Link/PromptPay) andthe card reference ID Stripe sends us (card fingerprint, not the card number; used to recognise the same card) | Granting diamonds and titles at OBT, calculating bonuses from each account’s cumulative total, refunds under Terms section 3, detecting unusual transactions, preventing one card from claiming the first top-up bonus on several accounts, applying the trade hold for new cards, and accounting/tax |
| Messages you send through the report button, along with data the system attaches (character name, map, position, time, ping/FPS values, browser type, and screen size) | To investigate and fix bugs, improve the game, and respond to account/data requests |
| Tester rewards: bug reports accepted by the team (report number and account) and the highest level the account reached during the CBT | To distribute tester rewards at OBT |
| Anonymous game performance data (about once a minute while playing): frame rate (frames per second), graphics quality level, map, device type (iOS/Android/PC), graphics chip group, screen size range, and game load time Not linked to any account or character | To make the game run smoothly on mobile and low-spec devices (stored as aggregate figures for no more than 120 days) |
| Local settings on your device (sound, graphics, shortcut keys) | Stored in your own browser and not sent to the server (except Auto settings, which are saved with your character) |
We do not collect your real name, address, phone number, or national ID number, and we do not sell data to others.
3. Legal Bases
- Performance of a contract (providing the game service under the Terms of Service)
- Legitimate interests (anti-cheating and system security)
- Compliance with laws applicable to the service (including keeping payment receipt records as required by accounting/tax laws)
4. Retention Period
- Character and gameplay data: may be reset during testing and, as planned, will be wiped when the CBT ends, as announced to testers.
- Account data, access/trade history, and other necessary data: kept throughout the CBT and for no more than 90 days after the CBT ends (to review outstanding reported issues), then deleted, except where the law requires us to keep it / backups are kept for 7 days and then deleted automatically / problem report messages are kept for the same period as account data.
- Wiping character data does not mean your account and all history are deleted at the same time. To delete your account or ask about your data, please contact us through the “Report Problem / Feedback” button in the game (Menu > System), or the game's Discord group if you cannot log in.
- Top-up history and tester rewards: Not wiped when the CBT ends Kept until the OBT distribution of diamonds/rewards (or refunds) is complete, and after that for as long as accounting/tax laws require [SD to verify the period] · Accounts with top-up history or pending rewards are not deleted under the 90-day schedule above, so that the rewards can be delivered. You may request deletion, but you will forfeit your right to receive diamonds/rewards.
5. Disclosure of Data
- Information displayed in the game, such as character names and chat messages, may be seen by other players as part of that use.
- Apart from what is displayed in the game, we disclose data only when required by law or to necessary service providers, such as Cloudflare, which relays connections; Google (only when you choose to sign in with Google: you log in with Google directly under Google's policy, and Google sends the game only your account ID and email); and Stripe (Stripe Payments (Thailand) Ltd.), the payment processor, which receives your payment details directly from you under Stripe's policy and sends back to the game only the transaction result (reference number, amount, status).
- Data is stored on a rented server (VPS) from VisperHost in Thailand (Bangkok), connected through Cloudflare (during the CBT).
- Database backups areencrypted before leaving the serverand stored on Cloudflare R2 (Cloudflare’s file storage, which may be outside Thailand) every hour, kept for up to about 2 months. Cloudflare cannot read the contents; they are used only to restore data if the server is damaged
6. Your Rights
You may request access, a copy, correction, deletion of your account and data, object to or restrict use, withdraw consent, and complain to the Personal Data Protection Committee Office — contact email [email protected], the “Report a problem / Suggestion” button in-game (Menu > System) or the game’s Discord group if you can’t log in. We will reply within 30 days
7. Security
Connections are encrypted (HTTPS/WSS), passwords are one-way hashed, password attempts are rate-limited, and data is backed up regularly. If a data breach affects you, we will notify you as required by law.
8. Children
Users under 18 must have parental consent before using the service.
9. Changes to This Policy
We will announce changes in the game or through official channels before they take effect.