DuskarWiki
Log inPlay free

Privacy policy

Last updated: 30 October 2026

This policy explains what personal data Duskar collects when you visit duskar.com or play the game, why we collect it, who helps us process it, how long we keep it and what rights you have.

In short: we collect only what we need to run your account and keep the game fair. Duskar shows no ads, uses no analytics or tracking tools, sets no cookies of its own and never sells your data.

Who is responsible for your data

The controller of your personal data is Artur Rychcik Netshow.pl, a company registered in Poland (VAT number PL5711709563, REGON 361857749). You can reach us about anything in this policy at [email protected].

What we collect and why

Your account

When you sign up we store your email address, your display name, your password (only as a one-way hash, never in readable form), your language and the dates you signed up and confirmed your email address. If you change your display name, we keep your former names so other players can still recognise you.

We use this data to create and run your account, let you log in and send you the emails the account needs. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

If you arrived from a link that names an ad campaign (UTM parameters such as utm_source and utm_campaign) or from a link on another website, we store the campaign or the name of that website with your account. We use it only in aggregate, to see which campaigns bring players who stay in the game. The legal basis is our legitimate interest in knowing which of our promotion works (Art. 6(1)(f) GDPR).

If you sign up from another player’s invitation link, we store which player invited you, so that they can receive the rewards for inviting you. The player who invited you sees your display name and account level on their invitation page. The legal basis is the performance of our contract with that player and with you.

Your game

The game stores everything that makes up your progress: warriors, items, currencies, expeditions, fights, achievements, rankings, clan membership and settings. It also records when you were last active, so other players can see who is online and the game can welcome you back after a break. The legal basis is the performance of our contract with you.

What you write and upload

We store what you choose to put into the game: your profile description, avatar and banner images, trophy captions, warrior nicknames and notes, marketplace notes, clan names and texts, and your chat and private messages. Uploaded images are converted to a new file on our server, which removes any metadata embedded in them, such as a location.

Security and fair play

To protect accounts and stop cheating, we record your IP address in a few places:

  • when you sign up, to slow down mass sign-ups from one network (IPv6 addresses are shortened, and the record is deleted after 10 minutes),
  • when a login fails, together with the email address that was tried and the reason,
  • when you list or buy something on the marketplace, so that accounts on the same network cannot trade with each other,
  • when you redeem a promo code,
  • when you log in or your session is renewed, so that moderators can spot accounts run by one person, for example to keep invitation rewards fair (IPv6 addresses are shortened, and an address is deleted 12 months after you last used it).

We also count requests per IP address or account for up to one hour to limit abuse. When moderators act on an account, we keep a record of the action and the reason. The legal basis for this processing is our legitimate interest in keeping accounts secure and the game fair (Art. 6(1)(f) GDPR).

Bot protection with Cloudflare Turnstile

The sign-up form is protected by Cloudflare Turnstile, which tells people apart from automated scripts, usually without asking you to do anything. While you sign up, Turnstile runs in your browser and Cloudflare processes signals such as your IP address, your browser’s user agent and TLS fingerprint, and the website the form is on. Our server then sends the result token and your IP address to Cloudflare to confirm the check. Cloudflare processes this data on our behalf for bot detection, and as an independent controller to improve its bot detection. Details are in Cloudflare’s Turnstile Privacy Addendum. The legal basis is our legitimate interest in protecting the game from automated sign-ups.

Payments

Duskar does not accept real-money payments at the moment. Before it does, we will update this policy with the payment provider and the data involved.

What other players and visitors can see

Duskar is a multiplayer game, so some of your data is visible to others by design. Your display name, avatar, banner, profile description, trophies, clan, rankings, online status and parts of your game history, such as fight results and world-first awakenings, are visible to other players. Some of them also appear on public pages of duskar.com, such as player, clan and warrior pages and the world news on the homepage. A fight report becomes public only when you save it and create a link to it, and you can revoke that link. Chat messages are visible to everyone in the channel, and private messages to the people in the conversation.

Cookies and storage in your browser

Duskar does not set cookies and uses no analytics, advertising or tracking technologies. The game keeps a few entries in your browser’s local storage and session storage, all of them needed for the game to work:

  • your login session, so you stay signed in,
  • your preferences and interface settings, such as expedition and team options,
  • a short-lived handover of the session when you sign up on the homepage and continue in the game,
  • whether you closed the language suggestion on the homepage,
  • the number of the player whose invitation link you followed, for 30 days, so the account you create can credit them,
  • the ad campaign or the website you arrived from, for 30 days, so the account you create can record it.

You can remove them at any time by logging out or clearing your browser’s site data. Cloudflare, which protects and delivers our website, may set cookies that are strictly necessary for security. See Cloudflare’s Cookie Policy.

Emails we send

We send only emails related to your account: the link to confirm your email address, a reminder if you have not confirmed it yet, password reset links and, after a long break from the game, a message about the welcome-back package waiting for you. We do not send newsletters or advertising, and we never share your email address with other players.

Who processes data for us

We do not sell or rent personal data and we do not share it with advertisers. We use these service providers, who process data only on our instructions:

  • Hetzner Online GmbH (Germany) hosts our servers and database.
  • Cloudflare, Inc. (USA) delivers and protects the website, runs Turnstile, and stores uploaded images and our encrypted database backups.
  • An email delivery provider sends our emails.
  • Functional Software, Inc. (Sentry, USA), in its EU data region in Germany, receives technical error reports and the timing of requests, without your email address or IP address, so we can find and fix problems. Reports from the game in your browser contain the error, the address of the page without its parameters and the type of your browser and system.

We may also disclose data when the law requires it, for example to answer a valid request from a court or authority.

Transfers outside the European Economic Area

Cloudflare operates a global network, so some data may be processed outside the European Economic Area. Sentry stores our data in the EU, but it is a U.S. company, so its staff may access the data from the U.S. Both are certified under the EU-U.S. Data Privacy Framework and also use the European Commission’s Standard Contractual Clauses.

How long we keep your data

  • Account and game data: for as long as your account exists.
  • Unconfirmed accounts: if you never confirm your email address and do not play for 30 days, we delete the account.
  • Chat and private messages: 30 days.
  • Failed logins, game event logs and fight reports: 30 days. Fight reports you save (up to 50) stay until you delete them.
  • Sign-up IP records: 10 minutes.
  • Request counters for abuse limits: up to 1 hour.
  • Marketplace and moderation records: 12 months.
  • Login IP records: 12 months after you last logged in from that address.
  • Server error logs: only a small amount, overwritten as new entries arrive.
  • Backups: our encrypted database backups are replaced within about five weeks, so deleted data disappears from them within that time.

Deleting your account

You can delete your account at any time in the game settings by confirming your password. Your email address, display name and password are erased, all your sessions end, and your profile, uploaded images, saved fight reports, former names, favourites, blocks, list of private conversations, open marketplace offers and the IP addresses stored with your logins, marketplace sales, promo codes and failed logins are removed. Your chat and private messages lose their author and are deleted with the rest of the chat after 30 days. If you lead a clan, leadership passes to the longest-serving member, and a clan with no other members is dissolved.

Game records that other players’ histories depend on, such as fights, trades and warriors, stay in the game under an anonymous account number, and in other players’ histories your name is replaced by that number.

Your rights

Under the GDPR you have the right to:

  • access your data and take it with you: you can download your data as a file in the game settings,
  • correct it: you can change your display name, email address and password in the game settings,
  • delete it: you can delete your account in the game settings,
  • restrict or object to processing based on our legitimate interests,
  • lodge a complaint with a data protection authority, in particular in the EU country where you live or work. The authority responsible for us is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

For anything you cannot do in the game yourself, write to [email protected]. We answer within one month.

Security

All traffic to Duskar is encrypted with TLS, passwords are stored only as strong one-way hashes, backups are encrypted and access to servers is limited to the people who run the game.

Children

You must be at least 13 years old to create a Duskar account. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, write to [email protected] and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. If a change significantly affects how we use your data, we will tell you in the game before it takes effect.