What we collect, and what we do not
Short, because there is not much of it. This site has no analytics, no advertising and no third-party trackers, and it sets no cookies of its own.
This website
habitat2d.comReading these pages collects nothing. There is no analytics script, no advertising pixel and no social embed; the fonts and images are served from this server rather than a content network, so no third party is told which pages you looked at. The web server keeps ordinary request logs — an address, a page, a timestamp — for a short period to spot abuse and faults.
The one outside service any page loads is Cloudflare Turnstile, and only on the account form, where it is what stops the form being used by scripts. It sees your address and browser in order to do that.
Creating an account
seven things, and whyThe form asks for a login name, an email address, a password, a date of birth and a country, and records that you accepted the terms shown on the form. Nothing else is required, and we never ask for a real name or a photograph.
The email address is what confirms the account and is the only way to reach you about it. The password is stored hashed, never in a readable form. The date of birth is how the thirteen-and-over rule is kept — the date is stored, not just the answer. The country is recorded for the same reason a shop records one. Your acceptance is stored with the version of the terms you accepted and the moment you did.
The address you register from is held briefly to limit how many accounts one place can create in a day. It is anti-abuse, and it is not used for anything else.
The marketing email box is separate, off by default, and ticking it is the only thing that gives us permission to send anything that is not about your account.
Inside the world
what the world remembersThe world stores what a world has to: your name, your appearance, the things you own, your tokens, the room you were last in and the turf you rent. Staff actions — a warning, a move, a banishment — are written to a log with the name of the member of staff who took them, so that a decision can be looked at afterwards.
Conversation is not archived for us to read. The chat log lives in your own browser for the session and is not kept afterwards.
Asking us to erase it
and what we cannot yet doAsk us and we will erase the paperwork behind an account — the email address, the date of birth, the country and the consent record — or delete the account outright, whichever you ask for. We will tell you when it is done.
Two honest limitations while the world is young. There is no self-service password reset yet, so a forgotten password has to be sorted out by hand. There is no unsubscribe link yet either: withdrawing marketing consent is done by hand, the same day you ask.
How to reach us is on the contact page.