Arcan-Mafia — Privacy Policy
1. Overview
1.1 This Privacy Policy explains what personal information NodeCore LLC ("Company," "we," "us," or "our") collects when you play Arcan-Mafia (the "Game") at mafia.arcanum-forge.com, how we use it, who we share it with, and what rights you have regarding your information.
1.2 We collect the minimum data necessary to operate the Game. We do not sell your data, display advertising, or use your information for any purpose other than running the Game.
2. Information We Collect
2.1 Discord Account Data (via OAuth2). When you log in, Discord provides us with the following information:
| Data Element | Purpose | Stored? |
|---|---|---|
| Discord User ID (numeric) | Unique account identifier | Yes — permanently while account exists |
| Username & discriminator | Display name in-game and on leaderboard | Yes — updated on each login |
| Avatar hash | Display your profile picture | Yes — updated on each login |
2.2 Game State Data. We store data generated by your gameplay:
- Level, experience points, cash balance, and resource statistics
- Crimes committed, missions completed, and outcome history
- Items, weapons, vehicles, crew members, and properties owned
- Residence selection and current in-game address
- Active mission state and timestamps
- Leaderboard rank and visible stats
2.3 Session Data. We issue a signed session token (JWT) stored in a secure, httpOnly cookie named am_session that expires after 7 days. This token contains your Discord user ID and session metadata, and is used solely to authenticate your requests.
2.4 Server Logs. As with all web services, our infrastructure provider (Cloudflare) may log standard HTTP request metadata, including IP addresses, request paths, and timestamps, for security and operational purposes. We do not use this data to build user profiles.
2.5 Arcanum ID. Starting with the Beta 2 season, playing the Game requires a linked Arcanum ID account — a separate account/profile system covering Arcanum Forge as a whole. Arcanum ID's own data collection (which does include your email address and any profile, friends, or messaging data you create there) is governed by its own Privacy Policy at arcanum-forge.com/legal/privacy/, not repeated in this document.
3. How We Use Your Information
3.1 We use the information we collect for the following purposes:
- To authenticate you and maintain your game session
- To display your username and avatar to other players on the leaderboard
- To save and restore your game progress across sessions
- To enforce fair play, detect cheating, and prevent abuse
- To respond to support requests or account deletion requests
- To maintain the security and integrity of the Game
3.2 We do not use your information for advertising, profiling, behavioral tracking, or any purpose not listed in Section 3.1.
4. Information We Do Not Collect
4.1 We explicitly do not collect:
- Your Discord password or security credentials
- Your Discord messages, server memberships, or friends list
- Your real name, address, or payment information
- Browser fingerprints or cross-site tracking data
- Any data from your device beyond what is standard in HTTP requests
4.2 Regarding your email address: our Discord sign-in request includes the email permission alongside basic identity — this is solely so it exactly matches the permissions Arcanum ID requests, letting Discord skip its consent screen if you've already authorized one of the two. The Game itself does not store your email address. If you also have an Arcanum ID account (see Section 2.5), that separate system does store your email as described in its own Privacy Policy.
5. Cookies & Session Tokens
5.1 The Game uses a single session cookie: am_session. This cookie is:
- HttpOnly — not accessible to JavaScript, protecting against XSS attacks
- Secure — transmitted only over HTTPS
- SameSite=Lax — limited cross-site transmission
- Expiry — 7 days from issuance
5.2 We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookies.
6. Information Sharing & Disclosure
6.1 We do not sell, rent, or share your personal information with third parties for commercial purposes.
6.2 We may disclose information: (a) to comply with applicable law, legal process, or governmental request; (b) to enforce our Terms of Service; (c) to protect the rights, property, or safety of the Company, Users, or others; or (d) in connection with a merger, acquisition, or sale of all or substantially all of our assets, provided that the acquiring entity agrees to honor this Privacy Policy.
6.3 Your username and leaderboard statistics are visible to all players within the Game. If you prefer not to appear publicly, you may request Account deletion.
7. Third-Party Services
7.1 Discord. Authentication is handled via Discord's OAuth2 service. When you click "Continue with Discord," you are redirected to Discord's authorization page. Discord's Privacy Policy governs data processed on their platform.
7.2 Cloudflare. The Game is hosted on Cloudflare Pages and uses Cloudflare D1 for database storage and Cloudflare Workers for server-side logic. Cloudflare processes network requests as our infrastructure provider and is subject to Cloudflare's Privacy Policy.
7.3 We do not use Google Analytics, Meta Pixel, or any other third-party tracking or analytics services.
8. Data Retention
8.1 We retain your Account data for as long as your Account is active. Session tokens expire after 7 days.
8.2 If you request Account deletion, we will permanently delete your Discord ID, username, avatar, and all associated game data within 30 days of receiving your request.
8.3 During development phases, the Company may reset game data for all users. Notice of such resets will be provided where reasonably practicable.
9. Security
9.1 We implement reasonable technical and organizational measures to protect your information, including: HTTPS-only communication, httpOnly and Secure session cookies, signed JWT tokens with server-side validation, and Cloudflare's network security layer.
9.2 No method of transmission over the Internet or method of electronic storage is 100% secure. While we use reasonable security measures, we cannot guarantee absolute security of your information.
10. Children's Privacy
10.1 The Game is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a User is under 13, we will terminate their Account and delete associated data promptly.
10.2 If you believe a child under 13 has provided us with personal information, please contact us at the address in Section 13 so we can take appropriate action.
11. Your Rights
11.1 Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate data (note: username and avatar sync from Discord automatically)
- Deletion — request permanent deletion of your Account and all associated data
- Portability — request your game data in a machine-readable format
11.2 To exercise any of these rights, contact us using the information in Section 13. We will respond within 30 days.
11.3 We do not discriminate against Users who exercise their privacy rights.
12. Changes to This Policy
12.1 We may update this Privacy Policy from time to time. The "Effective Date" at the top of this page will be updated to reflect changes. We encourage you to review this Policy periodically.
12.2 Continued use of the Game after changes to this Policy constitutes your acceptance of the updated Policy.
13. Contact
13.1 For privacy-related questions, data requests, or to request Account deletion:
13.2 Please include "Arcan-Mafia Privacy Request" in the subject line of your email and provide your Discord username so we can locate your Account.