Privacy
policy.

The controller of personal data is Piotr Oleszczyński, the creator of the game Evocatio. Contact: evocatio@evocatio.pl or the contact form.

• Player account — nickname, e-mail address, password (only as an Argon2id hash that cannot be read back), creation date, account status. Why: to run your account and let you play. Legal basis: the contract, i.e. using the account (Art. 6(1)(b) GDPR).
• Signed-in devices — browser and system type (e.g. “Chrome · Windows”) and sign-in dates. Why: so you can see where you are signed in and sign out everywhere. Basis: Art. 6(1)(b) and (f) GDPR.
• Sign-in attempts — e-mail and IP address of each attempt. Why: to block password guessing (after 10 failed attempts the account and address rest for 15 minutes). Basis: our legitimate interest in account security (Art. 6(1)(f) GDPR).
• E-mails — your address, to send the activation link, the password-reset link and important messages about your account. No advertising, no newsletter.
• Contact form — e-mail address, name or nickname (optional), topic and message. Why: to reply. You get one automatic reply that does not repeat your message. Basis: Art. 6(1)(f) GDPR.
• Technical server logs — e.g. the IP address when an account is created, errors. Why: security and fixing failures. Basis: Art. 6(1)(f) GDPR.
• Your character in the game — what you do in the game world is part of play and is saved in the world. Basis: Art. 6(1)(b) GDPR.

Giving data is voluntary, but without an e-mail address and a password you cannot create an account. We make no automated decisions about you and do not profile you.

• Account — until you delete it. On deletion your e-mail address and password hash disappear immediately; the nickname stays in the world chronicle as a pseudonym, not linked to you.
• Sign-in session — up to 30 days or until you sign out. Activation link — one hour; password-reset link — 15 minutes.
• Sign-in attempts with IP address — 15 minutes.
• Technical server logs — up to 30 days.
• Contact-form correspondence — as long as needed to reply and continue the conversation; we delete it on request.

We do not sell or share data with anyone for their own purposes. We use companies that process data on our behalf:

• Contabo GmbH (Germany) — the server running the website, accounts and the game;
• Zoho — the evocatio@evocatio.pl mailbox and automatic e-mails (ZeptoMail), in data centres in the European Union;
• Cloudflare (Turnstile) — only on the sign-up page: it checks that the account is being created by a person, not a program. In doing so it sees technical data about the connection and the browser (including the IP address) and does not use it for advertising or tracking — Cloudflare’s policy.

Data is stored in the European Union.

You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability and to object to processing based on our legitimate interest. Most of this you can do yourself in My account: download your data as a file and delete the account. For anything else write to evocatio@evocatio.pl.

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in your country.

An account can be created by a person aged 16 or over. Younger persons only with the consent of a parent or guardian.

The website uses no analytics, advertising or tracking. The only script from an external service is the Cloudflare Turnstile check on the sign-up page (described above) — fonts and all other files are on our server.

• evocatio_sesja — a strictly necessary cookie, only after signing in; keeps the session for up to 30 days. Scripts on the page cannot read it.
• Browser storage (localStorage) — the chosen website language, music player settings and a “signed in: yes/no” marker (no nickname, no session — only so the account button in the header does not flicker). They stay only with you.

The whole website runs over an encrypted connection (HTTPS). Passwords are kept only as an Argon2id hash. Changing the password signs you out on all devices.

We will announce important changes to this policy on the website. Version of: 24 October 2026.