Privacy Policy
Effective date: 4 October 2026
This policy explains how Tamalaya ("we", "us") handles personal data when you use the game and website at tamalaya.com. We act as the data controller. Contact: info@tamalaya.com.
Data we collect
- Account data: username, email address, and a securely hashed password.
- Usage data: characters you create, in-game actions, and interactions such as trades and messages.
- Technical data: IP address, login timestamps, and session information, recorded when you connect.
- Server logs: our web and game servers keep access and error logs (including IP addresses) for security and troubleshooting.
Purposes and legal bases
- Provide and operate the Service and manage your account — performance of a contract.
- Keep the Service secure, prevent abuse, and troubleshoot — legitimate interests.
- Comply with legal obligations — legal obligation.
- Send essential service emails (such as account verification) — performance of a contract.
Cookies and local storage
We use only strictly necessary cookies and functional browser storage. We do not use advertising, tracking, or analytics cookies.
| Name | Type | Purpose |
|---|---|---|
| sessionid | Cookie | Keeps you logged in. With "Remember me" selected it is stored for up to 14 days; otherwise it is deleted when you close your browser |
| csrftoken | Cookie | Protects forms against cross-site request forgery |
| evenniaFontFamily, evenniaFontSize | Local storage | Remembers your webclient display preferences |
| evenniaMessageRoutingSavedState, evenniaGoldenLayoutSavedState, evenniaGoldenLayoutSavedStateName | Local storage | Saves your webclient panel layout |
| tamalaya_cookie_notice | Local storage | Remembers that you dismissed the cookie notice |
Because these are strictly necessary or set at your request, they do not require prior consent. Your browser lets you delete or block them, though some features may then not work.
Third-party services
The website loads some stylesheets and scripts from third-party content-delivery networks. When your browser fetches these, your IP address is shared with those providers. We currently use:
- jsDelivr, cdnjs, and BootstrapCDN — layout and JavaScript libraries (Bootstrap, Popper).
- jQuery CDN — the jQuery library.
- GoldenLayout — the webclient windowing library.
These providers do not receive your account details from us. We are working to self-host as much of this content as possible.
Retention
- Account data is kept while your account is active, and deleted on request or when no longer needed.
- The session cookie is stored for up to 14 days if you choose "Remember me", or deleted when you close your browser if you do not.
- Web server access and error logs are rotated and kept for up to 14 days.
- Game server logs are kept for security and troubleshooting and rotated periodically.
Sharing
We do not sell your personal data. We share it only with the infrastructure providers that host the Service, the third-party content networks listed above, and where required by law.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, or object to processing of your data, and to data portability. You can delete your account in-game. To exercise your rights, email info@tamalaya.com. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Passwords are stored hashed, connections to the site use HTTPS, and access to server data is restricted. No system is perfectly secure, so please use a unique password.
Children
The Service is intended for users aged 16 and over. If you believe a younger person has created an account, contact us and we will remove it.
Changes
We may update this policy; the effective date above will change, and material updates will be announced on the site.
Contact
Questions or data requests: info@tamalaya.com.