Privacy Policy

This Privacy Policy explains how Shiplanet ("we", "us", "our"), the operator of Shiplanet (the "Game" or "Service") and this website, collects and uses personal information, and the choices you have. We are established in Türkiye and are the data controller for the information described here. This policy is part of, and should be read with, our Terms of Service.

Shiplanet is a game, not a data business. We collect the least we need to run your account and the game world, and we explain below exactly what that is, and what we deliberately do not collect.

We collect the following, most of it directly from you:

• Account details. Your ShipID and a securely hashed password (we never store the password itself). For guest accounts, an identifier for the device that created the account, so your progress is tied to that device until you upgrade to a full ShipID.
• Date of birth. Collected at sign-up to confirm you meet the minimum age, and to apply the age gate.
• Recovery email (optional). Only if you add one. Used to send password resets, to verify your email, to approve two-factor sign-in if you enable it, to send account-security notices, and to reply to your support requests.
• Two-factor and device data. If you turn on two-factor sign-in, we record which browsers or devices you have approved and when, so an approved device can skip re-approval for a limited time.
• Game, progress, and profile data. Your inventory and clothing, diamonds, level and experience, how long you play, the land, worlds, and locks you hold and who you have granted access to, your trades, market orders, and any purchase or entitlement records, your quick-slot and in-game preferences, a self-declared country flag, and a self-chosen character appearance, if you set them.
• Content you create. The Game stores the things you build and write so they persist for you and other players, such as world names, sign, door, and portal text, bulletin-board posts, gift messages, and your builds. Chat and private messages are delivered in real time and are not stored as a chat history, except where they are included in a report you or another player submits.
• Support and safety data. If you contact support, submit an appeal, or report or block a player, we keep your message, the email you gave, the account references involved, and any content you include (such as a quoted chat message) so we can respond and keep the Game safe.
• Usage and diagnostic data. We record pseudonymous usage events (such as signing in or entering a world) and crash and error reports on our own servers, to understand how the Game is used and to fix problems. A crash or error report can include technical details such as your device type and operating system, the app version, and the error message and related log lines. These are tied to your account identifier, never to your name or email, and you can turn them off in the game settings.
• Limited technical data. To deliver the Service and keep it secure, our servers necessarily process connection data (such as your network address) in the moment, for example to apply rate limits and block abuse. As described below, we do not build a stored profile of it or geolocate it.

• We do not store or geolocate your IP address as part of your account. The country flag beside your name is one you choose yourself; it is never derived from your connection.
• We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.
• We do not run third-party advertising or tracking pixels on your account, and we do not use your email for marketing.
• We do not knowingly collect more than what is described in this policy.

We use the information above to:

• Create and run your account, and provide the Game and its features.
• Keep the Service secure: authenticate sign-ins, operate two-factor, prevent fraud, cheating, and abuse, and enforce our Terms.
• Respond to your support requests and appeals, and send account emails such as password resets, email verification, and sign-in approvals.
• Apply the minimum age requirement.
• Keep the community safe: handle reports and blocks, and moderate content.
• Comply with legal obligations and respond to lawful requests.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Performance of a contract to create and run your account and provide the Game under our Terms.
• Legitimate interests in keeping the Service secure, preventing fraud and abuse, and operating and improving the Game, balanced against your rights.
• Consent where you choose to add a recovery email or enable optional features; you can withdraw consent at any time.
• Legal obligation where we must process information to comply with the law.

When you sign in on this website we set a small number of strictly necessary, first-party cookies. We do not use advertising or cross-site tracking cookies.

• sp_session keeps you signed in. It holds your session token, is httpOnly (scripts in your browser cannot read it), and lasts up to 30 days.
• sp_device is a per-browser identifier used for two-factor trust, so an approved browser can skip email approval for a limited time. It is httpOnly and lasts up to one year.

These cookies are required for the site to work; blocking them will prevent you from signing in. Signing out or deleting your account clears the session.

To understand aggregate traffic, such as which pages are popular and where visitors arrive from, we use Vercel Web Analytics, a privacy-friendly, cookieless analytics service. It sets no cookies, does not track you across other sites, and does not build a profile of you, which is why this site needs no cookie-consent banner.

We do not sell your information. We share it only in these limited cases:

• Service providers. Vendors that process data on our behalf under contract and only on our instructions, such as our hosting and infrastructure provider (Hostinger, in the European Union) and our transactional email provider (Resend, in the United States, used to send account and support emails).
• Error monitoring. A diagnostic error-monitoring provider (Sentry, hosted in the European Union) that receives technical error and crash reports from our servers, website, and game client so we can find and fix problems. These reports are stripped of identifying information (no name, email, IP, or account credentials) and are used only for diagnostics.
• Website analytics and hosting. Our website is hosted on Vercel (in the United States), which also provides the cookieless, aggregate traffic analytics described in the Cookies section. It does not receive your account password or game data.
• App stores and payment processors. If you buy something, the store you buy through (for example Apple or Google) processes your payment under its own privacy policy. We do not receive your full payment details.
• Legal and safety. Where we reasonably believe it is required to comply with the law, enforce our Terms, or protect the rights, safety, and property of our players, the public, or us.
• Business transfer. In connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this policy.
• Other players. Some information is public within the Game by design, such as your display name, self-declared flag, chat and messages you send, the land you hold, and your builds. Do not share anything in-game you want to keep private.

We keep account information for as long as your account is active. When you delete your account, we remove your personal information from our live databases, and the land you owned is released back to unclaimed. Some limited records may be kept where we have a legal or legitimate need, for example a minimal, non-identifying economy audit log, and records needed to prevent fraud or ban evasion, each kept only as long as necessary. Any support tickets or ban appeals you filed are anonymized rather than erased: your reply-to email and the link to your account are stripped, while the message itself is retained so we can keep a moderation and safety record. Residual copies may persist briefly in backups before being overwritten on our normal cycle.

Passwords are hashed with bcrypt and never stored in plain text. Actions that affect your account and the game world are validated on our servers, so your inventory, land, and trades cannot be forged by a modified client. The website session cookie is httpOnly, optional two-factor sign-in adds a second step, and password reset and account-lookup flows are designed so they cannot be used to reveal whether an account exists. No method of transmission or storage is completely secure, so while we work to protect your information we cannot guarantee absolute security.

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it. Where a higher minimum age applies in your country, that age applies to you.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these directly:

• View and update your account details, recovery email, and preferences from your account page.
• Delete your account at any time from the account page. Deletion is permanent and cannot be undone.
• For any other request, contact us using the details below. We may need to verify your identity, and we will respond within the time the law requires.

If you are in Türkiye, you have rights under the Law on the Protection of Personal Data No. 6698 (KVKK), including to learn whether your data is processed and request information about it, to ask for correction or deletion, and to object to results produced solely by automated analysis. You may apply to us using the details below and, if unsatisfied, complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

If you are in California, we do not sell or share your personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Shiplanet is operated from Türkiye, and we and our service providers may process your information in countries other than where you live, whose data protection laws may differ from yours. In particular, our servers and databases are hosted in the European Union (Lithuania) with Hostinger, our diagnostic error and crash reports are processed in the European Union by Sentry, our website is hosted and its cookieless traffic analytics processed by Vercel in the United States, and our transactional email is sent through Resend in the United States.

Where personal information is transferred across borders, including from the European Economic Area or Türkiye to a country without an adequacy decision, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses in our agreements with these providers, so that your information is protected consistently with this policy and applicable law.

Shiplanet is in active development, and this policy may change as the Game grows. When it does, we will update the "Last updated" date above and, where the change is material, take reasonable steps to notify you. Continued use of your account after a change means you accept the updated policy.

For any question or request about this policy or your information, reach us through our contact page or at [email protected]. If a formal data controller address is required in your jurisdiction, it will be published here before launch.