Privacy Policy

1. Who we are and what this covers

Ithoro LLC (“Ithoro,” “we,” “us,” or “our”) operates IdleBound and is the controller responsible for the personal information described here. This policy covers idlebound.com and its waitlist, the game in your browser and on desktop, guest and registered accounts, worlds and their multiplayer features, rankings, and support (the “Services”). Our contact details appear at the end.

Independent services, such as your browser, operating system, or email provider, have their own privacy notices for information they handle themselves.

2. Information we collect

Account and sign-in information

• Guest accounts: when you play as a guest we create an account with an identifier, a generated name such as “Guest 4821”, a placeholder address that is not a real email address, and the date it was made.
• Registered accounts, if you register one: your email address and your password, which we store only in a protected, hashed form.
• Sessions: each sign-in creates a session with a random token, its expiry, and the IP address and browser or device description (user agent) it came from. The game keeps the token on your device to stay signed in.

Characters and gameplay

• Each character’s name, world, look (body, hair, clothes, and equipment worn), level, experience, health and mana, gold, items and equipment carried, inventory space, mount, the map and position where it was last saved, and when it was made and last updated.
• Parties: which characters are in a party, who leads it, and invitations between characters.
• Which character is playing, on which world and channel, while you are online.
• What you do in the game, such as movement, attacks, pick-ups, purchases from in-game shops, and party actions. The world servers process these as you play to decide what happens; we keep the results above, not a history of every input.

Technical and security information

• IP addresses, used to count sign-in attempts so we can limit abuse, and present in routine server and network logs.
• Server logs and error reports, which can include an IP address, the time, the page or address requested, the browser or device description, and the account or character involved.
• Crash and error reports from the game: when the game crashes or hits an error, it sends a report of what went wrong and where in the game’s code, its last log lines, the game’s version, the device’s model, operating system or browser, language, time zone, processor, graphics, memory, and screen, the account’s identifier (before you sign in, a random identifier the game makes for its installation), and the world, channel, and character being played. Reports do not include your account name, email address, or messages. Our error-reporting provider receives your IP address with each report, as any server does; it is set not to store it, and keeps only the approximate location (country and city) it derives from it.

The waitlist

If you join the waitlist on this website: your email address, which of the site’s forms you used, and when. We also count sign-up attempts from your IP address for a few minutes to stop abuse, without storing it with your address.

When you contact us

If you email us, we receive your address, your message, and anything you attach, and we keep our replies.

What this website does not collect

idlebound.com sets no cookies and runs no analytics, advertising, or tracking scripts. Our hosting provider still processes the technical information needed to deliver pages and protect the site, as described in section 5.

3. How we use information

• To run the game: create and sign in accounts, save characters and their progress, run worlds and channels, decide what happens in play, show other players’ characters, run parties, and publish the rankings.
• To keep it fair and secure: limit sign-in attempts, detect cheating, bots, exploits, and abuse, investigate reports, and enforce our Terms of Service.
• To maintain and improve it: find and fix bugs, measure performance and load, and balance the game.
• To communicate with you: answer your messages and send service or security notices.
• To tell you about IdleBound, if you joined the waitlist: when it launches, and now and then with news.
• To meet legal obligations and establish, exercise, or defend legal claims.

Where a legal basis is required, we rely on performing our agreement with you (running the game you asked to play), our legitimate interests in keeping the Services secure, fair, and working (balanced against your rights), compliance with law, or your consent where we ask for it.

The world servers decide game outcomes automatically, such as hits, experience, and drops. We do not use automated decisions that produce legal or similarly significant effects about you.

4. What other people can see

• Other players see your character’s name, look, level, mount, and where it is and what it does on the map you share, and your party members see your character’s level, health, and whereabouts.
• Everyone can see the rankings on this website, which list characters by name, level, class, and world.

Your account name, email address, IP address, and other characters on your account are not shown to other players.

5. Service providers and when we share information

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

We share information only with providers that help us run the Services, under their contracts with us, and as described below:

When we start sending waitlist emails, we will use an email delivery provider acting for us, and we will name it here.

We may also disclose information when we reasonably believe the law requires it, to protect people, accounts, or the Services, or as part of a merger, acquisition, financing, or sale of assets, subject to appropriate protections. Providers and features can change as the Services evolve, and we will update this policy when they do.

6. Your device

The game stores your session token and settings, such as where you left its windows, on your device. In a browser, that is the game site’s storage. Clearing it signs you out, and for a guest account it means losing access (see the Terms).

7. The waitlist

Joining the waitlist means you ask us to email you about IdleBound: when it launches, and now and then with news. We use your address for nothing else, and we never sell it or share it for advertising. Every email we send will have a link to unsubscribe. You can also leave the list, or ask what we hold, by emailing support@ithoro.com from that address. Joining the waitlist does not create a game account.

8. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, to withdraw consent, and to appeal a decision about your request or complain to a data protection authority.

To make a request, email support@ithoro.com and identify the account: its email address, or for a guest account its guest name and a character’s name and world. We may need to verify that the account is yours, for example by asking for details only its owner would know. An authorized agent may make a request where the law allows, with proof of authority. We will respond within the time the law requires and will not discriminate against you for exercising a right.

You can delete a character yourself at any time, from the character screen or the game’s Settings, and your account, with every character on every world, from the game’s Settings.

9. Children

IdleBound is meant for players 13 and older and is not directed to children under 13. If we learn that we collected personal information from a child under 13 without the permission the law requires, we will delete it. A parent or guardian who believes this happened can contact us at support@ithoro.com.

10. Keeping and deleting information

We keep information only as long as we need it for the purposes above:

• Accounts and their characters, while the account exists.
• Sessions until they expire (30 days without use) or you sign out.
• Sign-in attempt counts for seconds.
• Server logs and error reports for a limited period, unless needed longer to investigate abuse or a security problem.
• Support emails as long as needed to answer you and keep a record of the request.
• Waitlist addresses until you unsubscribe or ask us to remove yours, or until we stop the emails you signed up for.

A deleted character is removed from the database at once, and its name may be taken by someone else. When an account is deleted, in the game’s Settings or by us at your request, we delete its sessions, characters, banks, friends lists, and party memberships at once. Copies in protected backups are removed on their regular schedule. We may keep information longer where the law requires it or to resolve disputes, prevent abuse, or enforce our Terms.

11. Where we process information

Ithoro LLC is based in the United States. Our database and game servers are in the United States, and Cloudflare serves the website from locations around the world. Where the law requires safeguards for international transfers, we rely on recognized mechanisms such as standard contractual clauses.

12. Security

We protect information with encrypted connections, hashed passwords, access controls, servers that only accept traffic through Cloudflare, limits on sign-in attempts, and server-side checks of everything the game sends. No system is completely secure. Protect your device and sign-in, and contact us if you think your account was accessed without permission.

13. Changes to this policy

We will post any update here with a new date. If a change materially affects your rights, we will give additional notice where reasonably possible and ask for consent where the law requires it.

14. Contact us

For privacy questions, requests, or complaints, contact us below. Please say it’s about IdleBound.