Idlebound

Privacy Policy

Effective and last updated: July 25, 2026

1. Scope and who we are

This Privacy Policy explains how Ithoro LLC ("Ithoro," "we," "us," or "our") handles information in connection with Idlebound, including the game, website, accounts, multiplayer features, support, and related services that link to this policy (collectively, the "Services"). Ithoro LLC is the controller of personal information covered by this policy.

A third party platform, such as an app store or game distribution platform, may separately process information under its own privacy policy. This policy does not control an independent third party's practices.

2. Information we collect

We collect information from you, automatically from your device, and from service providers.

Account and contact information

• Email address, verification status, account identifier, and account creation date.
• Password credentials in protected, hashed form. We do not store your password in readable form.
• Guest account identifier, login sessions, verification requests, and account linking records.
• Marketing preference and communications you send to support.

Profile and gameplay information

• Character names, appearance, class, level, statistics, progression, quests, skills, inventory, equipment, game currency, map position, and hotbar settings.
• Friends, parties, blocks, trades, in game mail, task history, leaderboard results, and related multiplayer activity.
• Game events needed to save progress, balance the game, investigate errors, and enforce game rules.

Social, moderation, and user content

• Chat messages, character names, and other content you choose to make available.
• Player reports, blocked player records, moderation actions, bans, and appeal information.
• Support requests, feedback, and other communications with us.

Device, network, and security information

• Internet Protocol address and network subnet, browser or user agent, client version, platform, login timestamps, and login success or failure details.
• A randomly generated identifier stored on your installation and a hashed device fingerprint used for security, fraud prevention, abuse detection, and account linking.
• Operating system, device model, screen dimensions, locale, time zone, graphics processor vendor and model, processor count, and similar technical details used to create and assess that fingerprint.
• Service logs, request records, approximate region inferred from an Internet Protocol address, and diagnostic information.

Platform and transaction information

If you use Idlebound through a third party platform, we may receive the platform identifier, transaction identifier, product or subscription plan, entitlement, region, currency, and purchase, renewal, expiration, cancellation, refund, reversal, or chargeback status that the platform makes available to operate the game. We do not currently collect or store full payment card numbers. A platform or payment provider processes payment information under its own privacy policy.

Information we do not want

Please do not send government identifiers, financial account numbers, precise location, health information, or other sensitive personal information through chat, character names, or support unless we specifically request it for a lawful purpose.

3. How and why we use information

We use information for the following purposes:

• Provide the Services. Create and authenticate accounts, link guest accounts, save progression, run gameplay and multiplayer features, deliver requested communications, process transactions, verify and restore entitlements, administer subscriptions, and provide support.
• Protect players and the Services. Detect cheating, bots, account farms, fraud, unauthorized access, harassment, exploits, and other violations. We also use information to investigate reports and enforce our Terms of Service.
• Maintain and improve Idlebound. Diagnose errors, understand feature performance, balance gameplay, develop updates, and maintain service reliability.
• Communicate with you. Send verification and security messages, respond to support, provide service, purchase, subscription, renewal, price change, trial ending, cancellation, and account deletion notices, and send marketing only when permitted and consistent with your preferences. A billing platform may send some transaction notices directly under its own privacy policy.
• Comply with law and protect rights. Meet legal, tax, accounting, platform, safety, and regulatory obligations and establish, exercise, or defend legal claims.

Where a legal basis is required, we process information as needed to perform our agreement with you, comply with law, pursue legitimate interests such as service security and improvement, or with consent. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

4. How we disclose information

We may disclose information in the following circumstances:

• Service providers. Vendors that provide hosting, content delivery, email, databases, caching, security, monitoring, and technical support. Cloudflare provides parts of our hosting, network protection, and transactional email infrastructure.
• Platforms. App stores, game distribution platforms, and device platforms when needed to distribute Idlebound, process purchases or subscriptions, verify entitlements, handle cancellations or refunds, prevent fraud, or support platform features.
• Other players and the public. Information you make visible through multiplayer features, as described below.
• Legal and safety reasons. Authorities, regulators, courts, or other parties when we reasonably believe disclosure is required by law or needed to protect people, rights, property, or the integrity of the Services.
• Business transactions. A buyer, investor, adviser, or successor in connection with a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate protections.
• At your direction. Other parties when you ask us to share information or give valid consent.

We do not sell personal information for money. We also do not share personal information for cross context behavioral advertising and do not use personal information for targeted advertising.

5. Public and social features

Character names, appearance, equipment, chat messages, leaderboard entries, and some multiplayer activity may be visible to other players or the public. Do not include your real name, contact details, or other personal information in public fields. Other people may save or redistribute information you make public, and we cannot control their actions.

6. Retention and deletion

We keep information only for as long as reasonably needed for the purposes described here.

• Verification codes are designed to expire after 10 minutes. Incomplete signup records are designed to expire after 30 minutes.
• Normal login sessions are designed to expire after 7 days.
• Account and gameplay information is generally kept while your account is active. If you delete your account, associated account and character records are deleted or deidentified, subject to the exceptions below.
• Chat, moderation, transaction, security, fraud prevention, and diagnostic records are kept for a period reasonably necessary to protect players, enforce our rules, resolve disputes, meet legal obligations, and maintain the integrity of the Services.

We may retain limited information longer when required by law, needed for security or fraud prevention, necessary to resolve a dispute, or stored in protected backups that are deleted on a scheduled cycle. We may retain deidentified information that cannot reasonably identify you.

7. Your privacy rights

Depending on where you live, you may have the right to request access, correction, deletion, restriction, objection, or portability of personal information. You may also have the right to withdraw consent, appeal a denied request, or complain to a data protection authority.

To make a request, email support@ithoro.com. Describe the request and identify the account involved. We may need to verify your identity before acting. An authorized agent may submit a request where permitted by law, but we may ask for proof of authority and verification from the account holder.

We will not discriminate against you for exercising a privacy right. Some information may be exempt from a request, including information we must retain for security, legal compliance, fraud prevention, or the rights of others.

California notice at collection

In the preceding 12 months, we may have collected the categories described above, including identifiers, Internet or electronic network activity, commercial or entitlement information, approximate location inferred from an Internet Protocol address, and inferences used for security and fraud prevention. We collect and disclose these categories for the business purposes described in Sections 3 and 4. We do not sell or share these categories for cross context behavioral advertising. California residents may request to know, correct, or delete covered information by contacting us.

European Economic Area, United Kingdom, and Switzerland

You may contact us to exercise applicable data protection rights. You may also lodge a complaint with the data protection authority where you live or work. When we rely on legitimate interests, you may ask for information about our balancing assessment.

8. Children

The Services are intended for a general audience and are not directed to children under 13. Children under 13 may not create an account or use the Services. If you are under the age of legal majority where you live, a parent or legal guardian must review and agree to the Terms of Service with you.

If we learn that we collected personal information from a child under 13 without legally valid permission, we will take reasonable steps to delete it. A parent or guardian who believes a child provided information should contact us at support@ithoro.com.

9. International processing

Ithoro LLC is based in the United States. We and our service providers may process information in the United States and other countries whose laws may differ from those where you live. Where required, we use recognized safeguards for international transfers and honor applicable local rights.

10. Security

We use administrative, technical, and organizational measures designed to protect information, including protected credential storage, access controls, and service security monitoring. No system or transmission is completely secure, so we cannot guarantee absolute security. Please use a unique password and contact us if you suspect unauthorized access.

11. Changes to this policy

We may update this Privacy Policy as the Services or legal requirements change. We will post the revised policy and update the date above. If a change materially affects your rights, we will provide additional notice when reasonably possible and obtain consent when required.

12. Contact us