Privacy notice

Last updated 2 November 2026

BalenaScape is run by one person, the owner. We collect as little as we can. This notice explains what we store, why, where and for how long, as required by the GDPR.

What we store

Your account: your username and your password as a salted scrypt hash. We never store the password itself.
Your game progress: your levels, items, bank, quests, appearance, position, Exchange offers and similar game data, plus when your account was created, when you last logged in and how long you have played. This includes your bank tabs and loadouts, and the results of your flower poker games of the last 90 days, so that a game cut short by a crash can still be settled.
Chest limits: to limit how many chests one player or one connection can find, the game keeps the times of the chests found in the past hour, per username and per IP address. Older times are deleted automatically.
YouTube status: if staff give you the YouTube status, your username is kept on that list until they take it away.
Friends: your friends list, your ignore list and your private chat setting (On, Friends or Off) are stored with your account. Whether you show as online to others follows that setting.
Login protection: a short, salted hash of the addresses of your last 5 successful logins, so that password guessing from other places can be slowed down. The addresses themselves are not saved with your account.
Protection against fraud and bots: to keep banned players and bots out, the game checks whether you connect through a VPN, VPS or hosting network, keeps a random identifier and some technical details of your browser, and uses a few counts about how the game is played (never your keys, text or clicks). Which accounts used which identifier is kept on our own server for 90 days after the last login, or until a ban is lifted. Nothing is shared with anyone.
Server log: when you create your account and when you log in, the server log records your username and IP address. Failed login attempts are logged too, never with the password, and so are connections that break the limits (for example by sending far too much), with their IP address. The login protection, the account sign-up and the connection limits also count attempts per IP address in memory for a short time. Requests for the lists on this website (the hiscores and the deepest dives) are counted per IP address for one minute, to limit how many one connection can make; they are not logged or saved.
Staff audit log: every use of a staff command by a member of staff, such as a mute or a ban, is written to a separate log with the time, the username, the rank and the IP address, and so are rank changes, bans and password changes (only that a password was changed, never the password itself). The log also records some exchanges of value between players, such as Wilderness blood money, flower poker games and world boss rewards, with the usernames and IP addresses involved. Significant poker-room pots are recorded with usernames, cards and coin results, along with flags for suspicious transfers between players.
Poker hand history: after each completed hand in the poker room, a separate history records the table, times, usernames, cards (including folded and unshown cards), decisions, stakes and results. Staff can review completed hands to investigate cheating and suspicious transfers. Other players receive only the cards shown at the table.

We don't collect your email address, real name or payment details. Public chat is shown to players nearby and is not saved. A yell is shown to every player online and is not saved either: the last 100 yells stay in the server's memory, where staff can read them to check a report, until the game restarts. Private messages go only to the player you write to and are never saved or logged. Your username is visible to other players, for example in chat and on scoreboards. If your dive into the Abyssal shaft is among the ten deepest, this website shows your username and that depth under Deepest dives, and nothing else about you. The Hiscores page on this website shows usernames with their levels and XP, boss kill counts, earned collection slot totals and PvP kills: the top 100 of every skill, every boss, the Collection log and PvP, and anyone can look up a username to see that player's ranks. Players with equal scores are listed oldest account first. It shows nothing else about you.

This website and your browser

This website sets no cookies, uses no analytics or tracking, and loads nothing from other companies: fonts, images and scripts all come from our own server. When you create an account, the page sends your username and password straight to the game server over an encrypted connection. To keep bots out, your browser first solves a small puzzle; that needs no cookies and no other companies either. The game remembers your last username and your settings in your browser's local storage. That data stays on your device and is not used for tracking.

The Discord link on this website and the Discord button in the game take you to Discord, a separate service with its own privacy policy. BalenaScape shares nothing with Discord.

Why we store it

To run the game: your account and progress are needed to provide the game you signed up for.
To keep the game secure and fair: logs, IP addresses and login protection help us stop password guessing, abuse and cheating, and the audit log and poker hand history let us check how staff use their powers and whether blood money or other winnings are being passed between accounts. The chest limits stop one person from farming chests with many accounts. This is our legitimate interest.

We never sell your data or share it with anyone for advertising.

Where we store it

On a rented server in the European Union, in Germany. Backup copies of the game data, including the staff audit log, are kept on that server and on the owner's own computer, also in the EU. Your data does not leave the EU.

How long we keep it

Account and game progress: until you ask us to delete your account. The hiscores follow the game's saves: an account the staff delete disappears from them when the game next restarts.
Server log: the log has a fixed maximum size (three files of 10 MB). The oldest lines are deleted automatically as new ones come in, and the whole log starts afresh whenever the game is updated. How long a line stays therefore depends on how busy the game is and how often it is updated: usually days to weeks, but on a quiet server that is not updated for a long time it can be months. When an update fails, the last 30 lines of the server log are copied into the record of that update, which is deleted at a later update once it is more than 30 days old.
Chest limits: one hour.
Staff audit log: 90 days, including blood money, flower poker, significant poker-room pots, suspicious-transfer flags and Dread chest lines. Older lines are deleted automatically, when the game starts and once a day after that.
Poker hand history: 30 days. Older daily files are deleted automatically when the game starts and once a day after that. Significant hands and suspicious-transfer flags copied to the staff audit log follow its 90-day retention.
Backups: the server keeps the 14 newest nightly backups, which is two weeks, and the 14 newest of each other kind, such as the backup made before every update. The owner's computer keeps the 30 newest copies. Older backups are deleted automatically, so data that was deleted from the game disappears from the backups over time. The backups contain the staff audit log and poker hand history as well: a line can stay in a backup for that long after it was deleted from the log itself. The server log is not in the backups.

Your rights

You may ask to see the data we hold about you, to correct it, to get a copy, or to have your account and data deleted. You may also object to how we use it. Write to balenascape@outlook.com. If you are not happy with our answer, you can complain to the data protection authority in your country.

Who is responsible

The owner of BalenaScape decides what happens to your data: under the GDPR, the owner is the controller. Questions about privacy, your account or the rules: balenascape@outlook.com.

Back to the home page or read the rules