THE SMALL PRINT

Privacy policy

Last updated: 12 October 2026 · Version: privacy-v3-2026-10-12

This policy covers the SoulQuest website, accounts and game, operated under the trading name RusticRubyGames (“we”, “us”). Contact support@soulquestrpg.com about your information or to exercise your rights. We do not sell personal information.

Running your account and game

We use your email address, securely hashed password, verification and login records to provide and protect your account. We keep the version and time of your agreement to the terms. We also store your characters, progress, settings, profile information, activity and chat to provide the features you use. Other players see the profile, presence and messages those features share, subject to the available visibility controls. Authorised staff can review records needed for support and moderation.

We use information necessary for the account and game service to fulfil our agreement with you. Without the required account information, we cannot create or secure your account. Account verification, password recovery and essential service emails are separate from optional news or marketing. If you choose to connect Discord when available, we receive its account identifier and display name to link your login; Discord’s privacy policy explains its own processing.

Security and fault reports

We keep proportionate access, game-action, anti-cheat, moderation and fault records to protect accounts, investigate abuse and fix problems. This can include account identifiers, action times, outcomes, technical details and the game state needed to investigate an incident. We also record changes to privacy permissions. Our basis is our legitimate interest in keeping the service secure, fair and reliable. These records are separate from optional product analytics.

Cloudflare delivers and protects our websites and handles email delivery. It processes connection and security information such as IP addresses, browser and device information, requested URLs, timestamps and security decisions. Turnstile checks help distinguish people from automated abuse. Security checks may use device information and security cookies. See Cloudflare’s privacy policy and Turnstile privacy notice.

Sentry, when enabled, receives limited server fault and security diagnostics to help us investigate problems. Reports can contain an internal account identifier, error type, software version and technical context. Our reporting filters exclude passwords, authentication tokens, cookies, email addresses, private chat and form contents. Browser diagnostics and performance reports are a separate optional choice. If you submit a problem description, do not include private information or secrets.

Security checks can automatically refuse suspicious requests or temporarily limit access. Contact support if you think you have been blocked in error. Declining optional tracking does not disable necessary protection.

Optional tracking and device preferences

These uses start off and require your separate permission when the feature is enabled. Accepting the terms does not enable them, and you can play without them.

• Product analytics — PostHog: selected usage and completed game-action events, with an internal account identifier, session information and software version, to understand and improve the game. We do not send private messages, passwords or form contents. Opting in later does not send gameplay events collected while you had declined.
• Browser diagnostics — Sentry: filtered browser errors and performance information to help diagnose problems.
• Session replay — PostHog: a masked record of page layout and interactions to help understand usability problems. Text is masked and account, chat and form areas are excluded. Replay needs its own checkbox; accepting other optional uses does not enable it.
• Device preferences: storing this tab’s unsent chat draft and read position on your device. Chat remains usable without this storage.

Our basis for these optional uses is consent. Open Settings → Privacy in the game to review or withdraw account permissions. Privacy choices is also available in the footer. Signed-out choices affect this browser only: sign in to withdraw the account permission that controls server analytics. Withdrawing consent does not undo earlier lawful processing or automatically delete reports already received; contact us about deletion.

Other open game pages check changes when active or resumed; a cached permission can take up to 30 seconds to expire in an active page. An account withdrawal is confirmed after any already-sending, time-limited server report finishes. Optional collection remains stopped until permission is given again.

Cookies and browser storage

Sign-in and request-protection cookies support your account and secure forms. The .SoulQuest.Privacy cookie remembers your purposes, policy version and decision time for 90 days across soulquestrpg.com and its subdomains. It contains no account identifier. Account permissions are stored separately and also expire after 90 days; the record of your choice may be retained as evidence. Browser permission alone cannot grant account permission.

Optional chat storage stays on your device and is cleared in accessible tabs when you withdraw that choice; another tab clears its own storage when it next runs. Our configured PostHog browser identifiers are held in memory rather than persistent analytics cookies. Sentry and PostHog still receive network information, including the connection IP address, when your browser connects to them. The public website and player handbook do not load optional analytics or replay tools.

Optional emails and enquiries

If you register interest or opt in through your account, we store your email, selected email categories, request and confirmation times, expiry and the relevant consent and privacy versions. “Game updates and news” and “Marketing and invitations” have separate choices, both initially off. We use consent and send optional emails only after your address is confirmed. Registering interest does not create an account or guarantee game access.

Use the withdrawal link in your confirmation email, your verified account’s Settings, or contact support to change these choices. Clearing both categories deletes your optional subscription. This does not stop required account emails. If you contact us, we use your address and the information you provide to answer you, based on our legitimate interest in responding to enquiries.

Who receives information

Account and game records are held on our private game server. Hosting and email services process information needed to deliver the service; Cloudflare, Sentry and PostHog receive the information described above for their respective purposes. We may also disclose relevant information to professional advisers or authorities when needed to meet legal obligations or establish or defend legal claims.

Our configured Sentry and PostHog collection services use EU endpoints. Cloudflare operates globally, and providers and their subprocessors may process information outside the UK, including in the US. Regional hosting does not by itself rule out international processing. The providers describe their processing and contractual transfer arrangements in Cloudflare’s data processing addendum, Sentry’s data processing addendum and PostHog’s data processing agreement. Contact us for information about the safeguards applicable to your data.

How long records are kept

Account and game records are kept to maintain your account and saved game. Security, moderation, fault, agreement and choice records are kept according to their purpose: investigating an incident or fault, handling a dispute, showing which permissions applied, and meeting legal obligations. When you request closure or deletion, we review which records can be removed and which still need to be kept for those purposes. There is currently no automatic deletion timetable for all game and security records.

The seven-day chat history available to players is a display limit, not a promise that older or deleted messages have been erased from storage. Restricted records may remain for moderation and abuse investigations. Provider reports and recovery backups have separate retention and deletion processes; a record disappearing from the game does not mean every copy is immediately removed.

Unconfirmed email interests expire after 48 hours. Confirmed interests expire 12 months after public confirmation or verified account opt-in, or are deleted earlier on withdrawal. Changing existing email choices does not extend expiry. Expired interests cannot be used; deletion normally runs hourly, but an outage can delay removal. Restricted backups are not used to send updates, and expiry and withdrawal must be reapplied before a restored list is used. We keep correspondence for as long as needed to resolve the enquiry and any related legal requirements.

Your rights

Depending on the circumstances, you can ask to access, correct, delete or restrict use of your information, request portability, object to processing based on legitimate interests, and withdraw consent for optional uses. We may need to verify your identity. Contact support above. You can also complain to the UK Information Commissioner’s Office or your local data protection authority.

Changes

We will update this notice when our practices change and bring material changes to your attention. We will explain a new use and obtain any required permission before starting it.