2Moons Rebirth is an unofficial, non-commercial fan project. This policy lists everything we store when you use the website, the launcher and the game server, why we store it and for how long. We keep as little as we can, and this list is written from what our software actually does.
Who is responsible
The 2Moons Rebirth team runs the service. For any privacy question or request, write to privacy@2moons-rebirth.com.
What we store, at a glance
| What | Why | How it is kept | How long |
|---|---|---|---|
| Account name and password | To run your account | The password only as a salted PBKDF2 hash, never readable | While your account exists |
| Email address | Account mail: confirmation link, sign-in codes, account recovery, important service notices | In our game database; confirmation links only as one-way hashes | While your account exists. An address that is never confirmed (or an unconfirmed change) is deleted after 7 days; unused links stop working after 24 hours and are deleted |
| 2-step verification (optional) | To protect your account | Authenticator secret encrypted (AES-256-GCM); recovery codes as one-way hashes; emailed codes in memory only, for minutes | Until you turn it off |
| Google sign-in (optional) | To sign you in with Google | Your Google account ID and the email address Google confirms; no name, picture or Google password | While your account exists |
| Login records | To stop password guessing and account theft | Time, account, IP address and result of each login and 2-step code | 90 days |
| Game activity log | To settle disputes, restore lost items and find cheating | Logins, logouts, game starts, account security changes, trades, shop sales, items gained or lost, mail, money, crafting and staff actions, each with the IP address and the hashed device ID | 180 days |
| Cheat detection alerts | To keep the game fair | Account, character, map position and what was detected, for staff review | 180 days |
| Bans | To enforce bans | The banned account, IP address or hashed device ID, the reason and the staff member | While the ban is in force, then 180 more days |
| Player reports | To handle reports | Reporting and reported character, map and time; no chat | 90 days |
| Server logs | To fix errors and handle abuse | The server's running log: character and account names, the IP addresses of logins and website requests, and that a chat message was sent (who and how long, not what it said) | 14 days (log files, the hosting system's journal and crash reports) |
| Game data | So the game works | Characters, items, money, guilds, friends, in-game mail, quests and similar | While your account exists; deleting a character removes it |
| Backups | To recover from failures | Daily copies of the game database (everything above except the activity log, alerts and server logs) | 14 days (also the copies made during server upgrades) |
Device fingerprint (hardware ID)
When you sign in through the launcher, it computes a fingerprint of your PC from the Windows machine ID, the system drive's serial number and the mainboard serial number. It mixes them with a fixed project salt and turns them into a one-way SHA-256 hash. Only that hash leaves your PC. The raw serial numbers are never sent and can't be recovered from the hash. The launcher sends it only after you have accepted this policy.
We keep the hash in the game activity log (180 days) and, if you are banned by device, in the ban list. We use it for one purpose: enforcing bans for cheating or abuse, so a banned player can't simply create a new account on the same PC. It is not used to track you outside the game, and it is never shared with anyone.
Email address
Every new account needs an email address. Older accounts, and accounts created by staff, may not have one. Until account mail is switched on, we store the address you enter but send nothing to it. If you sign in with Google and your account has no email address yet, the one Google confirms becomes your account email.
Cookies and browser storage
The website sets no cookies of its own and runs no tracking, advertising or analytics. It keeps two small items in your browser's storage, both needed for what you ask the site to do:
- 2mr.session: your sign-in after you log in. With "Stay logged in" ticked it stays in local storage for up to 14 days or until you log out; otherwise it is kept in session storage and ends when you close the tab. It contains your account name and a signed token.
- 2mr.consent: your cookie choice, so we don't ask again. It stays until you clear your browser data. You can change it at any time with "Cookie settings" at the bottom of every page.
Google sign-in is optional and off until you allow it. If you choose "Allow Google sign-in" in the cookie notice, or press "Continue with Google", your browser loads Google's sign-in script from accounts.google.com. Google may then set or read its own cookies under Google's privacy policy. If you choose "Essential only", no Google script is loaded. Our fonts and images are served from our own site, not from Google.
Cloudflare, which delivers the website, sets no cookies on our pages. Only if it has to check a visitor during an attack (a challenge) can it set the strictly necessary cf_clearance cookie, for 30 minutes. Staff who sign in to the admin panel get one session cookie for that panel (8 hours at most).
The launcher on your PC
The launcher keeps its settings in a file on your PC: the game folder, your account name if you ticked "remember", your start options and which versions of these terms and this policy you accepted. It never stores your password. Its log file also stays on your PC. When you sign in, the launcher sends your account name, password or sign-in code, and the hashed device ID to our server.
Why we process it
- To run the game and your account, the service you asked for (performance of a contract).
- To keep the game fair and secure: preventing cheating, account theft and abuse (our legitimate interest in a fair, safe game).
- Google sign-in on the website: only with your consent, which you can withdraw in "Cookie settings".
- To meet legal obligations, if any apply.
Who else handles it
- Hetzner Online GmbH (Germany) hosts the game server, its databases, logs and backups.
- Cloudflare, Inc. delivers the website and the launcher downloads and carries the connection from the website and launcher to our account server, and so processes your IP address. The game connection itself goes straight to our server at Hetzner. It also forwards mail sent to our contact addresses.
- Google LLC hosts the mailbox that mail to our contact addresses is forwarded to. If you choose Google sign-in, Google confirms your identity on its side, under its own privacy policy.
- Resend, Inc. will send our account mail (confirmation links and sign-in codes) from its EU region once account mail is switched on. It then receives your email address and the content of those mails, only to deliver them.
Cloudflare and Google are US companies; transfers to them rely on the EU–US Data Privacy Framework and their standard contractual clauses. We don't sell or rent your data, and we don't share it with anyone else, except where the law requires it.
Who on our team can see it
Staff see what they need for their role. IP addresses and hashed device IDs are visible only to administrators. Passwords and recovery codes are kept only as one-way hashes, so nobody can read them; 2-step secrets are stored encrypted.
Your rights
If you are in the EU or EEA you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. Write to privacy@2moons-rebirth.com from the email address on your account, or tell us your account name. To delete your account, write to the same address. An administrator deletes it for you, and the deletion is recorded. It removes the account, your email address, 2-step verification data, Google link, login records, shared storage, undelivered shop items and every character (with their items, skills, mail, friends and market listings), and your names on other players' friend and block lists. What stays: ban records (as long as described above) and the game activity log, until its 180 days run out. Copies in backups disappear when those expire (14 days). You can also complain to your data protection authority.
Age
You must be at least 16 to create an account, or have permission from a parent or guardian.
Changes
If this policy changes, the launcher shows you the new version and asks you to accept it before you play. The version and date are at the top of this page.