Privacy Policy
Effective September 27, 2026
This policy explains how Thomas Ostrow ("Dark Forest," "we," "us," or "our") handles information when you use the Dark Forest game, website, Discord login, multiplayer lobbies, and replay features (collectively, the "Service").
1. Information we handle
Discord account information
If you choose Continue with Discord, we request only Discord's identify permission. Discord provides your Discord user ID, username or global display name, and avatar reference. We create a separate internal account ID. We do not request your email address, server list, friends, messages, or presence through this login.
Sessions and login security
We store a cryptographic hash of a random session token, the account it belongs to, and session creation and expiration times. The browser receives the random token in a Secure, HttpOnly, SameSite cookie. Temporary OAuth security values are stored in hashed form while a login is in progress. We do not retain Discord access tokens or refresh tokens after login completes.
Game, lobby, and replay information
We handle the civilization name you choose, lobby membership and settings, game commands, game state, connection events, match timing, and results as needed to provide play. Other players can see the name and game information that the interface makes public during a lobby or match.
Solo matches may be saved as replay recordings. A replay can include the chosen civilization name, game setup, map and spawn data, commands, connection events, timing, and results. On the current public test service, replays are stored in a shared library that does not require login. Other visitors may be able to list, watch, copy, pin, unpin, replace, or delete those replays. Do not use a civilization name that you want to keep private.
Browser storage
Your browser may store your civilization name and sound preference on your device. Clearing site data removes those local preferences. The session cookie described above is used to keep you signed in.
Network and technical information
When you connect, our servers and hosting providers necessarily receive network information such as your IP address, request headers, connection timing, and error information. The Dark Forest account database does not intentionally store IP addresses. Infrastructure providers may process limited technical logs to operate, secure, and troubleshoot the Service.
2. How we use information
- Authenticate you with Discord and maintain your Dark Forest account.
- Provide game sessions, multiplayer lobbies, replay storage, and account features.
- Protect the Service, prevent abuse, diagnose failures, and enforce these Terms.
- Comply with law and respond to valid legal requests.
We do not sell personal information. We do not use Discord data for advertising, user profiling, or decisions about employment, housing, insurance, credit, or similar benefits. The Service currently has no third-party advertising or behavioral analytics.
3. When information is shared
- Discord: Your browser is sent to Discord for authorization, and our server exchanges the authorization code and requests your basic profile. A displayed avatar is loaded from Discord's content delivery network with a no-referrer policy.
- Hosting providers: Service data is processed on infrastructure used to host Dark Forest. The current test server is hosted by DigitalOcean in the United States.
- Other players and replay visitors: Lobby names, public game information, and shared replay data are disclosed as described above.
- Legal and safety needs: We may disclose information if reasonably necessary to comply with law, protect users, investigate abuse, or protect the Service and our rights.
- Business changes: If the Service is transferred or reorganized, information may transfer subject to this policy and applicable law.
4. Retention
| Information | Typical retention |
|---|---|
| Discord identity and internal account | Until you delete the account or it is no longer needed to provide the Service. |
| Login session | Valid for up to 30 days. A login keeps at most 10 active sessions per account. Expired session rows are removed during routine cleanup. |
| Incomplete OAuth login | Valid for up to 10 minutes. Expired login rows are removed during routine cleanup. |
| Lobby and live multiplayer state | Held in memory while needed for the lobby or match, then discarded when the session ends, all players leave, or the service restarts. |
| Replay recordings | Until deleted or automatically evicted to enforce the storage limit. Pinned replays remain until unpinned and evicted or manually deleted. The current test service has no replay backup. |
| Local browser preferences | Until you clear site data or overwrite the preference. |
5. Your choices and rights
Discord login is optional and guest play remains available. You can log out or delete your account from the Account dialog. Account deletion removes the internal account, stored Discord identity, and every active login session. Replays are not currently linked to accounts, so deleting an account does not delete replays. Delete them separately from Saved Replays before deleting your account.
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information, and to object or withdraw consent where consent applies. To make a request or ask a privacy question, contact tostrowconnect@gmail.com. We may need to verify that a request concerns your account.
6. Children
The Service is not directed to children under 13. You must also meet the minimum age required to use Discord and the minimum digital-consent age in your country. If you believe a child provided personal information contrary to these rules, contact us so we can delete it.
7. Security and international processing
We use measures designed to protect account information, including encrypted transport, Secure and HttpOnly cookies, hashed session and OAuth tokens, origin checks, rate limits, and restricted server storage. No system is completely secure. The current service is hosted in the United States, so information may be processed there if you access it from another country.
8. Changes to this policy
We may update this policy as the Service changes. We will post the new version here and update the effective date. If a change materially affects how we use personal information, we will provide additional notice when required.
9. Contact
Operator: Thomas Ostrow
Privacy contact: tostrowconnect@gmail.com
Location: Pennsylvania, United States