This Privacy Policy explains what personal data Pepe Century collects when you visit pepecentury.com or play the game, why we collect it and what your rights are. We keep data collection to what the game needs to work.
1. Who is responsible
The data controller is OPERATOR_NAME. Contact us about anything in this policy at info@pepecentury.com.
2. What we collect
- Email/password accounts: the email address and password you submit to our server for registration or sign-in. Our account database stores a one-way digest of your normalized email address and a salted password hash, associated with your chosen, unique player name. Your email address is not shown to other players. Firebase does not handle these accounts or passwords.
- Google sign-in: Google and Firebase Authentication process your sign-in. Our server receives a Firebase identity token and validates it with Firebase; that response can include your Google account identifier, email address and profile information. We retain the Firebase account identifier and session token information needed to recognize your captain, not your Google password. You choose a unique public player name; we do not automatically use your Google name or email as your public captain name.
- Account recovery: the email address you submit, a one-way hash of a recovery token and its expiry time. We send a password-reset link through our mail provider from noreply@pepecentury.com. Google account recovery is handled by Google.
- Game data: your character's appearance, position, inventory, ships, money, skills, bank contents, clan membership, trades and transaction ledger.
- Your settings: your graphics preferences and your keyboard controls. These are stored with your character rather than in your browser, so that your setup follows you to another computer and is not lost if you clear your browsing data.
- Messages: chat messages you send, which are shown to other players.
- Technical data: your IP address and connection details, used to deliver the game, keep it secure and limit repeated failed login attempts.
- Pepecoin data (only if you use it): your deposit address, withdrawal addresses and the transactions you make.
We do not ask you to enter your real name, date of birth or payment card details. We do not use advertising or third-party analytics; Firebase Analytics is not enabled. Existing username accounts remain available for sign-in, but accounts without an associated email cannot use email recovery.
3. Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your account, signing you in and running the game | Account, game data, session cookie | Performance of our contract with you (the Terms) |
| Sending a welcome email and recovering access to an email/password account | Submitted or Google-provided email address, player name, recovery token hash, delivery information | Performance of contract; our legitimate interest in account security |
| Showing the game the way you have set it up | Your settings | Performance of contract |
| Showing chat and trades to other players | Username, messages, trades | Performance of contract |
| Security, preventing cheating, abuse and brute-force logins | Technical data, game data | Our legitimate interest in a safe, fair game |
| Processing Pepecoin deposits, trades and withdrawals | Pepecoin data | Performance of contract; legal obligations |
4. Cookies and local storage
The game uses the first-party cookies and local-storage item listed below to keep you signed in and remember the cookie notice. Our Google sign-in integration also loads Firebase software from Google. Google sign-in uses Google/Firebase authentication services and may use their cookies or other browser storage during that process. Our Firebase client uses in-memory authentication persistence. These features are used for authentication, not advertising or analytics.
| Name | Type | Purpose | Duration |
|---|---|---|---|
pc_sid | Cookie (first-party, HttpOnly) | Keeps you signed in between visits. Page scripts cannot read it. | 7 days, or until logout. A session also ends after 7 days unused or 30 days in all. Google sessions require a fresh sign-in after at most one hour. |
pc_signed_in | Cookie (first-party) | Tells the page that you are signed in, so it can open the game. Holds no personal data. | 7 days, or until logout |
pepe.cookieNotice | Local storage | Remembers that you have seen this notice, so it is not shown again | Until you clear it |
Your game settings are no longer kept in your browser. Your graphics preferences and keyboard controls used to be stored in local storage on the machine you were playing on. They are now saved with your character on our servers instead, which means they follow you to any computer you sign in from and are not lost when you clear your browsing data. The items that held them — pepe.quality, pepe.waterReflections, pepe.windowReflections, pepe.perfHud, pepeCentury_positionDebug and pepeCentury_controls — are no longer written or read. If your browser still holds any of them from before this change, they are ignored, and you can delete them at any time.
You can delete cookies and local storage in your browser settings at any time. If you block the session cookie you will need to sign in each time you visit.
5. Who we share it with
We do not sell your data. Your username, character, chat messages, clan and trades are visible to other players as part of the game. Google/Firebase receives authentication tokens and technical connection information for Google sign-in; see Google’s Privacy Policy. Our SMTP mail provider processes the recipient address and message contents to deliver a welcome email when an account is created and password-reset emails when requested. These emails have no tracking pixels. Email/password credentials are processed by our server and are not sent to Firebase. Otherwise we only share data with service providers who help us run the Service (such as hosting) under appropriate agreements, or where the law requires it. Pepecoin transactions are recorded on a public blockchain, which is outside our control.
6. How long we keep it
We keep your account, game data and settings for as long as your account exists. The session cookie in your browser expires after 7 days; Google session tokens are valid for at most one hour and are removed when an expired session is used again. Login-attempt records are held in memory for security. Recovery links are valid for 30 minutes; their stored hashes are removed on use or replaced by a later recovery request. An unused expired hash may remain with the account until replaced or the account is deleted. When you ask us to delete your account we delete or anonymise your data within 30 days, except where we must keep records for legal reasons (for example Pepecoin transaction records) or to handle a dispute.
7. Security
The site is served only over HTTPS, passwords are salted and hashed, and access to our servers is restricted. No system is perfectly secure, so please use a password you do not use anywhere else.
8. Your rights
Depending on where you live, including under the GDPR, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a copy of it in a portable format. To use these rights, contact us at info@pepecentury.com and include your captain name so we can locate the account and verify your request. Do not send us your password or recovery link. You also have the right to complain to your local data protection authority.
9. Children
The Service is not intended for children under 16 without the involvement of a parent or guardian. If you believe a child has given us personal data without that consent, please contact us and we will delete it.
10. International transfers
If your data is processed outside your country, we make sure it is protected with safeguards required by applicable law.
11. Changes to this policy
We may update this policy. We will change the “last updated” date above and tell players in the game about significant changes.