What the server keeps

This is exactly what the online world server stores, and for how long. It is written for you, the person who runs the server, so that you can answer a parent who asks - and so that you know what you are responsible for.

What a player is asked for

- A log-in name and a password. - An e-mail address - but ONLY if you have set up e-mail (sudo stn mail setup), and even then it is OPTIONAL. The box says it is only so that the player can get the account back after forgetting the password, and that children should ask a grown-up first. Left empty, nothing is sent.

Nothing else: no real name, no date of birth, no age, no photograph, no location, no phone number. (If you set a "minimum age" for your world, the game only SHOWS that line; it asks nobody's age and checks nothing.)

What is kept, and for how long

In the accounts database (/opt/stnicholas/data/accounts.db):

- The log-in name (3 to 20 letters and numbers). It is never shown to other players. Children may use their real first name here; you could suggest they do not. Rude names are refused. Kept until the account is deleted.

- The password: NOT kept. Only a "salted scrypt hash" of it is kept - a scrambled form from which the password cannot be worked out, but which can check a password typed later. Nobody, including you, can read a password back.

- The e-mail address, if the player gave one: NOT kept as it is. It is kept only in the same scrambled form as the password (a salted scrypt hash). The server can check an address somebody types against it, but nobody - you included - can read the address back, list the addresses, or send anything to them. It is used for one thing only: when the player asks "I forgot my password", types his log-in name and his e-mail address, and the two belong together, a short code is sent to the address he has just typed. A player can give, change or take away his e-mail address in the game (Your Account, "My E-mail..."). Kept until he takes it away or the account is deleted. When it was given is kept too.

- The codes for a forgotten password: six numbers, which work for 15 minutes and for at most 5 tries. Only a scrambled form (a salted SHA-256) is kept, and only while the code can be used; a new code replaces the old one, and a used or worn-out code is deleted at once. The e-mail itself holds the world's name, the code, and a line saying that nothing has changed if the reader did not ask for it - never the log-in name or anything a player typed.

- Which lord in the world belongs to the account (an id like h17), when the account was made, when it was last seen, when its password was last changed, and - if you barred it - that it is barred, when, and the reason you typed. Kept until the account is deleted.

- Auto-login: so that a player does not type the password every time, the game keeps a long random key on that device. The server keeps only a scrambled form (SHA-256) of each key, with when it was made and last used. At most 5 devices per account. A key not used for 90 days is deleted. Logging out deletes it; changing the password deletes all the others; setting a new password with an e-mailed code deletes them all.

- Wrong passwords: to stop people guessing, the server counts wrong passwords for a LOG-IN NAME (by a one-way code of the name, never of anything else). After 10 in a quarter of an hour that name is locked for 15 minutes. These counts, and how many codes were asked for each name, are deleted after 2 days at most.

- A short audit (sign-up, log-in, password changed, e-mail given or taken away, a code asked for, barred, ...): the event, when, and the account number. Deleted after 30 days.

- How many e-mails the server sent in the last day (only the number, for the daily limit and for "stn mail status").

Internet addresses: NOTHING is kept. Not the address, and nothing made from it (no code, no hash) - not in the database, not in any log. The limits that go by internet address (how many accounts may be made and how many wrong passwords or codes may be tried from one connection) are kept only in the server's memory, are forgotten within a day, and are all forgotten whenever the account service restarts. The same goes for the limit of codes sent to one e-mail address: memory only. (Versions before 1.8 kept a one-way code of the address in the database and in the world's log. Updating to 1.8 deletes them from the database and takes them out of /opt/stnicholas/logs/world.log. Copies remain in backups made before the update until those backups are removed - 14 days at most - and in the system log, see below.)

In the world file (/opt/stnicholas/data/world/world.dat):

- The lord's game: his public name and house (chosen from lists, never typed), his arms, lands, armies, letters from the computer lords, battle reports, rank and honour.

- Ready-made messages between players. Nobody can type a word to anybody. A message is one sentence chosen from the game's own book of about 650 sentences, its blanks filled with things of the game (a place, a player, a lord, an amount, a time). For each player the world keeps the newest 80 messages he sent and received - stored as the number of the sentence and its fillings, never as words - with who sent it, to whom, and when. Older ones are pushed out by newer ones.

- Alliances between players (who is allied with whom), and soldiers standing guard in an ally's castle (how many, whose, and until when). A player may also "stop his ears" to another player (the list of whom he has muted).

- What you set: which lords you have silenced (stn world silence ID), and who may send messages in this world (stn world set chat all | allies | off).

- When an account is deleted, its lord leaves the world and his lands become free villages. His own box of messages and letters is emptied, and so is his list of players he would not hear. His rank and honour stay in the world file as part of the world's history, with no link back to the deleted account, and the messages he sent stay in the boxes of those who received them until newer ones push them out. (None of it is words a player typed.)

In the backups (/opt/stnicholas/data/backups):

- Copies of the accounts database, the world file and the settings file, one a night, each kept for 14 days. So a deleted account can still be in a backup for up to 14 days, and then it is gone. (Copies you download to your own PC are kept as long as you keep them. The settings file in them holds the password of the game's e-mail account - keep the copies private.)

In the server's logs (journalctl, and /opt/stnicholas/logs/world.log):

- One line per event with the account NUMBER or the number of the connection only - no log-in name, no internet address, no e-mail address, never a password, a key or a code - e.g. "login account=12". When an e-mail could not be sent, the line says only why ("mail_failed reason=auth"). What a message said is never written: when you silence a lord, the log has only a line like "ADMIN silence h7". Ubuntu keeps the system log until it reaches its size limit (by default a few hundred MB), usually weeks to months. (Lines written by versions before 1.8 may still hold the old address codes, "ip=1a2b3c4d", in the system log until it is cleared. To clear the whole system log now: sudo journalctl --rotate --vacuum-time=1s - this removes the logs of everything on the server, not only the game's.)

The game-update service (port 8093, behind the game's "Update Game" button):

- It keeps NOTHING about players. When a game asks whether there is a newer version, or fetches one, the service sees the internet address the request comes from - as any web server does - for as long as that connection lasts (so that one address cannot take up all the connections at once). It writes none of it down: there is no log of visits at all, nothing made from an address is kept, and the address is forgotten when the connection ends. Its only log lines say when it started or stopped, which version it offers, and what went wrong if something did - never with an address. - It asks for nothing: no account, no log-in name, no password. Everybody gets the same files - the game update you published.

The game's website (if you have put one on: sudo stn site publish), at http://YOUR-SERVER-ADDRESS/ (port 80) and on port 8093:

- The same service hands it out, in the same way: it only hands out the files you published - pages, pictures, the game to play in a browser and to download. It keeps no log of who fetched what, nothing made from an address and no counter of visitors; it sets no cookies and asks for nothing. (What a player does once the game in the browser connects to the world is the world's business, written above.) - One more thing passes through it. A game played in a browser sends some of its player's orders (a march, a scout, a letter's answer) to the website instead of straight to the world, because a web page cannot wait for the world's answer any other way. The service hands each one on to the world as it is and the answer back. It does not read them, and keeps and logs nothing of them.

With a web address (HTTPS through Caddy), Caddy itself keeps no log of visits unless you switch one on. (A line of its own about a connection that went wrong may, now and then, name the address it came from.)

The server's firewall is told to keep no log of the knocks it turns away.

Ubuntu itself, apart from the game: its log of log-ins to the SERVER (ssh) notes the internet address of whoever logs in or tries to - that is you, and strangers trying the door, never a player of the game. That log belongs to the server's own safety and the game does not touch it.

OUTSIDE THE GAME: the e-mail account you set up for the world.

- The mail service you use (for example Gmail) keeps a copy of every e-mail the server sends, in that account's "Sent" folder - and those copies hold the address each code went to, and the code. This is the ONE place where a player's e-mail address is kept in readable form, and it is outside the game: the game cannot delete it. Use an account made only for the game and used for nothing else, do not read it, and empty its "Sent" folder from time to time (in Gmail: open "Sent", tick all, delete, then empty the Bin). The mail service's own rules about what it keeps apply as well.

What a parent can ask for

- To see what is kept: sudo stn accounts export NAME (prints everything, in a form you can copy into an e-mail; for the e-mail address it says only "given (kept only in scrambled form)" or "none") - To delete the account: sudo stn accounts delete NAME - To bar it for now: sudo stn accounts ban NAME "reason" - A forgotten password, without e-mail: sudo stn accounts reset-password NAME

Who sees what

Only you (whoever can log in to the server) can see the accounts database, and even you cannot read a password or an e-mail address in it. The account service listens only inside the server (127.0.0.1); it cannot be reached from the internet. The game-update service can be reached from the internet, but it holds nothing about anybody: only the game update you published. Other players see only the lords' chosen names, arms, lands and deeds in the game, and the ready-made messages sent to them.

Your duties - please read

If you run a game that the public - and especially children - can join, the law may give you duties, even if the game is free and small. In the UK these include:

- The UK GDPR and the Data Protection Act 2018, and the ICO's "Age appropriate design code" (the "Children's code"), for online services likely to be used by children. An e-mail address is personal information, even when it is kept only in scrambled form: a scrambled address can still be checked against an address somebody already knows. If you switch e-mail on, that is the main reason to keep this paper up to date and to be able to tell a parent exactly what is kept (above) and to delete it when asked. Without e-mail the world keeps far less: a log-in name and a scrambled password. - The Online Safety Act 2023 (Ofcom), for services where users can meet or affect one another. Players of this game can send each other messages and make alliances, so it is such a service. But nobody can type a word to anybody: the messages are ready-made sentences from the game's own book, filled only with things of the game, and names are chosen from lists. So no player can send another his own words, a telephone number, an address or a link, which lowers the risk a great deal. You can still stop a player's messages (stn world silence ID) or switch messages off for everybody (stn world set chat off). You should still read what applies to you.

This note is NOT legal advice, and following it does NOT by itself make you compliant. Whoever wrote this program is not a lawyer. Please read the official guidance on the ICO's website (ico.org.uk - search for "Children's code") and Ofcom's website (ofcom.org.uk - search for "Online Safety Act"), and take advice if you are unsure. Playing with your own family and friends is a very different thing from opening the game to strangers.