Privacy

Last updated: 29 September 2026

This page explains what happens to your data when you play napoland at www.napoland.com. napoland is open source and made by its community, so you can also read exactly what the game does in its source code. Copies of napoland that other people run on their own servers are theirs, with their own rules.

Who is responsible

napoland is published by:

More in the legal notice. We follow the Swiss Federal Act on Data Protection (FADP) and, for players in the European Union and the European Economic Area, the General Data Protection Regulation (GDPR).

What we collect, and why

To sign you in

You sign in with your email address and a 6-digit code sent to it, or with your Google or Apple account. Signing in is handled by Supabase, which keeps your email address and a record of your sign-ins (when, and from which IP address and browser) to send the codes and keep accounts safe. Your browser talks to Supabase directly for this. Our game server then checks your sign-in and keeps only the random id Supabase gave your account, never your email address. We never store your codes or sign-in tokens.

If you sign in with Google or Apple, you do it on Google's or Apple's own page, and that company then tells Supabase your email address and your name as your account gives it (Google also sends your profile picture). Apple can give a private relay address instead of your real one, which forwards to it. Supabase keeps these with your account; our game server still keeps only Supabase's random id for it. Google or Apple also learns that you signed in to napoland, and their own privacy policies cover what happens on their pages.

Playing as a guest

You can play without signing in, as a guest. Your character is then kept on our server like anyone's (everything under "Your character" below), and your browser keeps a login token for it in its local storage; our server keeps only a scrambled copy of that token. Nothing about a guest says who you are: no email address and no account. A guest cannot chat or have friends, and other players can still block or report a guest. If your browser's data is cleared, the token goes with it, and so does the way back to your character. A guest who does not play for 30 days is deleted, with its pile, arrows, thanks, what it left in crates and what was carried back for it. Signing in keeps your character: from then on it belongs to your account.

A character made before sign-in existed, played with the login token its browser keeps, counts as a guest until someone signs in with it on that browser: if it is not played for 30 days, it is deleted like a guest. This rule deletes nobody before it has been in the game for 30 days, so everyone who plays can read it there first.

Your character

Its name and color, where it is in the world, its energy, how wet it is, what it wears (and how worn each piece is), the outfit it wears over it, if any, past level 20 the merits it spent, the jacket patterns and name tag badges it bought with them and the ones it wears, what is in its bag and in its stash at home (and what it took out of the stash), the tools it owns (for now, its paper maps, and which pieces of a torn map it found), its XP and the rest it saved up while you were away (which makes stashing count double for a while), what counts toward its feats (among them how many thanks it received), how many pieces of gear it made and how often it collapsed or was caught by a surge (and which of the townspeople's words about those it heard), heard, and which of the longer things they told it), how far it is in the story (the latest chapter it reached), which pages of its field notes opened and which of their questions it saw answered (reading a sign or a paper tells our server where it stands, never anything else), which of the notes people left out there it read and which keepsakes it brought home, for the daily parcels (signed in only) whether it had its welcome parcel, the day of its last parcel and which days of that week it played, the arrows it paints on the ground, what it leaves in a crate for whoever comes next (and when), how much it gave to each place in the woods that everyone mends together (signed in only: a guest's gifts count, but are not kept under it), the pile of things it leaves when it collapses (with the last steps it walked before, which others see as a pale figure walking back to the pile), the furniture it made for its home and until when it is cozy from its own fire, the meals it ate on the trip it is on (until it comes home), its best trips (the farthest out, the longest and the most XP brought home: how far, how long and how much, never the route), how far it built its home up (a garage, a cabin, a house), whether you keep visitors out of its home, whether you read the letter about its home in a garden of its own, while it is new which of its first steps it is on (to town, out of town to pick something up, and home to the chest; forgotten once it took the last), and when it was created and last played. The game cannot run without these. Other players on the same map see your character's name and color, what it wears (its gear, or the outfit over it, and the pattern on its jacket), the badge on its name tag, where it walks, whose pile or arrow is whose, who fed a fire last, who left what in a crate, and when, and whose name is on a mended place's plaque (whoever gave it the most, which the notice board says too); in your own home, only the friends who visit see you and what is in it (below). When your character runs out of energy out in the wilds and lies down waiting for help, the players on that map see it lying there, and their local chat says so once, with its name and the nearest landmark, walking ("Ana is down by the pond"), never where exactly; players who blocked you do not get that line. Like the rest of chat, the line is not kept.

Your home stands in a garden of its own, fenced all round: nobody walks into it, and the only way in is NAPO's teleport. Your friends in the game (friends need sign-in) can visit it from their friends list, whether you are home or not, to see how you made it yours: the house as far as you built it up, the furniture you made for it, and what stands on your trophy shelf once you made one (each charm and each piece of anomalous gear in your stash, once; while you are away, as they were when you last left the game). Nothing else of your stash, your bag or your chest is shown, and nobody but you opens your chest, works at your workbench or cooks in your kitchen. They read your character's name on the plate by your house's door. If you are home, you read the character name of whoever comes to visit; that is not kept. Only friends visit: someone you block never comes in, nor does someone who blocks you, and whoever stops being your friend, or is blocked, while inside is sent home.

You can keep everyone out: in the game's menu, under Friends, turn off "Let my friends visit my home". Then nobody visits, whoever is inside is sent home, and your friends see that your home cannot be visited now. It is on until you turn it off, and we keep the setting with your character. The first time you come home since homes stood in gardens of their own, a letter in the game says how home works now and where to change this; we keep that you read it, so it comes once. Before that, your cabin stood on a street with your neighbors: which street and lot, and the setting you had for your door there, are forgotten the next time your character plays.

Steps others glimpse

When your character walks at least 20 steps out in the wilds and the walk ends at a find it picks up, a fire it feeds or the way home, our server keeps the last of those steps (up to 40: the tiles, in order), with your character's color and which character took them, so that it never shows you your own. A player who is then alone in that area may see a see-through figure in your character's color walk those steps. Nothing shown with it says whose they were: no name and no id. The server keeps these steps only in its memory, never in the database or in a log: a day at most, fewer when many people walk there (it keeps a few for each area and forgets the oldest first), and a restart forgets them all.

Footprints in the snow

Up on the Ridge and in the Quiet above it, where there is snow, every step anyone takes leaves a footprint. Our server keeps each one (the tile, the way the step went, and when) so that whoever comes there in the next hour sees them. It does not keep whose they were: no name, no id and no color, only where. It keeps them only in its memory, never in the database or in a log: an hour at most, fewer when many people walk there (it keeps up to 1,500 and forgets the oldest first), and a restart forgets them all.

First finders

If your character is the first on our server to find one of the secrets out there (to read a note someone left, or to pick up a keepsake), we keep its name with that secret, with the game's day and when, and show it to everyone: in a one-line message to everyone playing at that moment, on the notice board in town, and in the journal of whoever finds it after. Only the first finder of each secret is kept, a guest's too, and it is shown to everyone, including players you block.

The lost and found

If you find another player's pile, you can carry all of it to the lost and found box in the lodge for them instead of taking half. While you carry it, your bag shows whose things they are. Once you leave it in the box, it goes into their chest, and we keep who carried it (with their name, which stays even if their character is later deleted), whose it was, where it was lost, what it held and the XP the carrier earned for it, and when: until it is in its owner's chest and they have been told, which is when they next play, and 7 days after that. Then it is deleted. The owner reads who carried it back, unless they block that player, in which case it says someone did. A pile also remembers, until it fades or is carried, how much of it its owner had taken out of their stash, so that carrying it back earns nobody XP twice.

Thanks

You can thank another player for a fire they fed or an arrow they painted, taking something another player left in a crate thanks them, a player who gets you back on your feet when you were down out in the wilds is thanked by you as you get up, and so is a player who carries what you lost back to the lodge, as it comes back. A thanks carries no words. We keep who thanked whom, when, and for what (which fire or arrow, what was left in which crate, who was got back up or whose things came back, and where), for 7 days: so that each player thanks each other player at most once a day, and so that the player you thanked can read who thanked them, and for what, when they next come home in the game. After 7 days it is deleted. A fire remembers the names of the last three players who fed it only in the server's memory, until the server restarts; players on its map see them, as they see whose arrow is whose. If you block someone, their thanks never reach you.

Friends and private messages

Who your friends are, the friend requests you sent and received, who you block, and whether you take friend requests and trade requests at all. Your friends see when you are online and on which map. A private message you send a friend is kept on our server, with when you sent it, only until they read it: reading it deletes it. The conversation you see stays in your browser only until you close the game.

A trade with a friend is kept only while it lasts, in our server's memory: whom it is with and what each of you puts in. Once it is done, what changed hands is simply in your bags, like anything else you carry; once it is off, nothing of it is kept.

Chat

What you say in chat goes to the players who can hear it: everyone online for world chat, the players near you for local chat (it also shows over your head). Our server passes it on and keeps none of it: not in the database and not in any log. Your game shows what you heard until you close it. Only signed-in players can talk, and some words are masked before anyone reads them. If you block someone, you no longer hear them. Up in the Quiet, nobody can say anything in world or local chat, and nobody there hears it.

A call (the short note your character sings when you hold B) goes the same way to the players on your map within 25 tiles, with the tile you stood on, and our server keeps none of it either. Guests can call too: a call has no words. If you block someone, you no longer hear their calls.

If you report someone, we keep who reported whom, the reason you chose, when, and the last thing they wrote to you as your game showed it, so that the people who look after napoland (people, not a program) can read it and deal with it. From chat, what you report is the last thing they wrote to you or said where you could hear it. The person you report is not told who reported them. The server log notes that a report was made, with both characters' ids and the reason, never what was written.

Buying looks

Once the game's shop is open, a signed-in player can buy looks for their character in the wardrobe at home: outfits, jacket patterns and name tag badges, which change how the character looks and nothing else. You pay on Stripe's own page, not in the game. Stripe processes the payment and your card, under its own privacy policy, and asks for what it needs to take a payment, such as your card and an email address for the receipt. Your card never reaches the game. We tell Stripe only which look you are buying, its price, and your character's id (a random number, never its name or your email address).

When the payment is complete, Stripe tells our server so, and we keep for each look you buy: which look, when, the price and currency, and Stripe's reference for the payment, with your character, so that the look is yours and comes back every time you sign in. If the payment is refunded, Stripe tells us that too, and we keep when; the look is then no longer yours. We never receive or keep your card details, and we do not keep the email address or anything else you give Stripe.

While you play

While you are connected, the game server uses your IP address, in memory only, to limit how many connections and new characters one address can make. That protects the game from abuse. The address is never written down: not in the database and not in any log. Our web server keeps no record of your visits.

Server logs

The game server writes down technical events, such as a character being created, joining, leaving or collapsing, with the character's id and name, a look being bought or refunded, with the character's id, the look and Stripe's reference for the payment, and errors, so that we can keep the game running and fix problems. These logs never contain email addresses, IP addresses, codes or tokens, and they are deleted after 30 days.

In your browser

The game keeps your sign-in session in your browser's local storage so you stay signed in (it includes your email address, and with Google or Apple your name), and, for the few minutes a sign-in takes, what it needs to finish: which address a code was sent to, or that you chose Google or Apple, with a one-time key that only this browser holds. If you play as a guest, or made your character before sign-in existed, your browser keeps its login token there; our server keeps only a scrambled copy of it. It also keeps your sound volume there, whether you turned the sound off, whether your radio is on, and how many calls you have sung (after the first few, the calls are shown without their words). None of this leaves your device, except to sign you in. We use no cookies and no trackers. Apart from signing in, everything the game loads, fonts included, comes from our own server.

Why we are allowed to

• To give you the game you asked for (Art. 6(1)(b) GDPR): your account, your character, your friends and your messages, the looks you buy, and everything needed to play.
• Our legal obligations (Art. 6(1)(c) GDPR): keeping the records of the looks we sell for as long as accounting law requires.
• Our legitimate interest in keeping the game safe and running (Art. 6(1)(f) GDPR): the limits per address, blocks and reports, the logs and the backups.

We do nothing else with your data: no profiling, no advertising, no automated decisions about you.

Who helps us

These companies process data for us, only on our instructions and under data processing agreements:

• Amazon Web Services runs our server, database, backups and logs (Northern Virginia, United States), and sends the emails with your sign-in codes (Amazon SES).
• Supabase handles sign-in (Northern Virginia, United States).

When you buy a look, Stripe takes the payment on its own page, and is responsible itself for what it does with your payment and card details: its own privacy policy applies there.

If you contribute to napoland on GitHub, GitHub's own privacy policy applies there.

Data outside Switzerland and the EU

These servers are in the United States. Your data is protected there by the providers' data processing agreements, which include the standard contractual clauses approved for Switzerland and the EU, and by the Swiss-U.S. and EU-U.S. Data Privacy Framework where a provider is certified under it.

How long we keep it

• Your character once you signed in with it, and your sign-in account at Supabase with its record of your sign-ins: until you ask us to delete them.
• A guest's character, and a character made before sign-in existed that nobody has signed in with (it counts as a guest): until it has not been played for 30 days, when it is deleted with its pile, arrows, thanks, what it left in crates, its first finds and what was carried back for it, but never before the rule has been in the game for 30 days. Signing in keeps it, as above.
• A pile, with the last steps before the collapse: an hour. An arrow you paint: a day (up to a week, with the Good neighbor feat).
• The last steps of a walk out in the wilds, which others alone there may glimpse: a day at most, in our server's memory only.
• Footprints in the snow of the Ridge and the Quiet, never whose: an hour at most, in our server's memory only.
• Who thanked whom, when and for what: 7 days.
• What someone carried back to the lodge for you, and who: until it is in your chest and you were told, then 7 days.
• How much your character gave to a place mended together: as long as the place is in the game, for the 20 characters who gave it the most (only the character's id and how much are written down; its name is read from the character, so it goes when the character does).
• Something you leave in a crate for whoever comes next, with your character's name and when: until someone takes it.
• Being the first to find a secret, with your character's name and the day: as long as your character exists.
• What you bought in the shop (which look, when, the price and Stripe's reference for the payment): as long as your character exists, and after that, without your character, as long as the law requires us to keep the records of our sales (in Switzerland, ten years).
• A private message: until your friend reads it. Friends, requests and blocks: until you remove them.
• A report: until we have dealt with it.
• Server logs: 30 days.
• Nightly database backups: 30 days. Server disk snapshots: 7 days.

When you ask us to delete your data, we delete your character, its pile and arrows, the thanks it gave and received, what was carried back to the lodge for it, what it left in crates, what it gave to the places mended together (and its name on their plaques), the secrets it found first, its friends, requests, blocks and unread messages (to and from you), your sign-in account and its record of sign-ins. The records of the looks you bought stay, without your character, for as long as the law requires us to keep them (above). The copies inside backups disappear by themselves within 30 days after that.

Your rights

You can ask us to show you your data, correct it, delete it, limit what we do with it, or give it to you in a form you can take elsewhere, and you can object to how we use it. Write to support@neuramare.com from the email address you sign in with, so that we know it is you (as a guest, sign in first: nothing else tells us a character is yours). If Apple hides your email from us, tell us the relay address it gave napoland: we answer there. We answer within 30 days.

You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU or the EEA, the authority of the country where you live.

Children

napoland is not meant for children under 13, and they should not sign in. If you are younger than the age at which your country lets you agree to this on your own (up to 16 in parts of the EU), ask a parent or guardian first. If we learn that a child under 13 has an account, we delete it.

Security

Everything travels over encrypted connections (HTTPS). Our server accepts only web traffic, and only the publisher can manage it. Login tokens are kept only as scrambled copies, and the whole game is open for anyone to review.

Changes

When this page changes, the date at the top changes too. If a change affects how your data is used, we will tell players in the game before it takes effect.