Download

Privacy Policy

Data processed for your Togu account and gaming experience.

Updated on

Togu Dev Team, a non-professional, non-commercial project, is the controller of the data processing described here. For questions about how your data is used or to exercise your rights, email [email protected].

  • Voting leaderboard. Your nickname without its tag and your monthly vote count are published on the leaderboard, based on our legitimate interest in supporting the community. You can object using the switch on /voter/. These data are recalculated from votes and deleted with your account.

  • Account. Your email address, password hash (an Argon2id hash of an HMAC with a pepper), username and tag, language, and the version of the terms you accepted are used to manage your account and provide the game. Legal basis: performance of a contract (GDPR Article 6(1)(b)). This data is kept for the life of the account. Pending accounts are purged 7 days after their verification link expires.

  • Account security. The encrypted TOTP secret, digests of your recovery codes, and passkeys are used to protect account access. Legal basis: performance of a contract (GDPR Article 6(1)(b)). They are kept for the life of the account or the relevant factor.

  • Sessions and devices. This data is used to authenticate you. Legal basis: performance of a contract (GDPR Article 6(1)(b)). It is kept until the session expires and for a further 30 days. Launcher sessions use the fixed label “Launcher”.

  • Audit log and IP address. This data is used for security and fraud prevention. Legal basis: legitimate interests (GDPR Article 6(1)(f)). The IP address is kept for 30 days; the audit event is then pseudonymized and kept for 90 days.

  • Quota counters. These digests are used to prevent abuse. Legal basis: legitimate interests (GDPR Article 6(1)(f)). They are kept for one day.

  • Game connection tickets. These are used to secure the connection to the game. Legal basis: performance of a contract (GDPR Article 6(1)(b)). The account service keeps them for 30 days.

  • Invitation codes. A used code remains linked to your account as history for as long as the account exists and is deleted with it. An expired or revoked code that has not been used is purged after 30 days.

  • Characters and game state. This data is held by the game server, separate from the account service, to provide the game. Legal basis: performance of a contract (GDPR Article 6(1)(b)). To request an export of game data, email [email protected]. After an account deletion request, character deletion follows as soon as the character is no longer in the game; it may therefore wait until disconnection.

  • Game server logs. Frame logs are kept for 7 days and system logs for 30 days for service security and operation.

  • Backups. Backups are encrypted and kept for up to 37 days to maintain service continuity. Legal basis: legitimate interests (GDPR Article 6(1)(f)).

Providers and recipients

  • Cloudflare, Inc. hosts the site, the account API tunnel, and R2 storage used for the launcher and encrypted backups. The Cloudflare Turnstile widget is loaded during registration to detect bots. Togu relies on its legitimate interests (GDPR Article 6(1)(f)) for this anti-automation processing. Cloudflare also says it uses information to improve Turnstile under its privacy policy. The verification server sends the IP address to Cloudflare; the account service does not retain Turnstile signals.
  • Oracle America, Inc. (Oracle Cloud Infrastructure) hosts the account and game servers.
  • Resend sends transactional emails and receives their recipient, subject, and contents for that purpose.
  • Have I Been Pwned receives only the first 5 hexadecimal characters of the password’s SHA-1 hash during registration and password changes to check whether it has been compromised. It never receives the password or the full hash.

Transfers outside the European Union

Cloudflare, Inc., Oracle America, Inc., and Resend are certified under the EU–US Data Privacy Framework. In the program register, Cloudflare has participant number 5666 and Resend has participant number 8907; Oracle describes its framework in its transatlantic Data Privacy Framework terms. These checks were made on 26 October 2026. If this certification does not apply to a transfer, the European Commission’s standard contractual clauses provided for in the relevant contracts apply.

Cookies and sessions

The public pages of the site do not set cookies. In the account area, the __Host-session cookie is Secure, HttpOnly, and SameSite=Strict; it lasts for up to 30 days and expires after 7 days of inactivity. The __Host-mfa cookie, used during two-factor authentication validation, expires after 5 minutes. The registration Turnstile widget is subject to the Cloudflare policy linked above.

Your rights and how to exercise them

You may request access to your data, its rectification or erasure, data portability, or object to processing. You can export account data and request account deletion from the account area. To request an export of game data, email [email protected]. Account data purging starts about 24 hours after the request, at the next hourly processing run; character deletion takes place as soon as the character is no longer in the game.

You may also lodge a complaint with the CNIL, the French data protection authority. Requests to exercise your rights receive a response within the statutory one-month period. For any request, email [email protected].