What we keep about you, why we keep it, and for how long.

Last updated: 1 November 2026

Who we are

Mamluk is made by DarAlIlm Studio, in Ireland, which is responsible for your information.

To reach us about anything on this page, write to [email protected] or use Report a problem.

In short

• We keep what it takes to run your account and your hero, and to keep the world safe from abuse.
• There are no advertisements, analytics or trackers on this website, and we do not sell your information.
• We mail you only to confirm your address and to reset your password.

What we keep

Your account. Your username, your email address, and your password as a salted scrypt hash: a one-way scramble that cannot be turned back into the password, by us or by anyone else. Also when the account was made, when the address was confirmed, when you last logged in, how many logins have failed in a row, whether the account is locked or suspended, and whether it has asked for or been given access to the world and until when.

Logging in on the website. A cookie holds a secret token and we keep only its hash, with when the session began, when it was last used, and the IP address and browser description from when you logged in.

Logging in from the game. If you choose to be remembered, a long token stays on your computer, in the Windows registry, with your username and the name of the hero you last played. We keep only its hash, with when it was made and last used, for up to five devices per account. Your password is not kept on your computer. Each time a hero enters the world we also make a one-time pass, of which we keep the hash, the hero it is for, the IP address and the times.

A record of logins. Every attempt, on the website or in the game, successful or not: the username typed, the account if there is one by that name, the IP address, whether it worked and why not, and the time. This is how we notice someone trying to get into an account.

Mailed links. For each link we send, the hash of its token and when it expires and was used.

Your heroes. For each one, its name and look, where it stands in the world, its hitpoints, skills, backpack, equipment, combat style, and its progress in training and scholarship, with when it was made and last saved. Other players see a hero's name and look. They do not see your username or your email address.

Problem reports. What you wrote on the report form, the address you gave if you gave one, your account if you were logged in, and when you sent it. The address is used only to answer you. We do not store your IP address with a report.

Things that pass through. Chat goes through the world server to the other players, and the server does not store it. The world server needs your IP address to exchange game data with you. To limit repeated attempts, the website counts requests by IP address and username in its memory only, which is cleared when it restarts.

Server logs. The web server keeps an ordinary log of requests: IP address, time, the page or file asked for, and the browser description. The website's own log names any email address a mail could not be delivered to.

Why we keep it

• To give you the game you asked for: your account, your heroes, your logins and the mail that confirms your address or resets your password.
• To keep the game safe and working, which is our legitimate interest: the record of logins, the server logs, the backups and the limits on repeated attempts.
• To put right what you tell us about: your problem reports.

Cookies

There is one, mamluk_session, and it is set only when you log in. It keeps you logged in and does nothing else. It cannot be read by scripts on the page, and it lasts 30 days from when you log in, or until you log out.

Who else sees it

• Those who run Mamluk can look up accounts, heroes and problem reports, to look after the game and answer you. Other players cannot.
• Our mail provider delivers our mail, so it receives your address and the mail's text, including the link in it. If you send a problem report, a copy of the report may go through it to the mailbox where we read reports: what you wrote, the address you gave, and your account's identifier.
• Our network and hosting providers carry the traffic to and from our servers, so they handle your IP address and what passes between you and us.
• The law. We give information to others only when the law obliges us to.

Some of these providers may handle information outside Ireland and the European Economic Area. Where they do, the safeguards that data protection law requires apply.

How long we keep it

• Account and heroes: as long as the account exists. Nothing removes a quiet account by itself.
• A hero you delete: it leaves the game at once, nobody can play it or see it, and its name is free for others. We keep its record for 30 days in case something has to be put right, and for as long as a problem report from your account is still open, and then erase it. It can stay in the backups for about a month after that.
• Website login: your browser drops the cookie after 30 days, and we erase the login when you log out or reset your password.
• Remembered device: until you have made five newer ones, or you reset your password.
• Mailed links: a confirmation link works for 24 hours and a password link for 1 hour, once each.
• One-time pass to the world: it works for one minute, once.
• Record of logins: as long as the account exists, and erased with it. Attempts on a username that has no account are erased after 90 days.
• Expired website logins, and spent links and passes: erased within about a week.
• Problem reports: one year.
• Server logs: up to one year.
• Backups: the database is copied every night and the last 30 copies are kept, readable only by the server's administrator. Something erased today can stay in those copies until they age out, about a month later.

What you can ask of us

You can change your password yourself on the password page. For the rest, write to us at the address above, from the address on your account:

• to see what we hold about you, or to have a copy of it;
• to correct it, such as changing your email address;
• to erase your account;
• to object to something we do with it, or to have us hold it without using it for a while.

Erasing an account removes it with its hero, its website logins, its remembered devices and its record of logins, and cannot be undone. Any problem reports stay for their year, no longer linked to the account.

We answer within one month. Irish and European Union data protection law apply. If you are unhappy with how we handle your information, you can complain to the Data Protection Commission in Ireland, at dataprotection.ie, or to the data protection authority where you live.

Children

Mamluk has cartoon sword fighting and is for players aged 7 and over. We do not ask your age. If you are under 16, a parent or guardian must give permission and should set up the account with you, using their own email address. If we learn that an account belongs to someone younger than 7, or to someone under 16 without that permission, we will erase it.

Parents and guardians: players can talk to each other in public chat and by private message, and we do not check what they say. You can ask to see or erase your child's information by writing to the address above.

Keeping it safe

Passwords and tokens are stored only as hashes, so a copy of the database would not give them away. Backups are readable only by the server's administrator. No system is beyond all harm: use a password for Mamluk that you use nowhere else.

If this page changes

The date at the top will change with it. If the change matters to what we keep or who sees it, we will say so in the News.