隐私政策PRIVACY POLICY

1. 运营者与服务商 Operator and providers

Google 登录保存唯一用户标识；对于经验证且由 Google 管理的 Gmail 或 Workspace 邮箱，保存邮箱作为账号标识，并可关联同邮箱的已验证账号。已有两份账号时不会自动覆盖或合并存档。不保存 Google 密码、访问令牌或头像。Google 按其隐私政策处理信息。身份与邮箱记录随账号导出和删除。

Google sign-in retains the unique subject and, for verified Google-managed Gmail or Workspace addresses, the email as an account identifier. A first sign-in can link to the matching verified account. Existing separate accounts and saves are not automatically merged or overwritten. We do not store Google passwords, access tokens or avatars. Google's privacy policy applies. Email and identity links are included in export and deletion.

人机验证启用时，在你开始登录、注册或找回密码流程后加载 hCaptcha，向其提供验证令牌及来源 IP 用于防机器人滥用。hCaptcha 还会根据其隐私政策处理浏览器、设备和验证交互等信息，并适用其服务条款。这属于必要安全处理，独立于可选使用统计；在你启动相应流程前不加载这些第三方脚本。具体保留及跨境处理以服务商政策和适用合同为准。

When enabled, hCaptcha loads after you start a sign-in, registration or recovery flow. Verification tokens and the source IP are sent for bot-abuse prevention. hCaptcha also processes browser, device and challenge interactions under its privacy policy and terms. This necessary security processing is separate from optional usage counters. These third-party scripts do not load before the relevant flow starts. Provider retention and international processing are governed by its policies and applicable contracts.

本游戏由中国个人开发者黄涛 / Huang Tao 运营。联系方式：tao448448@gmail.com。Turso 保存账号和游戏数据；Vercel 与仍启用的 Qoder Sites 部署承载网页、接口和运行日志。开通付费后，Creem 作为名义销售商处理付款、收据和相关销售税费，并按照其隐私政策处理结账信息。

Huang Tao, an individual developer in China, operates this game. Contact: tao448448@gmail.com. Turso stores accounts and game data. Vercel and any active Qoder Sites deployment host pages, APIs and operational logs. When payments are enabled, Creem acts as merchant of record and processes checkout information under its own privacy policy.

2. 账号、安全与找回 Accounts and recovery

服务仅面向中国大陆以外、已满18岁且达到所在地成年年龄的用户。登录前须确认年龄、居住及访问地区并接受条款；服务器保存确认版本和时间。年龄采用自我声明，不是证件核验。请使用化名，不要将现实个人信息写入角色名。发现未成年人账号后将暂停游戏访问，核查并删除不应保留的数据；监护人可通过邮箱联系。

Gameplay is for adults aged at least 18 and legally adult locally, who neither reside in nor access from mainland China. Age is self-declared, not identity-verified. Policy version and confirmation time are recorded. Use pseudonyms. Identified underage accounts will have gameplay suspended and improperly retained data reviewed for deletion; guardians can contact support.

新邮箱注册需要验证邮箱和密码；旧用户名账号继续支持，可在设置验证恢复邮箱。不要求手机号、真实姓名或身份证件。角色名可使用化名。账号保存内部编号、创建时间、权益、会话版本和恢复码哈希。新密码使用随机盐和 PBKDF2-SHA256、60万次迭代保存；旧哈希在登录时升级。恢复码只显示一次且只存哈希。退出撤销当前会话，密码修改或重置使旧会话失效。

New email registration requires a verified email and password. Existing username accounts remain supported and can verify a recovery email in Settings. No phone number, real name or identity document is required; use a pseudonym for characters. Records include IDs, creation time, entitlements, session version and recovery-code hashes. New passwords use randomly salted PBKDF2-SHA256 with 600,000 rounds; older hashes are upgraded on sign-in. Recovery codes are shown once and stored as hashes. Logout revokes the current session; password changes or resets invalidate older sessions.

注册、邮箱绑定和密码找回通过 Resend 发送必要的事务邮件，向其传递收件邮箱及验证码内容，不用于营销；服务商处理可能涉及跨境传输。验证码10分钟过期，仅保存带密钥哈希，最多尝试5次，使用后删除；过期记录在后续请求清理。待注册记录还临时保存密码哈希。已验证邮箱保留至修改或删除账号。

Resend delivers necessary registration, email binding and password recovery emails, processing the recipient address and code content, not marketing. Provider processing may involve international transfers; see Resend's privacy policy. Codes expire after 10 minutes, are stored only as keyed hashes, allow at most five attempts and are deleted on consumption; expired records are cleaned during later requests. Pending registration also temporarily stores a password hash. Verified email is retained until changed or the account is deleted.

游戏反馈保存账号编号、分类、内容、界面语言、版本和时间，用于改进与分析；不额外记录IP、设备指纹或邮箱。请勿填写密码或敏感资料。180天以前的反馈在后续请求中清理，账号导出包含反馈，删除账号同时删除反馈。

In-game feedback stores account ID, category, message, interface language, build and time for improvement and analysis, without additional IP, fingerprint or email fields. Do not include passwords or sensitive information. Feedback older than 180 days is cleaned during subsequent requests. It is included in account export and removed on account deletion.

3. 游戏存档 Game saves

Android 和 Windows 应用可无需账号离线游玩，使用应用私有网页存储（IndexedDB）保存角色、游戏流水与事件。独立本机人生不会自动上传，也不包含账号凭证或付费权益。已登录的云端人生会在本机保存副本与待同步记录；断网后可继续，重新登录原账号时须确认同步。云端版本不同则不自动覆盖，本机副本可归档。共用设备上的其他使用者可能看到这些本机角色；在本机存档管理中可导出或删除，卸载或清除应用数据也会删除。删除云端账号不会远程擦除已下载到离线设备的副本。导出的文件由你选择保存或分享的位置自行保管。

Android and Windows apps can be played offline without an account. Characters, game journals and events are stored in the app's private web storage (IndexedDB). Independent device lives are not uploaded automatically and contain no account credentials or purchase rights. A signed-in cloud life keeps a device copy and pending sync records. After a disconnection you can continue locally; syncing requires signing in to the original account and confirming the choice. Different cloud versions are not overwritten automatically; device copies can be archived. Other users of a shared device may see local characters. Device-save management supports export and deletion. Uninstalling or clearing app data also removes device saves. Deleting a cloud account does not remotely erase copies already downloaded to offline devices. You control where exported files are saved or shared.

服务器保存角色状态、剧情进度、技能、物品、关系、资产、职业、账本和事件记录，以及离线结算时间。保存请求带版本号与唯一编号，用于避免多设备覆盖和重试重复记账。连续变化会合并保存，网络故障时重试；关闭网页前尚未成功提交的进度仍可能丢失。第一栏位的云存档免费；可选购买增加一个独立云存档的角色栏位，详见服务条款。

Cloud saves hold character state, story progress, skills, inventory, relationships, assets, career, ledgers, events and offline-settlement time. Versions and request IDs prevent conflicting saves and duplicate retries. Changes are coalesced and network failures retried; progress not committed before closing the page can still be lost. Cloud saves for the first slot are free. The optional purchase adds a character slot with an independent cloud save; see the Terms.

4. 浏览器存储与令牌 Browser storage and tokens

新会话通过 Secure、HttpOnly、SameSite=Lax Cookie 保存，网页脚本不能读取令牌。旧版 localStorage 令牌在更新后移除；localStorage 保存设备及可选统计偏好。签名登录令牌最长有效30天，包含账号、角色、会话版本、随机编号及到期时间。签名使用服务端密钥，未单独配置时从数据库凭证派生。游戏代码不设置广告或追踪 Cookie。清除浏览器存储会退出账号并重置本机设置，不会删除已成功写入云端的存档。

New sessions use a Secure, HttpOnly, SameSite=Lax cookie, inaccessible to page scripts. Legacy localStorage tokens are removed; localStorage holds device and optional analytics preferences. Signed tokens last up to 30 days and contain account, character, session version, nonce and expiry. Signing uses a server secret, or a key derived from the database credential when no separate secret is configured. Game code sets no advertising or tracking cookies. Clearing browser storage signs you out and resets device preferences; committed cloud saves remain.

Android 和 Windows 客户端使用同一账号和云存档服务。客户端在系统浏览器中登录，获得明确同意后，通过两分钟有效、一次性且绑定 PKCE 的加密授权码返回应用。应用访问凭证仅保存在运行内存中，不写入 localStorage 或应用文件；应用进程退出后需重新登录。客户端凭证与网页 Cookie 相互隔离，系统浏览器继续遵循其自身的 Cookie 与隐私设置。应用暂停时尝试保存，尚未被服务器确认的进度可能丢失。当前客户端未接入广告 SDK。

Android and Windows clients use the same account and cloud-save service. Sign-in takes place in the system browser. After explicit approval, an encrypted, single-use authorization code, valid for two minutes and bound to PKCE, returns to the app. App access credentials remain in running memory and are not written to localStorage or application files; restarting the process requires sign-in again. App credentials and website cookies are isolated. The system browser retains its own cookie and privacy settings. The app attempts to save when suspended; progress not confirmed by the server may be lost. The current clients contain no advertising SDK.

5. 运行监控、防滥用与统计 Security and operational metrics

若所在地区开放牌桌，每次进入前需另行确认真实年龄至少21岁且达到当地成年年龄、居住及访问地区和牌桌协议。账号保存最近确认的协议版本、时间及平台提供的国家代码；不通过该流程收集出生日期、证件或精确定位。记录可随账号数据导出或删除。

Where tables are enabled, each visit requires a separate 21+/local-adult, residence/access-region and table agreement confirmation. The account retains the latest version, timestamp and provider-supplied country code, exportable/deletable with account data. This flow collects no birth date, ID document or precise location.

下述清理在请求触发的维护中执行，并非定时任务；低流量或停服时可能晚于90天。过期限流及会话记录同样采用机会式清理。平台日志的具体保留期需按平台设置核实。

Cleanup below runs opportunistically during requests, not on a scheduled job, and may occur later than 90 days during low traffic or downtime. Expired rate-limit and revocation records are also cleaned opportunistically. Provider log retention must be checked against provider settings.

可选客户端统计默认关闭，可在设置中主动开启并随时关闭；Global Privacy Control 信号会阻止发送。必要的服务端安全与交易计数独立运行。关闭可选统计不影响登录、存档或其他玩法。

Optional client usage counts are off by default, can be enabled or withdrawn in Settings, and are suppressed by Global Privacy Control. Necessary server security and transaction counts operate separately. Refusing optional analytics does not affect gameplay.

启用可选统计后，我们另按账号去重记录首次进入、首次有效行动、首章完成、支持者包预览、结账页准备和次日回访的时间，用于统计同一观察人群的七日转化与 UTC 次日回访。这张独立进度表关联内部账号编号，不保存邮箱、IP、搜索词或跨站轨迹；管理界面仅返回汇总。付款结果来自已验签的订单记录，不由客户端声明。进度保留约90天，采用下述机会式清理；关闭统计并联网、收到 Global Privacy Control 信号并联网，或删除账号时会删除关联进度。个人数据导出包含这些记录。其他设备需同步关闭统计；匿名事件汇总无法逐人撤回。

If you enable optional analytics, a separate account-deduplicated progress table records timestamps for first entry, first meaningful action, first chapter completion, pack preview, checkout readiness and next-UTC-day return. This measures seven-day conversion within the same observed cohort. It links an internal account ID, but stores no email, IP, search terms or cross-site activity; the admin view returns aggregates only. Payment outcomes come from verified order records, never client claims. Progress is retained for about 90 days with the opportunistic cleanup described below. Disabling analytics while online, entering with Global Privacy Control while online, or deleting the account deletes linked progress. Data exports include it. Other devices must also disable analytics; anonymous aggregate counters cannot be withdrawn individually.

官网的“隐私选择”与游戏设置共用可选统计偏好。同意后，推广参数或来源网站域名仅转换为 direct、google、bing、community、social、email 或 other 等有限来源类别，汇总官网及玩法指南访问、开始点击、攻略点击、三类玩法视频播放与结束、注册成功、登录成功与游戏载入次数。不会把完整推广参数、来源地址或搜索词、页面地址、邮箱或账号编号写入统计表；可选来源类别及已计数标记仅保存在当前标签页的 sessionStorage 中，30分钟到期。关闭统计会清除此来源记录。拒绝统计不影响官网或游戏。

Website Privacy choices and game Settings share the optional analytics preference. After consent, campaign parameters or the referring site's hostname are reduced to a fixed source category: direct, google, bing, community, social, email or other. Daily aggregates count website and gameplay-guide visits, play and guide clicks, the three gameplay clips' plays and endings, successful registrations, logins and game loads. Full campaign parameters, referrer URLs or search queries, page URLs, emails and account IDs are never stored in the analytics table. The optional category and counted-event flags stay in sessionStorage for the current tab with a 30-minute expiry; disabling analytics clears them. Refusing analytics does not affect the website or gameplay.

为防止撞库和接口滥用，服务端读取请求来源 IP，并用服务端密钥生成限流标识；游戏数据库不保存原始 IP。限流记录按窗口过期清理。运行日志记录请求随机编号、版本、状态码、耗时和固定错误类别，不记录密码、令牌、恢复码、完整存档、银行卡信息或请求正文。承载平台也会按其政策处理网络访问日志。

我们按日汇总游戏启动、牌桌打开、结账入口、付款与退款、存档冲突及错误事件次数，不建立用户画像、不统计跨站浏览行为，也不把账号编号写入汇总表。客户端重复错误会限频。汇总数据按90天窗口清理，管理页面只展示最近30天；平台运行日志的保留期由承载平台配置决定。

For abuse prevention, the service reads the source IP and derives a rate-limit identifier with a server secret, without storing raw IPs in the game database. Rate-limit records expire. Operational logs contain random request IDs, build, status, duration and fixed error categories, not passwords, tokens, recovery codes, save contents, card data or request bodies. Hosting providers also process network logs under their policies. Daily counters cover game starts, table opens, checkout, payment and refund outcomes, save conflicts and errors. Aggregate tables contain no account IDs or browsing profiles. Client errors are throttled. Counters are cleaned on a 90-day window; the admin view shows 30 days. Hosting-log retention depends on provider configuration.

6. 支付记录 Payment records

游戏服务端保存订单与结账编号、内部账号关联、金额与币种、支付或退款状态、时间、同意的条款版本及回调事件编号。Creem 结账可能接收用于关联订单的内部账号编号。卡号等支付凭据不经过游戏服务器。为处理退款、拒付和对账，支付记录可能在账号删除后按必要期限保留；删除账号不会自动取消已发生交易或发起退款。

The server stores order and checkout IDs, internal account references, amount, currency, payment/refund state, timestamps, accepted terms version and webhook IDs. Creem may receive an internal account reference to associate checkout with an account. Card credentials do not pass through game servers. Records needed for refunds, disputes and reconciliation may be retained after account deletion for the necessary period. Deletion does not automatically refund a purchase.

7. 公开内容与存储地区 Public content and location

财富榜默认不公开角色。主动开启后向其他已登录玩家展示角色名、角色年龄、城市和虚拟净资产，可随时撤回，不兑现现实奖励。剧情模板由运营者发布，普通玩家不能写入共享模板或行情新闻。当前默认数据库位于 Turso 东京区域，服务器接口配置在 Vercel 东京区域；服务商处理数据可能涉及跨境传输。

Leaderboard publication is off by default. On opt-in it displays character name, simulated age, city and virtual net worth to signed-in players, without real-world rewards. You may withdraw publication in Settings. The operator publishes story templates; players cannot write shared templates or market news. The default database is in Turso's Tokyo region and Vercel APIs are configured for Tokyo. Provider processing may involve international transfers.

8. 保留、删除与数据请求 Retention and your choices

设置支持导出账号、角色、账本、事件和订单记录。你可撤回可选统计和排行榜公开选择，或请求限制处理、反对处理以及适用的其他权利，并向有管辖权的数据保护监管机构投诉。地区访问限制不取消既有用户的数据权利；无法登录时可通过邮箱联系，经核验账号控制权处理。

Settings provides an export of account, characters, ledger, events and orders. You may withdraw optional analytics or leaderboard choices, request restriction or objection where applicable, and complain to the competent data protection authority. Regional gameplay restrictions do not remove existing data rights; contact support for verified requests if unable to sign in.

账号和游戏进度保留至你删除账号或服务结束。你可在设置的账号安全中输入当前密码、明确确认后永久删除账号及全部角色、存档、账本和事件记录。仅使用 Google 的账号可在重新 Google 登录后5分钟内明确确认删除，无须提供不存在的本地密码。支付与安全记录按上述必要期限另行处理，无法从匿名汇总次数中单独移除一次事件。

你也可通过联系邮箱提出访问、导出、更正、删除或其他适用的数据权利请求。我们会核验账号控制权，不能仅凭用户名或一封未验证邮件删除、导出他人数据。请勿在邮件中发送密码或恢复码；无法登录时先使用恢复码找回。我们通常在30天内答复，依法需要延期时会说明原因。

Accounts and game progress remain until account deletion or service shutdown. In Settings, account deletion requires the current password and explicit confirmation and permanently removes characters, saves, ledgers and events. Payment and security records follow the necessary retention described above. Individual events cannot be extracted from anonymous counters. Contact us for access, export, correction, deletion or other applicable rights. We verify control of the account and do not disclose or delete data based only on a username or an unverified email. Never email passwords or recovery codes; use recovery first if locked out. We normally respond within 30 days and explain any legally permitted extension.

9. 未成年人、处理目的与更新 Age, purposes and updates

适用法律要求合法性基础时：账号和存档以提供你请求的服务、履行合同为目的；必要安全处理基于防滥用的合法利益；可选统计与公开排行榜基于可撤回的选择；依法保留的财务记录用于履行法定义务。我们不出售个人信息、不进行定向广告或跨站画像。运营者位于中国大陆，可能为维护服务访问海外数据；服务商及分包商也可能在其他国家处理数据，海外部署不当然豁免个人信息和跨境义务。

Where legal bases are required, accounts and saves perform the requested service and contract; necessary security relies on legitimate interests in preventing abuse; optional analytics and leaderboard publication depend on a withdrawable choice; statutory financial records meet legal obligations. We do not sell personal data, run targeted advertising or create cross-site profiles. The operator in mainland China may access overseas data for maintenance, and providers and subprocessors may process data in other countries. Hosting abroad does not itself exempt the service from privacy or transfer obligations.

账号、存档和订单数据用于提供约定的服务；必要安全日志用于防滥用、故障处理和维护服务，付款记录也用于履行相关义务。全部游戏服务仅向已满18岁且达到所在地成年年龄的用户开放，登录前需自行确认；游戏角色年龄不等于玩家真实年龄。政策变化会更新本页日期并在游戏中公布；涉及需要另行同意的处理时会依法征求同意。

Account, save and order data provide the requested service. Necessary security records prevent abuse and support fault handling; payment records also meet applicable obligations. All gameplay is for adults aged at least 18 and legally adult locally, with self-confirmation before sign-in. Character age is not player age. Changes update this page and are announced in the game. Separate consent will be requested where legally required.