Bezgelor

Privacy Policy

Draft, pending legal review

This text describes what the server does today, in plain words. It has not been reviewed by a lawyer and may change before the public realm opens. If something here worries you, ask via Discord or a GitHub issue .

Draft of October 13, 2026.

Bezgelor is a fan project. This page says what the server and this website record about you, what happens to it and what is published. Where something is planned but not running yet, it says so.

1. What we collect

Your account

  • Email address, and when you verified it.
  • Your login proof, not your password. The game uses SRP6: we store a salt and a verifier derived from your email and password. The password itself is never stored or sent.
  • Short-lived game session values (a login token and a session key) while you log in to the game.
  • 2-Step Verification, if you turn it on: your authenticator secret (stored encrypted), hashed backup codes, a counter of failed attempts, and the IP addresses you chose to trust for 7 days (up to 20 per account).
  • The record also has optional fields for a linked Discord name. The site does not offer linking yet, so they are empty.
  • Roles, suspensions and whether the account is closed.

Your characters and play

  • Characters, their appearance, progress, items, currency, quests, achievements, reputation, paths and tradeskills, housing, guild membership and the game's other character state.
  • Mail you send and receive (text, attachments, money), your friends, rivals and ignore lists, and trades and marketplace orders.
  • Chat lines in the channels the server logs are kept for 7 days (a server setting) so moderators can act on reports, then deleted.

The event stream

The server records a stream of game events: logins and connections, entering zones, kills, deaths, quests, items and currency gained or spent, trades, group and guild actions, and what the abuse checks see. Each event carries your account and character ids and a precise time. It is used for debugging, balance, finding cheating and abuse, and measuring how the game is played. It is never published as it is. Chat text is not in it. Raw IP addresses are kept for 30 days and then removed, keeping only a salted hash. Detailed debug records are kept for 14 days. Other events and per-minute counters are kept.

Bug reports

If you report a bug with /c bug or the game's Report a Bug window (Help), we store your words and the context the server knows: your character's summary, position and target, your last ten casts, the state of the quest you chose, your character's game events and server log lines from the 60 seconds before, and the build. Chat, whispers, email addresses and IP addresses are not captured. Developers read reports. Entries in the public issue tracker hold no character names or accounts.

Staff actions

Actions by staff in the admin area (who did what, to whom, and the staff member's IP address) are written to an audit log.

2. How we use it

  • To run the game and this website, and to let you log in.
  • To protect accounts (2-Step Verification, lockouts) and to find cheating and abuse.
  • To fix bugs, balance the game and check our work against how WildStar behaved.
  • To publish anonymised data and test reports (next section).
  • To send mail about your account, such as verification.

3. Open data

Bezgelor wants to share what it learns. Two kinds of data are involved, and they are kept apart.

  • Test reports are published today. They come from automated test characters on a test server, not from players.
  • Play data from the public realm will be published in anonymised form once that realm is open. None has been published so far, and the tool that produces it is not running yet. The plan: daily totals, and daily event logs released 7 days late, with pseudonyms that change every day (the key destroyed) so days cannot be chained into a profile, times rounded to the hour for session and social events, any pattern seen in fewer than 5 players folded into a total, and never any names, free text, IP addresses, chat or the pairs of players in social events. The tool will be open source so the method can be audited, and each release will state its remaining risk.

Playing on the public realm means taking part in this. There is no opt-out. If you want privacy, run your own Bezgelor server; the source is public.

4. Storage and security

Data is stored in a PostgreSQL database. Passwords are never stored (see above), and the 2-Step secret is stored encrypted. We take reasonable care, but no system is perfectly secure, and this is a small volunteer project.

5. Who sees it

We do not sell your data. Staff can see account and character data in the admin area according to their role, and their actions are logged. We may share data if the law requires it or to protect people or the project. The anonymised data above is public.

6. How long we keep it

  • Chat lines: 7 days.
  • Raw IP addresses in the event stream: 30 days (the salted hash stays).
  • Detailed debug records: 14 days.
  • Trusted IPs for 2-Step Verification: 7 days each.
  • Account, character and event data: while the account exists. When you close your account it can no longer log in, and the records of your play linked to it are kept for balance and abuse work, then anonymised. That anonymisation step is not automated yet; if you want something removed sooner, ask us.

7. Your choices

  • See your own data: the My Activity page shows your own event stream and exports it as CSV or JSON. Your characters, mail and settings are in the portal.
  • Correct or remove something: change what you can in Account Settings; for the rest, ask us (see Contact).
  • Close your account: Account Settings, Danger Zone.
  • 2-Step Verification and trusted IPs: you can turn it off and forget trusted IPs.

8. Copyright notices (DMCA)

Bezgelor respects intellectual property rights. If you believe your copyrighted work has been infringed, tell us through Discord or a GitHub issue (draft: a formal contact address will be added). Please include:

  • A description of the copyrighted work
  • Where the infringing material is
  • Your contact information
  • A statement of your good-faith belief

9. Cookies and browser storage

This website sets one cookie, a signed session cookie (_bezgelor_portal_key), which keeps you logged in and protects forms against forgery. Your theme choice (light, dark or system) is saved in your browser's local storage, not in a cookie. We use no tracking cookies and no third-party analytics.

10. Children

Bezgelor is not for children under 13, or under the age of digital consent where you live if that is higher. We do not knowingly collect data from them; tell us if you think we have.

11. Changes

This is a draft and will change, at the latest when the public realm opens. We will say so in the news and change the date above.

12. Contact

For privacy questions, use Discord or a GitHub issue (do not post private data in an issue; ask for a private channel instead).