Privacy

The short version

To play on KcdM you need an EGX account (username, e-mail address, password). KcdM does not use cookies, does not track you and does not sell anything about you. We only handle what is strictly needed to run the platform.

This website

No cookies, no analytics, no advertising, no third-party scripts: fonts and images are served from eggxa.com itself. Like any website, our host (o2switch, France) records technical access logs (IP address, date, requested page) for security, kept for a limited time.

The launcher

• At each start, KcdM.exe checks for updates on eggxa.com and on the platform. These servers see your IP address, as with any download.
• Your settings, favourites and history are stored only on your PC, in %LOCALAPPDATA%\KcdM.
• When you join a server, your in-game name and your IP address are sent to that server so you can play. The server's owner is responsible for what they do with it.

Your EGX account

• We keep your username, your e-mail address (verified by a 6-digit code; used only to help you recover your account and for account messages), a salted hash of your password (scrypt, never the password itself), the dates your account was created and changed, and the last IP address you signed in from, for security, deleted after 30 days.
• If you enable two-factor authentication, we keep its secret and the fingerprints of your backup codes. If you create a server key, we keep only its public half, its name and its creation date.
• Signing in on the launcher keeps you signed in on that PC: the session is stored encrypted by Windows, only for your Windows user. Only a fingerprint of each session token is kept on our side. A session opened from a browser expires after 7 days without use (30 days at most). You can list your devices and sign out everywhere from compte.eggxa.com.
• When you join a server, it receives your in-game identity and your username from the platform, not your e-mail or password.
• You can delete your account at any time from compte.eggxa.com or by asking us: it is removed together with its sessions.
• Account e-mails are sent by our own server (no third-party e-mail service).

Server owners

A server listed on KcdM publishes its name, description, logo, tags, region, player count and address in the public list. This information is chosen by its owner in server.cfg. A server marked as verified is linked to the EGX account of its owner, whose username is shown.

Each server owner is responsible for the data their own server keeps (in-game accounts, characters, IP addresses, logs): they are the controller of that data, EGX only passes your in-game identity and username to them when you join.

How long we keep things

• Account data: as long as the account exists. Deleted accounts are removed from the live data at once, and from our encrypted backups within 30 days.
• Last sign-in IP address: 30 days. Browser sessions: 7 days without use, 30 days at most. Launcher sessions: 365 days without use.
• Platform backups: encrypted with a key that is not on the server, kept 14 days on the server and 30 days off-site.
• Technical logs of the platform (service journal): limited by the system to a few weeks. Game-server logs of the servers we operate (Bohemiae RP): rotated by size, about 100 MB at most.

If something goes wrong

If we ever learn of a breach of personal data (an intrusion, a leak), we assess it within 24 hours, notify the competent supervisory authority within 72 hours when required by the GDPR, inform the players concerned directly when the risk for them is high, record the incident in our breach register and publish what happened on this page.

Your rights

Under the GDPR you can ask to access, correct or delete personal data about you (including your EGX account, which you can also delete yourself). Most requests are answered by the sections above; our contact channels will be published on this page and in the support section.