Privacy Policy

1. Who We Are

Vowforged is developed by Brave Unknown ("we," "us," or "our"). This Privacy Policy explains what information this website (the "Site") collects when you visit, how we use it, and the choices you have. It covers the Site only — if the Vowforged game itself collects information differently once released, that will be disclosed separately, in-game or on its store page.

2. Information We Collect

Information you provide

If you sign up for our mailing list, the email address you submit is passed to our email marketing provider, Brevo, to add you to the list. We don't keep a copy: the address is held only briefly, encrypted, while it's being sent to Brevo, and it's never written to our logs. See "Third-Party Services" below for more on Brevo.

Information collected automatically

When you browse the Site, we automatically log the page path you visited, the domain of the site that referred you here (if any), and your browser and device type, parsed from your browser's user-agent string. We also generate a visitor identifier for each visit.

That identifier is not a cookie. It's a one-way cryptographic hash of your IP address, browser user-agent, a secret key, and the current date, so your IP address can't be read back out of it. Because the date is baked in, the identifier changes every day: the same visitor can be counted within a single day (so we can count unique visitors) but not linked across days. Because we hold the secret key, the identifier is pseudonymous rather than fully anonymous, but we only ever use it to count visits, never to identify you. Your raw IP address isn't stored with these page-view records, and traffic identified as bots or crawlers is excluded from this logging.

Your IP address and browser user-agent are also stored with your browsing session, which keeps the Site's forms and security checks working. A session expires after two hours of inactivity, and expired sessions are deleted automatically. If you try to sign in to the Site's admin panel, the attempt is logged with your IP address, browser, and the email address entered, to protect the panel. Our hosting providers also receive your IP address when they deliver the Site to you (see "Third-Party Services" below).

Cookies

The Site sets two functional cookies — a session cookie and a security (CSRF) token cookie — used to keep the Site working correctly (for example, form submissions and security checks). Neither is used to track you across other websites or shared with advertisers. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics scripts or ad pixels on the Site. Site fonts are bundled with the Site itself rather than loaded from a third-party font service at runtime.

Some pages embed content from third-party services described below (for example, a YouTube trailer or the Shopify merch widget); those services may set their own cookies when that content loads. We use YouTube's privacy-enhanced embed mode, which limits this, but doesn't guarantee no cookies are set.

3. How We Use Information

• To send occasional Vowforged news and updates to mailing list subscribers.
• To understand aggregate traffic patterns — which pages are popular, where visitors come from, and what devices and browsers they use — so we can improve the Site.
• To operate and secure the administrative panel our team uses to manage Site content.

We do not sell your personal information, and we do not use it for targeted advertising.

4. Third-Party Services

• Hosting. The Site is hosted on Laravel Cloud, and its images and other uploaded files are served from Cloudflare's storage service. Like any web host, these providers receive technical information such as your IP address and browser details when they deliver pages and files to you, and may keep it in their server logs. Their own privacy policies govern that data.
• Mailing list. Newsletter sign-ups are handled by Brevo, our email marketing provider. Brevo stores the email address you submit and sends the updates you signed up for; its own privacy policy governs its handling of that data.
• Bot protection. Our mailing list sign-up forms, in the footer of most pages and in the sign-up pop-up, are protected by Cloudflare Turnstile, which runs a check in your browser to confirm you're not an automated script before your submission is accepted. Because a sign-up form is present on every page, this check loads on every page you visit, and when you submit the form we send Cloudflare your IP address to confirm the check. Cloudflare's own privacy policy governs its handling of the data involved.
• Merchandise. Merch is sold through embedded Shopify Buy Button widgets. Completing a purchase happens on Shopify's platform, whose own privacy policy and terms apply to that transaction. We do not receive or store your payment information.
• Video. Where a trailer is available, it's embedded from YouTube using YouTube's privacy-enhanced mode (youtube-nocookie.com), which limits cookies set before you interact with the player. Google's own privacy policy governs its handling of the data involved.
• Steam and Discord. Links to the game's Steam store page or our Discord server take you to Valve's or Discord's own platform, each governed by its own privacy policy.

5. Data Retention

• Mailing list email addresses are held by Brevo (see "Third-Party Services" above) until you unsubscribe or ask us to remove them.
• Automatically collected page-view records (path, referrer domain, browser/device type, and the daily-rotating visitor identifier) are kept for 13 months and then deleted automatically. We only ever look at them in aggregate, as site-traffic reports.
• Session records, including your IP address, are deleted automatically once the session expires.
• Records of sign-in attempts to the admin panel are kept as a security log.

6. Your Choices and Rights

You can ask us to tell you what personal information (your email address) we hold about you, or to delete it, at any time. Depending on where you live, you may have additional rights under laws such as the EU/UK GDPR or the California Consumer Privacy Act (CCPA) — including the right to access, correct, delete, or restrict use of your personal information, and to lodge a complaint with your local data protection authority. Contact us using the details below to exercise any of these rights.

7. Children's Privacy

The Site is not directed at children, and we do not knowingly collect personal information from children under 13 (or under 16 in the UK/EEA). If you believe a child has provided us with personal information, contact us and we will delete it.

8. Data Security

We take reasonable technical and organizational measures to protect the information we hold, including encrypted connections (HTTPS). No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

10. Contact Us

Questions about this Privacy Policy, or requests regarding your personal information, can be sent to [email protected].