Privacy & data.

The data controller for emrald.xyz is Lucas Descamps, founder of Emrald Games (France). Contact: [email protected].

Emrald has two sides — the creator panel (you, signing in to manage projects and servers) and the game backend (data persisted for players who connect to those servers). Both collect distinct categories of data.

Panel (creators)

• Steam profile — your Steam ID (64-bit number), display name, avatar URL, and optionally your email address. Provided by Steam when you sign in via OpenID.
• Sessions — an HTTP-only cookie containing a random session token, plus the user-agent and a SHA-256 hash of your IP address (used to detect suspicious activity). Cleared on sign-out.
• Projects you create or join — name, slug, logo, member role, environment configuration (variables, permissions, groups, addon idents), and audit log entries of your actions on the project.

Game backend (players)

• Player profile per project — Steam ID, display name, in-game money / bank balance, XP, kills, deaths, playtime, inventory, appearance, and similar gameplay state. Persisted so progress survives reconnects.
• Moderation history — bans, kicks and warnings issued on a project, including the author, reason, and (for bans) expiry.
• Gameplay logs — structured events emitted by the gamemode or addons (money transactions, item pickups, deaths…) that creators can audit through the panel.

Emrald lets creators install third-party addons published on sbox.game. Addons may store their own data (chat history, custom inventories, mini-game state, etc.) through our generic key-value storage SDK.

Addon-collected data is the responsibility of the addon's author and the creator who installed it — not Emrald. We do not control what shape the data takes, what it represents, or how long it's kept by the addon. If you have privacy concerns about a specific addon, contact that addon's author or the creator of the server you're playing on.

We physically store the rows on the same Postgres database as the rest of the player data, and they are deleted at the same time (project deletion, account erasure request, etc.) — but we do not interpret or expose their content.

We process the data above on the following legal bases:

• Contract performance — to provide the Emrald service you signed up for (panel access, project management, persistent player profiles).
• Legitimate interest — to enforce server moderation, detect abuse, and audit changes to projects.

We do not use your data for advertising, profiling or automated decision-making, and we never sell it to third parties.

• Sessions — until you sign out, or 30 days of inactivity, whichever comes first.
• Panel account & projects — for as long as your account is active, or until you delete your project / request account deletion.
• Active player profiles — for as long as the project that hosts them exists. Project deletion wipes the player's active state on the game backend (current money, inventory, kills, appearance, etc.).
• Archived community stats — when a project is deleted, players who have a panel account (i.e. who signed in on emrald.xyz at least once) keep a frozen historical snapshot of their participation: project name and logo, their group at the time, money totals, playtime, and first / last seen dates. This powers the "Communities you played" section of the player dashboard so users still see the servers they invested time in. The snapshot contains no new data — only what was visible on the player's dashboard while the project was live, frozen at deletion time. It's kept for the lifetime of the panel account.
• Addon-collected data — as long as the project exists, deleted along with the project. Individual addons may delete their own data earlier at their author's discretion.
• Moderation history — 2 years from issuance for warnings and kicks, indefinite for active bans (lifted manually by a creator or expiring at the date set by the creator).
• Gameplay logs — 90 days, automatically purged by a background job.

We use a small number of sub-processors to run the service:

• Railway Corp. (United States) — hosts the panel, APIs and Postgres databases.
• Cloudflare, Inc. (United States) — stores small media files (project logos) via R2 object storage.
• Valve Corporation (United States) — authenticates sign-in via Steam OpenID.

US-based processors handle data under their respective privacy frameworks (Data Privacy Framework for EU↔US transfers, plus their internal Data Processing Agreements).

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or outdated data.
• Erasure— request deletion of your account and all associated data, including archived community stats ("right to be forgotten"). You can delete your own projects from the panel at any time, but there is currently no self-service "delete my account" button in the UI — for full account erasure, contact us by email and we'll process the request manually within one month.
• Restriction — ask us to limit how we use your data while a dispute is being resolved.
• Portability — request a machine-readable export of your data.
• Objection — object to specific processing based on legitimate interest.

To exercise any of these rights, email us at [email protected]. We respond within one month. You also have the right to lodge a complaint with the French data-protection authority CNIL.

Emrald uses a single, strictly-necessary HTTP-only cookie that stores your panel session token. No analytics cookies, no advertising cookies, no third-party trackers are set by us.

Steam-issued tokens are exchanged over HTTPS only and never persisted. Session cookies are HTTP-only, Secure and SameSite-Lax. Server boot tokens are stored as argon2id hashes on the panel side. Game-backend JWTs are signed with HS256 using a secret kept off the panel's public surface.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be announced through our Discord server.

Questions about this Privacy Policy can be directed to [email protected].