■ Legal
Privacy policy
What Thrall knows about you, what it never sees, and what it does with the rest.
Last updated 10 November 2026
The short version: we hold what is needed to run your Thrall account, and nothing about your game accounts.
What we never receive
Your game logins. Usernames, passwords and bank pins live in the vault, which is encrypted in your browser and stays there. It is not sent to us. See The vault.
What your clients do. Clients run on your device and connect to the game directly. Their traffic does not pass through Thrall.
What we hold
| What | Why |
|---|---|
| Email address | Sign-in, confirmation, password reset, security notices, plan notices |
| Display name | Shown to you in the console |
| Password hash (scrypt) | To check your password. The password itself is never stored |
| Two-factor secret, encrypted | If you turn two-factor on |
| Your plan and its history | To apply your plan’s limit |
| Sessions: IP address, country, browser, times | To keep you signed in and let you see and end your devices |
| Security log: sign-ins, failures, changes, with IP address and browser | To protect the account and show you its recent activity |
When payments open, card details will go to the payment processor and not to us. This page will be updated before that happens.
Cookies
Two, both necessary. No advertising or analytics cookies.
| Cookie | Holds | Lasts |
|---|---|---|
__Host-th_sid |
A random sign-in token | 30 days from last use |
th_name |
Your display name, so pages can greet you | 30 days |
Your browser’s storage also holds the vault and roster described in The vault. Those stay on your device.
Who else is involved
| Company | What they do for us |
|---|---|
| Cloudflare | Hosts the site and database, and runs the human check (Turnstile) on sign-up and password reset |
| Resend | Delivers the mail we send you |
We do not sell your data and do not share it with anyone else, unless the law compels it.
How long we keep it
- Your account: until you delete it.
- Ended sessions and the security log: up to 12 months.
- After you delete your account: your account, sessions and plan records are removed at once. Security log entries are kept with your details stripped.
Your choices
- See and change your details in your panel.
- Delete your account from the panel. It takes effect immediately.
- Ask for a copy of what we hold, or ask a question, at help@thrall.dev.
Depending on where you live you may have further rights over your data, including the right to complain to a data protection authority.
Security
Passwords are hashed with scrypt. Two-factor secrets are encrypted at rest. Sessions use random tokens of which we store only a hash. All traffic is encrypted in transit.
Changes
If this policy changes in a way that matters, we will mail you before it takes effect.