1. Scope
Privacy contact: privacy@maralys.com. This Policy applies to the website, MARALYS ID, game servers, launcher, official mods and support. Production registration and non-essential collection remain disabled until the required procedures and infrastructure review are complete.
2. Data categories
Account data includes email, username, display name, date of birth and language; the password is stored only as an Argon2id hash. When an official mod signs in, the API receives the entered password over HTTPS only long enough to verify it and does not store it in plaintext. We also process IP, user-agent, sessions, security logs, game identifiers/progress/sanctions, MCOIN balance and wallet transaction history, support correspondence, consent evidence, order metadata and, if voluntarily linked, SteamID64 and public Steam fields. Pixel Battle data includes season ID, cell coordinates and colour, action time, linked MARALYS ID, username, canvas version, contribution statistics, change history and reports. Coordinates, colour, time and username are public on the canvas and in replay; a profile link appears only for a public profile. Authoring data includes article drafts and revisions, Markdown, linked-image URLs, categories, tags, moderation status, moderator feedback and action timestamps. MARALYS does not store full payment-card data.
3. Purposes and legal grounds
We process data to enter and perform the User Agreement, provide accounts and servers, prevent abuse, deliver support, meet legal obligations and pursue proportionate legitimate interests. Separate consent is used where legally required. Marketing uses separate optional consent.
4. Recipients
Access is role-limited. Russian hosting, email, anti-DDoS, technical and payment vendors may process data under contract and instruction. Authorities receive data only under a valid legal requirement. A current processor list is available on request.
5. Russian localisation and cross-border transfers
The primary recording, systematisation, accumulation, storage, update and retrieval of Russian citizens’ personal data use a database in Russia. Steam is a separate foreign service. Any cross-border transfer is enabled only after the Operator completes the applicable assessment and Roskomnadzor procedure. Steam linking is optional unless licence proof is required for a specific server.
6. Retention
Account data remains while the account is active, then is deleted or depersonalised unless law, accounting, security or legal claims require limited retention. Web sessions last up to 30 days, mod refresh sessions up to 90 days, and one-time codes no longer than their documented lifetime. Backups expire under a controlled rotation schedule.
7. Security
Controls include TLS, access separation, Argon2id, hashed tokens, refresh rotation, logs, backups, dependency updates and incident response. No system is absolutely secure; use a unique password and report suspicious activity immediately.
8. Your rights
You may request processing information and a copy, correction, blocking, deletion, withdrawal of consent and a review of the Operator’s actions. Use the account form or privacy email. Identity verification may be required. Withdrawal is prospective and does not stop processing based on another lawful ground.
9. Children, cookies and changes
MARALYS ID is designed for adults aged 18+. Essential cookies secure sessions and forms; optional categories require a choice. Material policy changes receive a new version and renewed consent where law requires it.