Privacy Policy

Last updated: 1 September 2026

This Privacy Policy explains what data this Restaurant City Reborn server (the "Service"), operated by the Restaurant City Reborn project ("we", "us", "our"), collects, why we collect it, and the choices you have.

1. What we collect

Account information

• Username, first name, and last name.
• Your PIN — stored only as a salted scrypt hash, so we cannot read or recover it.
• If you connect Discord: your Discord user ID, username, display name, avatar identifier, email address, link date, and notification preference. Discord-only profiles do not have a usable PIN until you set one.

Gameplay data

• Your profile and progress: owned items and restaurant layout, inventory, ingredients, garden, floors, employees, mail, friends, rankings, notifications, game events, stored images, and cash transactions. This is what lets us save and restore your game.

Session and security data

• A session cookie (rc_session) and the SHA-256 hash of your session token, plus CSRF tokens used to protect state-changing requests.
• Your IP address and user agent, collected when you use the Service.

Operational logs

• Request records (method, path, status) held in a bounded in-memory buffer (500 entries by default) and a local log file. These power the operator dashboard and are used for debugging and abuse detection.

2. How we use your data

• To authenticate you and keep you signed in;
• to link your Discord and game identities, add you to the community server with your permission, and send enabled mail, employee-energy, and garden-state notifications;
• to save, restore, and display your gameplay;
• to provide support and respond to your requests;
• to prevent abuse, detect fraud, and keep the Service secure;
• to operate, monitor, and improve the Service.

3. Legal bases

We process your data to perform our contract with you (these Terms), to pursue our legitimate interests in running a secure and reliable service, and, where required by applicable law, on the basis of your consent.

4. Sharing

We do not sell your personal data. We share it only:

• with service providers who host or operate components of the Service, only as necessary to run it;
• with Discord when you choose Discord sign-in, account linking, server joining, or bot notifications;
• when required by law, regulation, or legal process;
• to protect the rights, property, or safety of the Service, our users, or others;
• in connection with a transfer of ownership of the Service.

5. Cookies

We use the essential session cookie rc_session. During Discord sign-in we also use short-lived, HttpOnly rc_discord_oauth and rc_discord_ticket cookies for OAuth security and first-login completion. They are not used for advertising or tracking. See the Cookie Policy for details.

6. Retention

• Session cookie: expires after 30 days or when you log out.
• Session records: expire after 30 days.
• Discord OAuth state expires after 10 minutes and an unfinished first-login ticket expires after 15 minutes. Linked Discord identity data remains until it is unlinked or the account is deleted.
• Request-log buffer: capped (500 entries by default); older entries are discarded.
• Account and gameplay data: kept while your account is active, and for up to 30 days after you request deletion, unless a longer period is required by law or needed to resolve disputes or abuse.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to receive a copy of it. To exercise these rights, contact us through the Service (in-game mail or your account). We will respond within 30 days. You may also request that your account and its data be deleted.

8. Children

The Service is not directed at children under 13, and you must be at least 13 years old to create an account. If you believe a child under 13 has created an account, contact us and we will delete it.

9. Security

We use security measures appropriate to a small self-hosted service: PINs are hashed with scrypt and salted, session cookies are HttpOnly and SameSite, session tokens are stored as SHA-256 hashes, and state-changing requests require CSRF tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

Your data is stored on the server(s) operated by us. Where we use hosting providers, data may be transferred only as needed to run the Service and under appropriate safeguards.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page with its date. Material changes will be announced through the Service where practical.

12. Contact

To exercise your rights or ask a privacy question, contact us through the Service (in-game mail or your account), or ask the server administrator through the dashboard.