Last updated 2026-10-18
Privacy policy
STFU Requiem is a free fan game run by one person. It stores only what the game needs to work. Nothing is sold, and there are no ads or third-party trackers on this site.
Who is responsible
The data controller is Samuel Dovi, who runs STFU Requiem. For anything about your data, write through the contact form or ask on the Discord server.
What we store
- Your account. If you sign in with Discord: your Discord user ID, display name and avatar, as Discord shares them when you allow it (we never see your Discord password or email). If you make a website account: your username and a salted hash of your password (never the password itself).
- Your game save. Your stands, items, progress, currencies, titles, profile customization and fight history. The save is shared with the STFU Requiem Discord bot, so the same game works in both places.
- What you write. Chat messages (global, gang, raid and private), gang names and mottos, your profile text, and reports you send. Private messages are visible to the two players in them and, when a message is reported, to the admins.
- Notifications. If you turn on push notifications, your browser's push subscription (an address your browser gives us to deliver them). Turning them off deletes it.
- A salted hash of your IP address. Used only to spot one person running many accounts and to slow down login attacks. We never keep the address itself; the anti-cheat hash expires after 90 days, the login counters after a few minutes.
- Messages you send us. The contact and bug report form keeps your message, the email you give (only if you give one), the page it's about and your browser's name, to answer you and fix the problem. Only admins read them; the most recent thousand are kept, and admins delete them once handled.
- Error logs. When a page breaks, we keep the page address and your player ID with the error so it can be fixed. Logs roll over after a few thousand lines.
Why we may use it (legal bases)
- To run the game you signed up for (performance of a contract): your account, your save, what you write, fights and trades.
- To keep the game fair and safe (legitimate interest): the hashed addresses against multi-accounting and login attacks, error logs, reports and the admin log.
- Because you said yes (consent): push notifications and the guest save's cookie. You can take it back at any time by turning notifications off or deleting the cookie.
Cookies
One session cookie keeps you signed in (it lasts 30 days), one remembers the language you picked (a year), and one more remembers this device's push subscription if you turned notifications on. If you play as a guest, one more cookie (it lasts about a year, renewed on each visit) holds the random key to your guest save: deleting it loses the save, unless you saved it with a username. A few display preferences (the collapsed sidebar, filters, the tour) are kept in your browser's local storage and never sent to us. There are no analytics or advertising cookies.
Who sees it
Other players see what the game shows publicly: your name, avatar, profile, stands, gang and ladder records. Admins can see saves to fix problems, handle reports and stop cheating; every admin action is logged. The site and the bot run on a private server; Discord handles sign-in with Discord and delivers the bot's messages; your browser's own push service delivers notifications. Nobody else receives your data, and none of it is sold.
Some news posts hold a YouTube video. Nothing is loaded from YouTube until you click play; then it plays from youtube-nocookie.com, YouTube's privacy-enhanced mode, under Google's privacy policy.
Discord is based in the United States: if you sign in with Discord, Discord processes that sign-in under its own privacy policy. Signing up with a username and password instead keeps Discord out of it.
How it's protected
Every page is served over HTTPS. Passwords are stored only as salted hashes, network addresses only as salted hashes. Logins and sign-ups are rate-limited and locked after repeated failures. Admin access is limited and logged, and backups are kept for 14 days.
How long we keep it
Your save and account stay until you ask for them to be deleted. Daily backups of the game database are kept for 14 days, so deleted data disappears from them within two weeks. Chat keeps only the most recent few hundred messages per channel.
Your rights
Under the GDPR (RGPD) you can, at any time and for free:
- Get a copy of your data (access and portability): Account → Your data → Download my data gives you everything we hold about you as one file.
- Delete your account (erasure): Account → Your data → Delete my account removes your save, your login, your messages, friendships, listings and every other piece of data tied to you, right away and with no copy kept. You can also ask an admin on the Discord server or write to us; an admin deletion keeps a copy of the save for 30 days in case it was a mistake.
- Correct it (rectification): rename yourself on the account page, edit your profile, or ask us.
- Object or ask us to limit how we use it, and take back a consent you gave: write to us.
We answer within a month. If you think we got it wrong, you can complain to your data protection authority; in France, the CNIL.
Children
The game is meant for players aged 13 and over, the same as Discord. If you're under the age where your country requires a parent's consent (15 in France), please get it before playing.
Questions
Ask on the Discord server or write to us. If this policy changes, the date at the top changes too, and big changes are announced in the news.