Last updated: 12 April 2026 Effective date: 12 April 2026
Dwarven Stronghold Limited ("we", "us") is the data controller for personal data processed in connection with Shadow Walkers. This Privacy Policy explains what personal data we collect, why, how long we keep it, who we share it with and what rights you have.
This Privacy Policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR, Regulation 2016/679), and the Privacy and Electronic Communications Regulations (PECR).
We do not currently have a statutory Data Protection Officer because we are not required to appoint one under Article 37 UK GDPR, but privacy questions are handled by the privacy contact above.
We only collect what we need to run the Game, keep it safe and comply with our legal obligations. The table below lists every category of personal data we process.
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, chosen display name, hashed password, account creation timestamp, preferred language, country of residence | You, at registration |
| Authentication data | Login timestamps, device fingerprint (coarse), IP address | Automatic at login |
| Gameplay data | Character name, faction, level, inventory, progression, quest state, playtime, coordinates in the world | Automatic during play |
| Communication data | Public and private chat messages, guild messages, reports submitted against you or by you | You / reporters |
| Creative content | Thari Music Tool compositions, screenshots you save server-side | You |
| NPC AI dialogue data | The text you type to a small number of named LLM-backed NPCs (Stara Pierwsza, Bezimienny, Późny Walker) and the model's reply | You, when you talk to these NPCs |
| Support data | Emails you send us, bug reports, crash reports, attached logs | You |
| Payment data | The fact that you made a purchase, the SKU, the amount, the invoice number, the Paddle transaction ID, the last four digits of your card (displayed only) | Paddle |
| Cookies and similar technologies | Session cookie, preferences cookie, (with consent) analytics identifier | Your browser |
We do not collect:
| Purpose | Data used | Legal basis (Art. 6 UK GDPR) |
|---|---|---|
| Create and maintain your account | Account data, authentication data | Performance of contract (6(1)(b)) |
| Operate the Game and save your progress | Gameplay data, creative content | Performance of contract |
| Provide in-game chat and guilds | Communication data | Performance of contract |
| Moderate harassment, fraud and abuse | Communication data, reports, IP address | Legitimate interests (6(1)(f)) — keeping the service safe |
| Generate NPC dialogue via Anthropic API | Text you type to the three named LLM NPCs | Performance of contract, with your consent at the point of entering the dialogue |
| Process payments and issue invoices | Payment data | Performance of contract; legal obligation (tax and accounting, 6(1)(c)) |
| Customer support | Support data, account data | Performance of contract |
| Email you about essential service issues (downtime, security, material policy changes) | Email address | Legitimate interests; legal obligation where required |
| Send optional marketing emails (devlog digest, launch announcements, sales) | Email address | Consent (6(1)(a)) — you may withdraw at any time |
| Analytics and service improvement | Coarse usage statistics | Consent via cookie banner; otherwise not collected |
| Prevent and investigate security incidents | Authentication data, IP address, access logs | Legitimate interests |
| Comply with law enforcement requests | Any relevant data | Legal obligation |
The Shadow Walkers website and game client set a small number of cookies and similar storage items. A cookie consent banner is shown the first time you visit and any time our cookie inventory changes materially.
You can withdraw cookie consent at any time by clicking "Cookie settings" in the footer of shadow-walkers.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
Three specific NPCs in Shadow Walkers use a large language model ("LLM") to generate dialogue:
When you type a message to one of these NPCs:
The first time you enter a conversation with one of these NPCs, you will see an in-game notice explaining this and asking you to confirm. If you decline, the NPC will switch to a scripted fallback dialogue and no data will be sent to Anthropic. All other NPCs in the Game (9+) run on locally hosted models and do not transfer data outside our own infrastructure.
We share personal data only with processors who help us run the Game under a written data-processing agreement. We do not sell personal data and we do not share it with advertisers.
| Recipient | Role | Location | What they receive |
|---|---|---|---|
| Paddle.com Market Limited | Payment processor, Merchant of Record | United Kingdom | Name, email, billing country, card data (Paddle only), purchase details |
| Hetzner Online GmbH | Server hosting | Germany (EU) | All data stored on our servers (at rest and in memory) |
| Anthropic PBC | LLM API for three named NPCs | United States | Your dialogue messages to those NPCs only (see Section 5) |
| Nume (nume.pl) — email hosting | Outbound transactional email (account, billing, support) and opt-in marketing email, via a Stalwart JMAP server | Poland (European Union) | Your email address and the content of messages we send you |
If we ever need to add a processor, we will update this list before doing so.
We may also disclose personal data:
Personal data is stored in the European Union (Germany) and, for the specific purposes described above, transferred to the United Kingdom (Paddle) and the United States (Anthropic). All transfers outside the UK and EEA are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses as supplementary measures, and we review the transfer-impact assessment every 12 months.
You can request a copy of the safeguards that apply to any specific transfer by writing to [email protected].
| Category | Retention | Reason |
|---|---|---|
| Account data | For the life of your account, plus 30 days after closure | Recovery window in case you asked to close the account by mistake |
| Gameplay data (character, inventory, progression) | For the life of your account, plus 30 days after closure | Same |
| Chat messages — public / party / guild | 90 days | Moderation and safety review |
| Chat messages — direct / whisper | 30 days | Moderation and safety review |
| Reports of harassment and their evidence | 2 years from closure of the report | Protection of other players |
| NPC AI dialogue logs | 90 days | Safety review |
| Payment records and invoices | 7 years | UK HMRC tax and accounting obligation |
| Security and access logs | 12 months | Incident investigation |
| Support tickets | 2 years from resolution | Customer service history |
| Marketing email list | Until you unsubscribe | Consent |
When a retention period ends, data is either deleted, anonymised beyond recovery, or archived in encrypted cold storage that is deleted on schedule.
Under the UK GDPR and the EU GDPR you have the right to:
To exercise any of these rights, write to [email protected]. We will verify your identity and respond within 30 days, extendable by a further 60 days for complex requests (we will tell you if we extend).
No system is perfectly secure. If you believe you have found a security vulnerability in Shadow Walkers, please contact [email protected] before disclosing it publicly; we follow a good-faith disclosure policy and will not take legal action against responsible researchers.
Shadow Walkers is not directed at children under 13 and we do not knowingly collect personal data from them. In certain countries (for example, several EU member states) the minimum age for consent to online services is 16, and we apply that higher age for users in those countries.
If you believe a child has created an account, contact [email protected] and we will investigate and delete the account and associated personal data as appropriate.
We may update this Privacy Policy from time to time. If we make a material change — for example, adding a new processor, changing retention periods, or adding a new processing purpose — we will:
Historical versions of this Privacy Policy are kept in our public changelog on shadow-walkers.com/legal/changelog.
If you are not satisfied with how we handle your personal data, you can complain to the UK supervisory authority:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom Website: https://ico.org.uk — Helpline: +44 (0)303 123 1113
EEA residents may also complain to their national data protection authority.