Privacy policy

Effective 25 October 2026

This policy explains what data the game “Zorya: World in the Mist” (Polish version: “Zorya: Świat we mgle”), available at https://zorya.quest, collects, why, who processes it on our behalf and how you can delete it. This is a translation of the Polish version; if they differ, the Polish version prevails.

1. Data controller

The data controller is Tomasz Watras, trading as Houda Tomasz Watras, ul. Żelazna 2, 40-851 Katowice, Poland, tax ID (NIP) 6292324622, REGON 521571765. For any privacy matter, write to hallo@zorya.quest.

2. What we collect

Strava profile. When you sign in with Strava we receive your athlete ID, first name, last name and profile picture URL, plus the tokens the game uses to fetch your activities. We never receive your password or e-mail address. You can change your name in your player profile; the change applies only to the game.
Strava activities recorded since you joined the game: ID, name, date, distance, moving time and the simplified route (summary polyline). The activity:read_all scope also covers activities you set to “Only You” on Strava. Activities without a route (e.g. indoor) are ignored.
Device location, if you allow it in your browser. The point where you start the game is saved to your account (the revealed map starts there). Your live position is only used to preview the fog around you: it is processed in your browser and never sent to our server.
Game state: revealed area, collected crystals and points.
Knight’s card: your arms, epithet and the form of your rank title (masculine or feminine in Polish), if you choose them. The form is only used to inflect the rank name.
Support (Keepers of the Fire), if you support the game: your Stripe customer ID, plan, support dates, the name you enter for the Gallery of keepers and your consent to show it. Your e-mail, card or BLIK details and billing address go directly to Stripe; we never see card details.
Reports and messages, if you send them with the Report a bug or get in touch form or by e-mail to hallo@zorya.quest: the text, the type of report, a reply e-mail address and a screenshot if you add them. The form also attaches your game account, the game version, a general description of your device (operating system, browser, screen size, language), the page you write from and the error mark. It does not store your full IP address or full browser identifier.
Technical data: a session cookie (section 9) and server logs kept by our hosting provider (IP address, time and URL of the request, browser type).
Visit statistics (Vercel Web Analytics): which pages of the game are viewed, where the visitor came from (referring page, utm parameters), country, device type, operating system and browser. They work without cookies or browser storage. A visitor is recognised only by a hash of the request that is discarded after 24 hours, so the statistics cannot tell who you are or be linked to your game account.
Error reports (Sentry): when something breaks in the game, the browser or server sends a description of the error: the message, the place in the code, the game version, the page without URL parameters, a general description of the browser and system, and the last few steps before the error (e.g. moving between pages). A report contains no game account, IP address, cookies or routes.

3. Purposes and legal basis

Running your account and the game: revealing the map from your activities, counting points, saving progress (Art. 6(1)(b) GDPR, performance of the contract you enter into by accepting the terms).
Handling support and payments: performance of the support agreement (Art. 6(1)(b) GDPR) and tax and accounting law (Art. 6(1)(c) GDPR).
Device location: your consent given in the browser (Art. 6(1)(a) GDPR). You can withdraw it in your browser settings.
Security and debugging based on logs: our legitimate interest (Art. 6(1)(f) GDPR).
Visit statistics, to learn which parts of the game are used: our legitimate interest (Art. 6(1)(f) GDPR).
Error reports, to fix the game before anyone has to report a fault: our legitimate interest (Art. 6(1)(f) GDPR).
Answering reports and messages and fixing reported bugs: our legitimate interest (Art. 6(1)(f) GDPR).

4. Who can see your data

Your Strava data, meaning your profile, activities and routes, is shown in the game only to you. We do not show it to other players or publish it.

The one exception is the Roll of Knights, a leaderboard you join only yourself, with the “Join the Roll” button (consent, Art. 6(1)(a) GDPR). Other signed-in players then see your first name and last initial, arms, epithet, rank and game scores: points, number of crystals, land cleared in km² and the share of the GZM Metropolis, all time and this week. They do not see your routes, activities, starting point or profile photo. You can leave the Roll at any time, and others stop seeing you there straight away.

Likewise the Gallery of keepers: if you support the game and tick the consent box (Art. 6(1)(a) GDPR), other signed-in players on the Keepers of the Fire page see the name you enter, your arms, epithet and the month you started supporting. You can untick it at any time.

We do not sell data, show ads, combine your data with data from other sources, or use it to train or power artificial intelligence systems.

5. Processors

Supabase – game database, servers in Frankfurt (EU).
Vercel Inc. (USA) – application hosting and visit statistics. Transfers to the USA rely on the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework.
OpenFreeMap – map tiles. Your browser downloads them directly, so OpenFreeMap servers see your IP address and the part of the map you view, but not who you are in the game.
Stripe Payments Europe Ltd. (Ireland) – payments for support, only if you support the game. Stripe may transfer data to the USA under Standard Contractual Clauses and the EU-US Data Privacy Framework, and also keeps payment data as an independent controller under its privacy policy.
Functional Software, Inc. (Sentry) (USA) – error reports, stored in the EU (Frankfurt). Any transfer to the USA relies on the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework.
Resend (USA) – the game’s e-mail: receives messages sent to hallo@zorya.quest and delivers reports from the form to the game’s maker. Transfers to the USA rely on the European Commission’s Standard Contractual Clauses.
Google Ireland Ltd. – the Gmail mailbox where the game’s maker reads and answers reports and messages. Google may transfer data to the USA under Standard Contractual Clauses and the EU-US Data Privacy Framework.

6. Strava

We fetch your Strava data through the Strava API with the consent you give when signing in. Your use of Strava is governed by Strava’s own terms and privacy policy, which this policy does not modify. Strava may collect data about how the game uses its API and use it in accordance with its privacy policy. We do not send Strava any of your data other than the token needed for API requests. This game is not developed, sponsored or endorsed by Strava.

7. Retention

We keep your data as long as you have a game account. An activity you edit or delete on Strava is updated or removed in the game at the next activity sync, which happens whenever you open the game. When you delete your account, your data is erased from the database immediately and your Stripe customer profile is deleted. Records of the payments themselves are kept for the period required by tax law (5 years from the end of the year). It may remain in our database provider’s backups for up to 30 days, and server logs expire after a few days.

Reports from the form are kept in the database for up to 12 months and attached screenshots for 90 days. Deleting your account deletes them at once. E-mails and report notifications in the game maker’s mailbox are deleted once the matter is settled, at the latest after 12 months.

8. Deleting your data and disconnecting Strava

In the game: open your player profile (tap your name) and choose Delete account (Usuń konto). The game immediately erases all your data and revokes its access to your Strava account. Your activities on Strava are not affected.
On Strava: you can revoke the game’s access at any time in Strava settings (My Apps). The game then stops fetching your data. Whatever remains in the game can be deleted with the in-game button or by e-mail.
By e-mail: write to hallo@zorya.quest asking us to delete your data. We will delete it within 48 hours and confirm by e-mail.

9. Cookies and browser storage

sesja – keeps you signed in, valid for one year or until you sign out. It contains only a random session ID.
strava_state – protects the Strava sign-in against forgery, valid for 10 minutes.
Browser storage holds only the map zoom level.

We do not use analytics or advertising cookies. Visit statistics (section 2) work without cookies.

10. Security

All connections are encrypted (HTTPS). Strava tokens are kept only on the server, never in the browser. The database is not publicly accessible and the game server connects to it with a secret. In the event of a data breach we will notify you and the Polish supervisory authority as required by the GDPR and, where Strava data is involved, Strava as well.

11. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent at any time (without affecting earlier processing). Write to hallo@zorya.quest. You can also lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

12. Age

The game is intended for people aged 16 or older.

13. Changes

We will announce material changes in the game. The current version is always on this page. See also the terms of use.