Privacy Policy
Last updated 29 October 2026
Cosmonym is a game about naming worlds. We collect as little as we can, we never sell your data, and there are no ads or tracking.
In short: browsing and growing worlds needs no account and stores nothing about you.
If you create an account, we keep your explorer name, your email (encrypted), and the worlds you claim.
You can delete your account at any time.
What we collect
| Data | When | Why |
|---|---|---|
| Explorer name | You create an account | Shown publicly on your profile and the worlds you discover |
| Email address | You sign up, or sign in with Google, Microsoft or Discord | Signing in, confirming your address, password resets. Stored encrypted. |
| Password | You choose one | Signing in. We store only a one-way hash, never the password itself. |
| Sign-in provider ID | You sign in with Google, Microsoft or Discord | Recognising you next time. We don’t receive your password or contacts. |
| Worlds, messages and stars | You claim, write or star | The game itself. Worlds, their messages and star counts are public. |
| Reports | You report a world | Moderation |
| Hashed IP address | Every request | Rate limits and abuse prevention. IPs are turned into a keyed hash; we don’t keep raw IP addresses. |
| Session cookie | You sign in | Keeping you signed in. It’s the only cookie we set. |
Some settings (like sound on/off) are saved in your own browser’s storage and never sent to us.
What we don’t do
- No advertising, analytics or tracking cookies, and no tracking pixels.
- We never sell or rent your data.
- We don’t read your email, contacts or anything else from the sign-in providers beyond your name, email and account ID.
Services we use
- Cloudflare protects and delivers the site, and sees your IP address as part of every request.
- Google, Microsoft or Discord, only if you choose to sign in with one of them. Their own privacy policies apply to that step.
- Microsoft 365 sends our emails (confirmations and password resets).
- Google Fonts serves the site’s typefaces, so your browser contacts Google when loading the page.
- Have I Been Pwned checks new passwords against known breaches. Only the first five characters of a one-way hash are sent; your password never leaves our server.
How we protect it
- All traffic is encrypted (HTTPS, TLS 1.2 or newer).
- Emails and two-factor secrets are encrypted at rest; passwords are hashed with scrypt.
- The app runs isolated from the rest of our network, with access to the database limited to what it needs.
- Administrator access requires a password and an authenticator app, and every admin action is logged.
How long we keep it
- Account data stays until you delete your account.
- Session records expire after 30 days of inactivity; email links expire within 24 hours.
- Rate-limit counters are kept in memory for at most a day.
Your choices and rights
- Delete your account any time from Account in the menu. Your login details are erased immediately; worlds you discovered stay in the galaxy but are no longer linked to you.
- Change your explorer name from the same page.
- To get a copy of your data, correct it, or ask any question, email [email protected]. Depending on where you live (for example the EU, UK or California), you may have further rights, and you can complain to your data protection authority.
Children
Cosmonym isn’t intended for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, contact us and we’ll remove it.
Changes
If this policy changes in a meaningful way, we’ll update the date at the top and, for significant changes, let signed-in explorers know.