Mirasia

Privacy

Last updated: 23 September 2026

This notice explains what the game Mirasia and the website playmirasia.com collect about you, why, where it is stored, how long we keep it, and how you can have it deleted. We show no ads, we sell no data, and this website uses no tracking cookies and no analytics.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Alexander Hafner
Email: playmirasia@gmail.com

Write to this address with any privacy question or request.

The short version

What we collect and why

Your online account and cloud save

When the game goes online it creates an account for you: a random account id, a restore code (we store only a hash of it, never the code itself), your save file (progress, unlocks and settings) with its five previous versions, the display name you choose, and when the account was created and last updated.

Why
To keep your progress safe and let you restore it on another computer.
Legal basis
Our contract with you (GDPR Art. 6(1)(b)).
Kept
Until you erase it. Accounts that never got a name and never finished a run are deleted automatically after 30 days without use.

Steam login

When you start the game through Steam, it logs in with a Steam ticket. Steam confirms your SteamID64 to us, and the game sends your Steam persona name. The persona name becomes your display name unless you picked your own. We store the SteamID64 with your account, together with when the link was made and when you last logged in.

Why
So your progress follows your Steam account to any computer.
Legal basis
Our contract with you (GDPR Art. 6(1)(b)).
Kept
Until you erase your online data.

Run data for balancing

While gameplay data sharing is on (Settings > Game), the game sends a summary of each run when it ends (for example your relic, cards, stamps, difficulty, game mode, seed, outcome and game version) and a detailed log of what happened in that run. Both are linked to your account id, your display name and a random install id that identifies this installation of the game.

Why
To find bugs and to balance the game.
Legal basis
Our legitimate interest in improving the game (GDPR Art. 6(1)(f)). You can object at any time by switching the setting off; runs that were not sent yet are then deleted from your computer.
Kept
As long as we use it to balance the game, and never after you erase your online data.

Daily challenge leaderboard

When you finish a daily challenge, the game submits your result: display name, relic, how far you got, remaining HP, run time, whether you won, your stamps and the date. The board is visible to every player. Next to your name it can show a short tag made from a one-way hash of your account id, so players with the same name can be told apart. We also store your account id with the entry and whether your account is linked to Steam.

Why
To run the leaderboard and keep it free of cheated entries.
Legal basis
Our contract with you (GDPR Art. 6(1)(b)).
Kept
Until you erase your online data.

Ranked multiplayer

For ranked matches we store your account id, display name, rating, wins and losses, the result of each match, and fair-play records (rule breaks our match server detected, such as leaving a match or sending an impossible game state). To stop one internet connection from playing against itself, we store a keyed one-way hash of your IP address with the match, never the address itself. While a match runs, the match server sees your IP address. Your opponent sees your display name and rating.

Why
To match players and keep ratings fair.
Legal basis
Our contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in fair play (GDPR Art. 6(1)(f)).
Kept
Match results stay in the match history so every player's rating stays correct. When you erase your online data, your account is removed from them.

Friend duels

A friend duel connects the two games directly. The host's public IP address and port are stored with the lobby code so the guest can connect, and each player's game sees the other player's IP address. The game may ask your router to open a port for the duel (UPnP); it asks for at most one hour and removes the opening when you leave.

Why
To connect the two games.
Legal basis
Our contract with you (GDPR Art. 6(1)(b)).
Kept
The lobby entry stops working after 10 minutes. It is deleted when the host closes the duel, or at the latest the next time any player sets up or joins a duel.

Feedback

When you send feedback from the game, we store your message, its category, your display name, the game version, a little game context (the current screen, battle number, gold and HP), the current run id if there is one, a random install id, and a screenshot only if you tick "Attach screenshot".

Why
To read and fix what you report.
Legal basis
Our legitimate interest in fixing the game (GDPR Art. 6(1)(f)).
Kept
Until we no longer need it, and never after you erase your online data.

Security logs

To stop abuse, such as scripts creating thousands of accounts, our servers record the IP address of requests to online features in rate-limit logs. The general rate-limit log keeps only the network part of an IPv6 address (the first 64 bits); the log that limits how many new accounts one connection can create keeps the full address.

Why
To protect the online features for everyone.
Legal basis
Our legitimate interest in a secure service (GDPR Art. 6(1)(f)).
Kept
Deleted automatically, at the latest after 48 hours.

This website

playmirasia.com is hosted by Vercel. When you open it, Vercel processes your IP address and technical request data (browser, requested page, time) to deliver the page and protect it from attacks. The website sets no cookies, apart from a login cookie on our private staff page, and uses no analytics or tracking.

Why
To deliver and protect the website.
Legal basis
Our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)).
Kept
Only for the short time Vercel keeps its request logs.

Who processes data for us

Supabase, Fly.io and Vercel work only on our instructions under data processing agreements. Like any hosting provider, they keep short-lived technical request logs, which include IP addresses, to run and protect their service. They are US companies. Where data can be accessed from outside the EU, the transfer is covered by the EU Standard Contractual Clauses in those agreements.

Your rights

You have the right to access your data (GDPR Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on our legitimate interest (Art. 21). You can also complain to a data protection supervisory authority (Art. 77), for example the one where you live.

How to delete your online data

  1. In the game, open Settings > Save, press "Erase my online data" and press it again to confirm. This deletes the online account of the save slot you have open: its cloud save, its Steam link, its daily scores, its rating and fair-play records, and the run data and feedback linked to that account or to this installation. If you use more than one save slot, do this for each of them. Your local progress on your computer stays. If you keep playing, the game creates a new online save from the progress on your computer the next time it syncs (for example at the end of a run, or when you start it through Steam).
  2. Or email playmirasia@gmail.com with your display name. We may ask you to confirm that the account is yours before we delete anything.

Stored run logs and feedback screenshots are removed in a second step within 30 days. Ranked match results stay in the match history so your opponents' ratings remain correct, but your account is removed from them.

Children

If you are under 16, please ask a parent before you use the online features. If you believe a child has sent us data, contact us and we will delete it.

Changes to this notice

We update this notice when the game changes what it collects. The date at the top shows the current version.