How we handle your data.

Player files

One file per character, stored on the server. It holds your character name, a hash of your password (never the password itself), and the gameplay state the MUD needs to remember between sessions: score, inventory, location, clan ties, and so on. Standard MUD storage; nothing exotic.

Connection logs

When you connect to the game, the server logs your IP address. This is what powers the ban list (the only way to keep harassers, exploiters, and the occasional malicious script out of a public service like this). Logs rotate periodically; we don't keep them forever.

In-game activity logs

The MUD logs commands and channel traffic by default; this is how SMAUG-family servers have always worked. What's in those logs: the commands you type, the contents of chat / ooc / ask / anime / newbiechat, what you say in a room, and tells (private messages between players). The logs live on the same server as the game; nothing leaves it. We use them to investigate bugs, enforce the ban list, and occasionally look at patterns of play. If you wouldn't want something logged, don't send it on a public channel.

Discord server activity

Messages in the official NarutoMUD Discord server are visible to the staff team and to Discord itself by design. The MUD's Discord bot keeps its own copy of channel activity for the same operational reasons. Same boundary as the in-game logs: stays with us, not shared elsewhere.

On this marketing site

Apache logs the usual web access fields (IP, path, timestamp, user agent) for the same operational reasons every web server does. Nothing else.

The day-to-day use is operational: investigate crashes, enforce the ban list, figure out why a particular area is misbehaving, respond to bug reports. Standard MUD-staff stuff.

We may also analyze the logs in aggregate or per-character to understand how the game is actually being played. Things like which jutsu people lean on, which areas get the most traffic, what time of day feels alive, where new players get stuck on their first session. These analyses inform the changelog and the dev-team's priorities. They stay with the team; we don't sell, share, or feed any of it to a third party.

• No email. Character creation only asks for a name and password. We have no email address on file for you unless you sent one to staff yourself.
• One analytics tool, and it's a polite one. We use GoatCounter — cookieless, no fingerprinting, no tracking across sessions. It logs that a page was viewed and roughly where the request came from (country, referrer URL). No Google Analytics, no Facebook Pixel, no ad networks, no behavioral profiling. (You can view-source and check.)
• No cookies on this site. The Express app that serves these pages doesn't set any, and GoatCounter is cookieless by design.
• No PII beyond the character account. No real name, no birthday, no phone number, no payment info. We don't take money for the game.
• No ads, no ad networks, no behavioral profiles.

Character data is kept indefinitely. The MUD has been running since 2004 and some players still log in to characters they made twenty years ago; deleting old player files would erase that history. If your character has been dormant for years and you'd rather it didn't exist anymore, you can delete it yourself (see “your rights” below) or ask staff to do it.

Connection logs and web access logs rotate on a normal sysadmin schedule (typically a few weeks to a few months, long enough to investigate an incident, not so long that they pile up indefinitely).

We don't sell player data. We don't share it with advertisers, marketers, data brokers, or other game operators. The single analytics tool we use (GoatCounter, described above) only sees website pageviews — never anything from inside the MUD itself. The game runs on a single DigitalOcean droplet that the staff team rents; nothing leaves it except for the bits the MUD sends to your client while you're playing.

We do link out to a few places (Discord, a Printify-hosted merch shop, MUD listing sites you can vote on). Following those links sends you to those services, which have their own privacy policies; we don't hand over anything about you when you go.

If law enforcement showed up with a valid legal order, we would comply with what the order actually requires and nothing more. This has never happened. It probably never will. We're a fan project about ninjas.

• Delete your character yourself. Log in and type delete at the in-game prompt. The character file and the associated state are removed.
• Ask staff to remove your data outright. If you'd rather have us handle it, or you want belt-and-suspenders confirmation it's gone, reach out through the contact page . Tell us the character name and we'll take care of it.
• Ask what we have. If you want to know exactly what's in your player file, ask. We'll dump it for you.

The MUD is a general-audience text RPG. We don't require an email address, a real name, a birthday, or any other identifier we could use to figure out a player's age, so there's nothing for us to age-gate against. If a parent wants a child's character removed, contact us and we'll remove it without ceremony.

If we make a meaningful change (collecting something new, changing how long we retain something, adding a third party), we'll flag it on Discord before it takes effect so people have a chance to notice. The small edits (a clearer sentence, a fixed typo) just happen, but the “last updated” date will always tell you when the page last moved.