Privacy policy
This policy covers backmir.org, email and Google sign-in, and the player community. Updated October 15, 2026. Contact: u5196173364@gmail.com.
Data we collect
Guest characters and progress stay in your browser. With Google sign-in we verify and store your unique Google account identifier and verified email to identify your site account. Basic profile access may include your public name and picture; we do not store your Google picture or access Gmail, contacts or Drive. We store your chosen display name, posts, replies and images, plus reports, moderation records and login sessions. Automatic cloud uploads are enabled by default when signed in to the game, and can be disabled in Cloud saves. Manual uploads remain available. We privately store character progress, names, levels and save times under your account. Only the latest save is kept for cross-device loading. Replaced cloud saves are not retained; full saves are not public. Loading creates a local backup first. Contact the email above to request deletion. Signing out does not delete saves. Accounts with cloud saves join the leaderboard by default. Only character names, classes, levels, XP and update times are public; emails, Google identifiers and full saves stay private. You can leave at any time: entries are removed immediately and later uploads do not rejoin you. You can rejoin yourself. Review and report records are private to moderators. To understand acquisition, we keep the first identifiable source in this browser for up to 90 days: only a referring hostname or a restricted utm_source label. On registration we associate it with your site account and record the registration interface language. While you play signed in, we record your latest game language and the server receipt time. These account records do not contain full referring URLs, search terms or raw IP addresses. We do not send emails or account identifiers to Google Analytics. Uncollected historical fields remain unknown. Source and language records are for site administration and are covered by account data deletion requests. Email sign-in and linking use one-time codes delivered by Cloudflare to the address you provide. Codes expire after 10 minutes; we store only their digests, not plaintext codes. A linked email signs in to the same account and saves.
Purpose and service providers
We use data for sign-in, publishing your content, security and moderation. We do not sell account data or use Google account data for advertising or AI training. Google provides authentication; Cloudflare provides hosting, D1, private R2 image storage and image processing. Data may be processed outside your country. Posts, display names and published images are public; email addresses and Google identifiers are not displayed publicly.
Storage, cookies and retention
Essential HttpOnly session cookies last up to 30 days; you can sign out all devices. Google login challenges expire after 5 minutes; email codes expire after 10 minutes and scheduled cleanup removes expired records. Uploaded images become full-size and thumbnail WebP files with EXIF/XMP removed; originals are not stored. Unpublished images are cleaned up after about 24 hours. Images on deleted or hidden content immediately lose public access and are cleaned up after about 7 days. Accounts and posts remain until a deletion request is processed; the delete button first removes public visibility. Security and moderation records may be retained to resolve reports. Backups expire under Cloudflare retention schedules.
Your choices and contact
You can play without signing in, edit or remove your posts, sign out all devices and revoke access in your Google account settings. Contact the email above to request access, correction or permanent deletion of account data; we verify ownership before processing. Do not post emails, passwords or codes publicly. Clearing browser data can permanently remove local characters. This service is not directed at children under 13.
Analytics
The home page, guides and game use Google Analytics for visits and gameplay: character creation, game entry, level-ups, completed quests, map changes, deaths and foreground play time. We also measure video plays, equipment image opens, loading time and errors, first kills, learned skills and equipment changes. Fields include class, level, map and quest IDs, interface language and build version. We do not send character names, account identifiers, emails, chat or save contents. The site retains cumulative post view counts. Each page load reports once, without periodic reports, reading-time records, visitor identifiers or account links. Anonymous per-view retry records expire after 7 days; view totals remain. Public post pages also measure views, visitors and foreground reading time using cookies and browser visit data. Only post IDs, categories and page URLs without query parameters are sent, never titles, bodies, display names, account IDs or typed content. Language and reply-page variants of a post are grouped together. Collection starts after setup, without historical backfill. Visitors are browser-based estimates, not exact counts of people. The account page measures sign-in conversion. The game records backup prompt views, clicks, dismissals and the first successful cloud backup. Sign-in events contain only the start, failure stage, registration or login success, entry category and interface language, never emails, names, account IDs, credentials or typed content. Community lists, posting forms, moderation and privacy pages do not load analytics scripts. Google handles authentication requests under its privacy policy.