云端之城 隐私政策
生效日期：2026-10-27 版本：1.0
一、我们是谁、本政策管什么
《云端之城》（英文名 Nimbora: Kingdom of Murfania，以下称"本游戏"）由Dawn Productions（以下称"我们"）开发，通过 Steam 发行。本政策说明本游戏在你的电脑上以及在我们的服务器上处理哪些数据、为什么处理、保存多久，以及你可以怎么控制这些数据。
本政策只管本游戏和为本游戏服务的后端。Steam 由 Valve 运营，适用 Valve 自己的隐私政策。我们的官方网站 cloudcitygame.com 不使用 Cookie，也没有接入统计脚本；它只用浏览器本地存储记住你选择的显示语言。
隐私问题请联系：support@cloudcitygame.com
二、简要说明
- 你的存档、设置、本机账户都保存在你自己的电脑上。
- 只有唱 K 和联机语音会用到麦克风。唱 K 的声音只在本机用来打分，不会上传；只有你点"保存本次录音"，录音才会存到你的电脑上。联机语音只在联机房间里、直接传给同一房间的玩家，不经过我们的服务器，任何服务器都不保存。
- 本游戏里没有 AI 实时生成的内容，也不会把你的任何数据发给 AI 服务。
- 我们不卖数据，不投广告，不接第三方统计或广告 SDK。
- 游戏崩溃后，下次启动时会先问你要不要发送崩溃报告。只有你主动提交反馈，或者同意发送崩溃报告，相关内容才会发给我们。
- 联网功能（好友、私信、空间、队伍、送礼、官方邮件）需要一个"云城账号"。第一次联网前，游戏会先弹出一段联网说明，你同意后才会自动创建，不用填邮箱、手机号或真实姓名；不同意也可以照常单机游玩。我们保存你的昵称、好友关系和你发出的内容，用来提供这些功能、维护秩序和防作弊。私信保存 30 天，登录记录保存 90 天，你的 IP 地址只以加盐哈希的形式保存（第九节有完整的保存期限表）。
三、只保存在你电脑上的数据
下面这些数据都保存在本游戏的存档目录（游戏的 Saved 文件夹）里，我们看不到。
| 数据 | 用途 | 说明 |
|---|---|---|
| 本机账户：账户名、可选的密码、可选的安全问题答案 | 在同一台电脑上区分不同玩家 | 密码和安全问题答案只保存加盐哈希，不保存原文 |
| Steam 类本机账户 | 用你的 Steam 身份登录本机账户 | 游戏会在本机读取你的 Steam ID 和 Steam 昵称；账户文件夹以 Steam ID 命名 |
| 角色存档、农园、成就进度、剧情进度 | 玩游戏 | 存档带防篡改校验签名，签名只在本机核对 |
| 设置 | 画面、声音、操作等偏好 | 其中有一个随机生成的"安装编号"（不含任何个人信息），反馈和崩溃报告会用到它 |
| K 歌录音 | 你点"保存本次录音"后留作纪念 | 保存在对应本机账户的文件夹里，不会上传 |
| 引擎日志、崩溃文件 | 排查问题 | 由游戏引擎自动写入本机；只有你同意发送时才会上传（见第六节） |
| 云城账号的本机密钥、恢复码 | 下次自动登录云城账号；换电脑时找回账号 | 恢复码在你确认已经记下后会从本机删除。请不要把这两样发给任何人 |
|---|
删除游戏的 Saved 文件夹即可删除上面所有本机数据。卸载游戏不一定会删除这个文件夹。
四、麦克风（唱 K 与联机语音）
- 游戏只在两种时候打开麦克风：在歌舞坊开始唱 K 时；进了联机房间、而且联机语音没有关时。单机游玩时不开麦。
- 唱的过程中，声音只在本机用来分析音高和节奏、算出分数，不会上传，也不会发给其他玩家。
- 一曲唱完，只有你点了"保存本次录音"，游戏才会把录音（WAV 文件）保存到你电脑上的账户文件夹里。不点就不保存。
- 联机语音只在联机房间里有（例如饭店、桌游坊、歌坊之声的联机房间）。默认是「按住 Z 说话」，可以在 设置 › 声音 › 联机语音 改成关闭或开放麦；切出游戏窗口时自动静音。你的声音压缩后经游戏的联机连接发到房主（同房间的一位玩家）的电脑，再由房主转给房里其他人；不经过我们的服务器，我们的服务器和房主都不保存。默认只有队友和云城好友能听到你，陌生人默认静音，你拉黑的人的声音不会播放。静音名单、每人的音量和发声方式保存在你的电脑上。本游戏不做语音识别、声纹识别或情绪识别。
五、Steam 处理的数据
你通过 Steam 购买、启动和游玩本游戏。Valve 作为独立的数据控制者，按 Steam 隐私政策 处理你的 Steam 账号、购买记录、游戏时长等数据。本游戏会在你的电脑上调用 Steam 接口读取你的 Steam ID 和昵称（用于 Steam 类本机账户和联机）。
五之二、联机房间
- 联机房间通过 Steam 的联网服务建立。同一房间的其他玩家能看到你在游戏里的名字（Steam 昵称，或你的云城昵称）和你的角色。
- 房间聊天由房主的游戏转给房间里的其他人，房主的游戏会先过滤一遍。我们的服务器不保存房间聊天。
- Steam 不可用时，游戏可能改用直接连接，这时房间里的其他玩家在技术上能拿到你的 IP 地址。
- 联机语音怎样传、谁能听到，见第四节。
六、反馈与崩溃报告
6.1 你主动提交的反馈。 你在游戏里打开"反馈"并点击发送后，我们会收到：
- 你选的类别、你写的文字（最多 2000 字），以及你自愿留的联系方式（例如 Discord 名或邮箱）；
- 截图（游戏画面，不含界面）和游戏日志（最多 1 MB）：两项默认勾选，提交前你可以取消；
- 版本、平台、语言，以及上面提到的随机安装编号；
- 设备概况：操作系统版本、处理器、核心数、内存大小、显卡型号和驱动版本、分辨率、窗口模式、画质档位、平均帧率；
- 游戏状态：所在地图、角色在地图里的坐标和朝向、剧情章节、打开的界面、本次游玩时长、本机账户类型、经截短哈希处理的本机账户标识、角色编号与游玩时长，以及你已登录的云城账号编号。
6.2 崩溃报告。 游戏崩溃后，下次启动时会弹窗问你："发送""这次不发"或"以后自动发送"。只有你选了"发送"或"以后自动发送"，我们才会收到：崩溃时的错误信息、崩溃类型和时间、上次运行的游戏日志、引擎生成的崩溃描述文件（crash.xml）、内存转储文件（minidump，最大 8 MB），以及 6.1 中的版本、设备概况和游戏状态。
上传前，游戏会把日志、崩溃描述文件和内存转储里文件路径和用户名字段中的 Windows 用户名，以及你的电脑名替换掉。这些文件仍可能包含你电脑上的其他文件路径、引擎生成的设备标识，以及崩溃那一刻内存中的游戏内容（例如屏幕上的聊天文字）。
选了"以后自动发送"后，你可以在 设置 › 隐私 › 崩溃报告 里改回"每次询问"。
6.3 不登录也能提交。 提交反馈和崩溃报告不需要云城账号。我们的服务器不保存你的原始 IP 地址，只保存加盐哈希，用来限制同一来源一天内的提交次数。发不出去时，报告先存在你的电脑上，下次联网再补发，全部内容发送成功后，本机副本会删除。
七、云城账号与社交功能
7.1 账号怎么来的。 第一次连上我们的服务器前，游戏会先弹出联网说明（附本政策链接）；你同意后，游戏会自动为你创建云城账号，并给你一个随机账号编号、一个好友码和一串恢复码。不需要邮箱、手机号或真实姓名。如果你用 Steam 类本机账户，游戏会把 Steam 生成的一次性登录凭证发给我们的服务器，由服务器向 Steam 核验，核验通过后我们会把你的 Steam ID 记在云城账号上。我们只保存本机密钥和恢复码的哈希，不保存原文。
7.2 我们保存的内容：
| 类别 | 具体内容 | 谁能看到 |
|---|---|---|
| 账号资料 | 账号编号、昵称和 4 位编号、好友码、个性签名、称号、公开档、隐私与聊天设置、创建时间、最后在线时间 | 昵称、签名、称号对好友和同队玩家可见 |
| 生日（选填） | 你自己填写的出生日期。用来判断能不能使用"爱人"称号（须年满 18 岁），以及是否适用未满 13 岁的限制（见第十三节）；填写后不能自己修改 | 只有我们；其他玩家看不到 |
| 好友关系 | 好友、好友申请、分组、备注、拉黑名单 | 只有你自己（对方能看到你们是好友） |
| 在线状态 | 是否在线、正在做什么（例如所在区域或活动） | 好友和队友；你可以设为隐身或关掉"显示正在做什么" |
| 空间快照 | 你选择公开的那个角色的名片、等级、进度、农园地块与作物 | 好友（你可以关掉空间） |
| 你发出的内容 | 私信、队伍聊天、留言板留言、动态、评论、点赞、送礼附言 | 收件人、队友或你选定的好友范围 |
| 互动记录 | 访客记录、送礼、偷菜与帮浇水记录、亲密度与称号、"刚才一起玩的人" | 相关的双方 |
| 官方运营 | 公告已读记录、官方邮件领取记录（包括领到哪个角色）、兑换码使用记录 | 只有我们 |
| 举报 | 你举报或被举报的内容，以及被举报消息前后最多 20 条上下文 | 只有我们 |
| 安全与防作弊 | 登录记录（时间、登录方式、客户端版本、IP 地址的加盐哈希）；所有跨账号价值流动的流水（送礼、偷菜、领邮件、兑换码）；存档校验未通过的标记；自动规则产生的风险告警；限频计数 | 只有我们 |
7.3 文字过滤和默认设置。 新账号默认只能用预设短语聊天。自由文字会先过滤，含网址、邮箱、电话号码或社交账号的会被拦下，脏话会打码。你拉黑某人后，对方发来的消息不会再投递给你。
7.4 IP 地址。 你的电脑连接我们的服务器时，服务器必然会看到你的 IP 地址。我们这样处理它：限频计数里的 IP 最多保存 1 天；兑换码输错的记录（用来防止暴力猜码）里的 IP 保存 30 天；其他记录只保存加盐哈希，不保存原文。
7.5 官方公告和邮件。 游戏会定期从我们的服务器获取公告、节日活动和官方邮件，请求时会带上语言、平台和版本，用来挑出适合你的内容。
7.6 不会做的事。 管理员看不到你的本机存档。我们不会根据你的数据给你推送广告，也不会做营销用的用户画像。防作弊规则只产生告警，由人工判断后才可能限制账号，不会自动封号。
7.7 电脑配置概况。 每次启动游戏、连上我们的服务器后，游戏会发送一份电脑配置概况：操作系统版本、处理器型号与核心数、内存大小、显卡型号与驱动版本、分辨率、窗口模式、画质档位，以及游戏版本。我们只用它统计玩家电脑配置的分布（例如各档显卡各有多少人），用来决定优化方向、默认画质和最低配置要求。保存时不记录你的账号编号原文，只存一个经过密钥处理、无法反推出账号的标识，用来让同一个账号只算一份；不记录 IP 地址。180 天内没有再次上报的会被删除。运营后台只看得到汇总后的比例，看不到单个玩家的配置。
八、我们为什么处理这些数据（法律依据）
适用于欧盟、英国等要求说明法律依据的地区：
| 处理 | 依据 |
|---|---|
| 本机数据、K 歌打分 | 只在你的电脑上处理，我们不接收 |
| 你主动提交的反馈、你同意发送的崩溃报告、选填的联系方式 | 你的同意（GDPR 第 6 条第 1 款 a 项）。你可以不提交，也可以随时撤回 |
|---|---|
| 反馈附带的设备概况与游戏状态、限制提交次数 | 正当利益：修复问题、防止滥用（第 6 条第 1 款 f 项） |
| 云城账号、好友、消息、空间、队伍、送礼、官方邮件 | 履行与你的约定，提供你主动使用的联网功能（第 6 条第 1 款 b 项） |
|---|---|
| 登录记录、流水账、风险告警、举报处理、限频、备份 | 正当利益：保障账号安全、防作弊、维护社区秩序、防止数据丢失（第 6 条第 1 款 f 项） |
| 登录时的电脑配置概况 | 正当利益：了解玩家的电脑配置，决定优化方向、默认画质和最低配置（第 6 条第 1 款 f 项） |
| 生日 | 你的同意。只在你想用"爱人"称号时填写，用来确认年满 18 岁 |
| 配合依法提出的要求 | 法定义务（第 6 条第 1 款 c 项） |
|---|
我们不做仅凭自动化处理、对你产生法律效力或类似重大影响的决定。
九、保存多久
反馈与崩溃报告
| 数据 | 保存期限 |
|---|---|
| 崩溃报告的附件（日志、crash.xml、内存转储） | 90 天后自动删除 |
| 普通反馈的附件（截图、日志） | 长期保存 |
| 反馈和崩溃报告的文字、设备概况与游戏状态 | 长期保存 |
云城账号与社交
| 数据 | 保存期限 |
|---|---|
| 账号资料、好友关系、拉黑、空间快照、留言板、动态与评论、亲密度与称号、公告已读、邮件领取与兑换记录 | 账号存在期间。你申请删除账号后30天内删除。你删除的动态会先隐藏，48 小时内可以在游戏里找回，之后连同上面的赞和评论一起删除 |
| 私信 | 30 天 |
| 队伍聊天 | 队伍解散时删除，队伍一直不散的最多保存 3 天 |
| 访客记录、玩家间送礼、偷菜与帮浇水记录 | 30 天 |
| "刚才一起玩的人" | 7 天 |
| 发出后没人回应的称号邀请 | 7 天 |
| 每日次数统计、一起在线分钟数 | 3 天 |
| 联机房间心跳、限频计数（含 IP） | 1 天 |
| 兑换码输错记录（含 IP） | 30 天 |
| 登录记录、价值流水账 | 90 天 |
| 电脑配置概况（不含账号编号原文和 IP） | 180 天没有再次上报的删除 |
| 风险告警 | 处理完成后 180 天 |
| 举报及其上下文 | 处理完成后1 年 |
| 管理操作审计记录 | 1 年 |
| 每日数据库备份 | 30 天 |
期满后数据会被删除，或者处理成无法再关联到你的形式。法律要求更长保存的情况除外。
十、与谁共享
- Cloudflare, Inc.：我们的服务器、数据库和文件存储都运行在 Cloudflare 上（Workers、D1、R2、Durable Objects）。Cloudflare 作为我们的数据处理者，按其隐私政策和数据处理附录处理数据。
- Valve（Steam）：见第五节；用 Steam 登录云城账号时，我们会把登录凭证交给 Steam 核验。
- 其他玩家：按第七节和你的隐私设置，看到你选择公开的内容。
- 依法要求：法律、法院或政府机关依法要求时。
- 我们不出售你的个人信息，也不为跨场景行为广告的目的"共享"个人信息（这两个说法按美国加州法律理解）。我们没有接入第三方统计、广告或 AI 服务来处理你的数据。
十一、跨境传输
我们的数据库位于亚太地区，请求会经过 Cloudflare 的全球网络。
如果数据从欧盟、英国或瑞士传到其他国家或地区，我们依靠 Cloudflare 数据处理附录中的标准合同条款等保障措施。开发者位于澳大利亚。
十二、安全
- 游戏与服务器之间使用 HTTPS 和加密的 WebSocket 通信。
- 本机密钥、恢复码、兑换码在服务器上只保存哈希；IP 地址只保存加盐哈希（例外见 7.4）。
- 后台管理页面只允许经过 Cloudflare Access 验证的开发者账号登录。
没有绝对安全的系统。如果发生影响你的数据泄露，我们会按法律要求通知你和监管机构。
十三、儿童与未成年人
本游戏面向 12 岁及以上的玩家；使用 Steam 本身需要年满 13 岁。我们不会明知而收集 13 岁以下儿童的个人信息。新账号默认只能用预设短语聊天，自由文字会过滤联系方式；"爱人"称号要求年满 18 岁，并且可以用家长控制关掉。按你自己填写的生日不满 13 岁的账号，只能用预设短语聊天，不能写个性签名、不能发动态和评论；填写这个生日时，已发的动态会被删除、签名会清空。没有填写生日的账号不做这项限制；年满 13 岁后自动解除。
如果你是家长，认为孩子向我们提供了个人信息，请联系support@cloudcitygame.com并提供孩子的好友码，我们会删除。
十四、你的权利和控制方式
在游戏里你可以：
- 修改昵称（每 30 天一次）和个性签名；在聊天设置里选择"全部 / 只用短语 / 关闭"；把在线状态设为隐身或勿扰；关掉"显示正在做什么"；关掉空间；设置留言板只收短语；关掉"允许偷菜""允许帮忙打理""允许结爱人"；
- 删除你的留言、你空间里的留言和你的动态；删除好友、拉黑、举报；
- 更换恢复码（旧的立即作废）；
- 提交反馈前取消截图和日志；崩溃后选"这次不发"；
- 删除
Saved文件夹，清除全部本机数据。
你也可以写信给我们。 根据你所在地区的法律，你可以要求查阅、更正、删除你的个人信息，限制处理或反对处理，或者要求导出一份你的数据。请发邮件到support@cloudcitygame.com，写上你的好友码，我们会请你在游戏里完成一个简单验证，确认账号是你的。我们会在 30 天内答复。反馈和崩溃报告如果当时没有登录，我们没法按人查找。你可以告诉我们大致的提交时间和内容，我们会尽量找出来删除。
如果你在欧盟或英国，你也有权向当地的数据保护机构投诉。
十五、关于人工智能
本游戏的对话、小星的回答都来自预先写好的文本，游玩时不使用 AI 实时生成任何内容。联机语音只在玩家之间传送，不经过我们的服务器。我们不把你的任何数据（包括聊天内容、反馈、录音）发给 AI 服务。开发过程中借助 AI 工具制作的部分内容，已按 Valve 的要求在本游戏的 Steam 页面披露。
十六、政策变更
本政策更新时，我们会在本页标明新的生效日期，并通过游戏内公告通知。如果变更涉及新增收集的数据类别或新的用途，我们会在变更生效前提醒你，需要同意的会重新征得你的同意。
十七、联系我们
Dawn Productions
237 Mowbray Rd, Chatswood NSW 2067, Australia
support@cloudcitygame.com
Nimbora: Kingdom of Murfania — Privacy Policy
Effective date: 2026-10-27 Version: 1.0
1. Who we are and what this policy covers
Nimbora: Kingdom of Murfania (Chinese title 云端之城, "the Game") is developed by Dawn Productions ("we", "us") and distributed on Steam. This policy explains what data the Game handles on your computer and on our servers, why we handle it, how long we keep it, and how you can control it.
This policy covers the Game and the backend that serves it. Steam is operated by Valve and is covered by Valve's own privacy policy. Our official website, cloudcitygame.com, sets no cookies and uses no analytics scripts; it only uses your browser's local storage to remember the display language you chose.
Privacy contact: support@cloudcitygame.com
2. Summary
- Your saves, settings and local profiles stay on your own computer.
- The microphone is used only for karaoke and for voice chat in multiplayer rooms. Karaoke singing is scored on your computer and never uploaded; a recording is saved to your computer only if you click "Save this recording". Voice chat goes only to the players in the same room, never passes through our servers and is not stored on any server.
- The Game contains no content generated by AI while you play, and it never sends your data to any AI service.
- We do not sell data, show ads, or use third-party analytics or advertising SDKs.
- After a crash, the Game asks you at the next launch whether to send a crash report. We receive feedback or crash reports only when you choose to send them.
- Online features (friends, messages, your Space, parties, gifts, official mail) use a "Cloud City account". Before the Game goes online for the first time, it shows a short notice; the account is created only after you accept. If you decline, you can still play single-player as usual. We never ask for an email address, phone number or real name. We store your nickname, your friend list and what you post, so that we can run these features, moderate the community and prevent cheating. Direct messages are kept for 30 days and login records for 90 days. IP addresses are stored only as salted hashes. Section 9 has the full retention table.
3. Data that stays on your computer
The following data is stored in the Game's save folder (the Saved folder), and we cannot see it.
| Data | Purpose | Notes |
|---|---|---|
| Local profile: name, optional password, optional security-question answers | Telling players on the same PC apart | Passwords and answers are stored only as salted hashes, never in plain text |
| Steam-type local profile | Signing in to a local profile with your Steam identity | The Game reads your Steam ID and Steam name on your computer; the profile folder is named after your Steam ID |
| Character saves, farm, achievement and story progress | Playing the Game | Saves carry a tamper-check signature that is verified on your computer only |
| Settings | Graphics, audio and control preferences | Includes a randomly generated "install ID" with no personal information in it; feedback and crash reports use it |
| Karaoke recordings | Kept as a keepsake after you click "Save this recording" | Saved in your local profile folder; never uploaded |
| Engine logs and crash files | Troubleshooting | Written by the game engine on your computer; uploaded only if you agree (see Section 6) |
| Cloud City account device key and recovery code | Signing in automatically next time; recovering your account on a new PC | The recovery code is deleted from your computer once you confirm you have written it down. Never share either one |
|---|
Deleting the Game's Saved folder deletes all of the data above. Uninstalling the Game may not delete this folder.
4. Microphone (karaoke and voice chat)
- The Game opens the microphone in only two cases: when you start a karaoke song in the Song & Dance House, and when you are in a multiplayer room with voice chat turned on. The microphone is never opened in single-player.
- While you sing, your voice is analysed on your computer for pitch and rhythm to calculate a score. It is not uploaded or sent to other players.
- When the song ends, the recording (a WAV file) is saved to your local profile folder only if you click "Save this recording". Otherwise nothing is kept.
- Voice chat is available only in multiplayer rooms (for example multiplayer rooms in the Restaurant, the Dice House table games and Song of the Hall). By default it is push-to-talk (hold Z); you can switch it off or to open mic under Settings › Sound › Voice Chat, and it mutes automatically when you switch away from the game window. Your voice is compressed and sent over the game's own multiplayer connection to the host (one of the players in the room), who relays it to the others. It never passes through our servers, and neither our servers nor the host store it. By default only your party members and Cloud City friends can hear you; strangers are muted by default, and players you have blocked are never played. Your mute list, per-player volume and voice mode are stored on your computer. The Game does no speech recognition, voiceprint recognition or emotion recognition.
5. Data handled by Steam
You buy, launch and play the Game through Steam. Valve, as an independent controller, handles your Steam account, purchase history, playtime and similar data under the Steam Privacy Policy. On your computer, the Game calls Steam to read your Steam ID and Steam name (for Steam-type local profiles and multiplayer).
5a. Multiplayer rooms
- Multiplayer rooms run on Steam's networking service. Other players in the same room can see your in-game name (your Steam name, or your Cloud City nickname) and your character.
- Room chat is relayed to the other players by the host's game, which filters it first. Our servers do not store room chat.
- If Steam is unavailable, the Game may fall back to a direct connection, in which case other players in the room could technically obtain your IP address.
- How voice chat is sent and who can hear it is described in Section 4.
6. Feedback and crash reports
6.1 Feedback you send. When you open "Feedback" in the Game and click Send, we receive:
- the category you chose, the text you wrote (up to 2,000 characters), and any contact detail you choose to give (for example a Discord name or email);
- a screenshot (game view only, without menus) and the game log (up to 1 MB). Both are ticked by default, and you can untick them before sending;
- the game version, platform and language, plus the random install ID mentioned above;
- a device summary: operating system version, CPU, number of cores, amount of RAM, graphics card and driver version, resolution, window mode, quality preset, average frame rate;
- game state: current map, your character's position and facing on that map, story chapter, open screen, length of the current session, local profile type, a shortened hashed identifier of your local profile, character ID and playtime, and your Cloud City account ID if you are signed in.
6.2 Crash reports. After a crash, the Game asks at the next launch: "Send", "Not this time" or "Always send automatically". Only if you choose "Send" or "Always send automatically" do we receive: the error message, crash type and time, the game log from that session, the crash description file generated by the engine (crash.xml), a memory dump (minidump, up to 8 MB), and the version, device summary and game state described in 6.1.
Before uploading, the Game replaces your Windows user name (in file paths and user-name fields) and your computer name in the logs, crash description file and memory dump. These files may still contain other file paths on your computer, a device identifier generated by the engine, and game content that was in memory at the moment of the crash (for example chat text on screen).
If you chose "Always send automatically", you can switch back to "Ask Every Time" under Settings › Privacy › Crash Reports.
6.3 No account needed. You can send feedback and crash reports without a Cloud City account. Our server does not store your IP address, only a salted hash of it, which we use to limit how many reports one source can send per day. If a report cannot be sent, it waits on your computer and is retried the next time you are online. The local copy is deleted once everything has been sent.
7. Cloud City account and social features
7.1 How the account is created. Before the Game first reaches our server, it shows an online notice with a link to this policy; once you accept, it creates a Cloud City account for you with a random account ID, a friend code and a recovery code. You never need to give an email address, phone number or real name. If you use a Steam-type local profile, the Game sends a one-time login ticket issued by Steam to our server. The server checks the ticket with Steam, and if it is valid we link your Steam ID to the account. We store only hashes of the device key and the recovery code, never the originals.
7.2 What we store:
| Category | Details | Who can see it |
|---|---|---|
| Profile | Account ID, nickname and 4-digit tag, friend code, signature, title, public character, privacy and chat settings, creation time, last-online time | Nickname, signature and title are visible to friends and party members |
| Birthday (optional) | The date of birth you enter. Used to check whether you may use the "Partner" bond (you must be 18 or older) and whether the under-13 limits apply (see Section 13). You cannot change it yourself once entered | Only us. Other players never see it |
| Friends | Friends, friend requests, groups, notes, block list | Only you (the other person can see that you are friends) |
| Online status | Whether you are online and what you are doing (for example your area or activity) | Friends and party members. You can appear offline or turn off "Show what I'm doing" |
| Space snapshot | Profile card, level, progress, farm plots and crops of the character you make public | Friends (you can turn your Space off) |
| Content you post | Direct messages, party chat, guestbook entries, posts, comments, likes, gift notes | The recipient, your party, or the friends you choose |
| Interaction records | Visit log, gifts, crop-stealing and watering-help records, friendship level and bonds, "Recently played with" | The two players involved |
| Official operations | Which notices you have read, which official mail you claimed (and to which character), which redeem codes you used | Only us |
| Reports | Content you report or that is reported about you, with up to 20 surrounding messages for context | Only us |
| Security and anti-cheat | Login records (time, login method, client version, a salted hash of your IP address); a ledger of every transfer of value between accounts (gifts, crop stealing, mail claims, redeem codes); a flag if your save failed its tamper check; risk alerts raised by automated rules; rate-limit counters | Only us |
7.3 Filtering and defaults. New accounts can chat only with preset phrases by default. Free text is filtered first: messages that contain links, email addresses, phone numbers or social-media handles are blocked, and profanity is masked. If you block someone, their messages are no longer delivered to you.
7.4 IP addresses. Whenever your computer connects to our server, the server necessarily sees your IP address. Here is what we do with it: rate-limit counters keep it for at most 1 day; records of wrong redeem-code attempts (used to stop code guessing) keep it for 30 days; everywhere else we store only a salted hash, never the address itself.
7.5 Official notices and mail. The Game regularly fetches notices, festival events and official mail from our server. Each request includes your language, platform and game version, so we can pick the right content for you.
7.6 What we don't do. Administrators cannot see your local saves. We do not use your data to show you ads or to build marketing profiles. Anti-cheat rules only raise alerts, and a person reviews each one before any restriction. Accounts are never banned automatically.
7.7 Computer specs summary. Each time you start the Game and it connects to our server, it sends a summary of your computer specs: operating system version, CPU model and number of cores, amount of RAM, graphics card and driver version, resolution, window mode, quality preset, and the game version. We use it only to count how common each kind of hardware is among players (for example, how many players have each tier of graphics card), so we can decide what to optimise, the default quality settings and the minimum requirements. We do not store your account ID with it. We store only an identifier derived from it with a secret key, which cannot be turned back into your account ID and is used only so each account is counted once. We do not store your IP address with it. A summary that has not been sent again for 180 days is deleted. Our admin tools show only aggregated percentages, never one player's specs.
8. Why we process your data (legal bases)
For players in the EU, the UK and other places where a legal basis must be stated:
| Processing | Legal basis |
|---|---|
| Local data and karaoke scoring | Handled only on your computer; we never receive it |
| Feedback you send, crash reports you agree to send, optional contact details | Your consent (GDPR Art. 6(1)(a)). You can choose not to send, and you can withdraw at any time |
|---|---|
| Device summary and game state attached to reports; limiting how many reports can be sent | Legitimate interests: fixing bugs and preventing abuse (Art. 6(1)(f)) |
| Cloud City account, friends, messages, Space, parties, gifts, official mail | Performing our agreement with you to provide online features you choose to use (Art. 6(1)(b)) |
|---|---|
| Login records, ledger, risk alerts, handling reports, rate limits, backups | Legitimate interests: account security, cheat prevention, community safety, protecting against data loss (Art. 6(1)(f)) |
| Computer specs summary sent at login | Legitimate interests: understanding players' hardware to decide what to optimise, default quality settings and minimum requirements (Art. 6(1)(f)) |
| Birthday | Your consent. You enter it only if you want the "Partner" bond, so we can confirm you are 18 or older |
| Responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
|---|
We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
9. How long we keep data
Feedback and crash reports
| Data | Retention |
|---|---|
| Crash report attachments (log, crash.xml, memory dump) | Deleted automatically after 90 days |
| Feedback attachments (screenshot, log) | Kept long-term |
| Text, device summary and game state of feedback and crash reports | Kept long-term |
Cloud City account and social features
| Data | Retention |
|---|---|
| Profile, friends, block list, Space snapshot, guestbook, posts and comments, friendship level and bonds, notice reads, mail claims and redemptions | While your account exists. Deleted within 30 days after you ask us to delete your account . A post you delete is hidden first; you can restore it in the game within 48 hours, after which it is deleted together with its likes and comments |
| Direct messages | 30 days |
| Party chat | Deleted when the party disbands; at most 3 days for a party that never disbands |
| Visit log, gifts between players, crop-stealing and watering-help records | 30 days |
| "Recently played with" | 7 days |
| Bond invitations nobody answered | 7 days |
| Daily counters and minutes spent online together | 3 days |
| Room heartbeats, rate-limit counters (including IP) | 1 day |
| Wrong redeem-code attempts (including IP) | 30 days |
| Login records and value ledger | 90 days |
| Computer specs summary (without your account ID or IP address) | Deleted if not sent again for 180 days |
| Risk alerts | 180 days after they are resolved |
| Reports and their context | 1 year after they are resolved |
| Admin audit log | 1 year |
| Daily database backups | 30 days |
When a retention period ends, the data is deleted or made so that it can no longer be linked to you, unless the law requires us to keep it longer.
10. Who we share data with
- Cloudflare, Inc.: our server, database and file storage run on Cloudflare (Workers, D1, R2, Durable Objects). Cloudflare handles the data as our processor under its privacy policy and data processing addendum.
- Valve (Steam): see Section 5. When you sign in to your Cloud City account with Steam, we pass the login ticket to Steam to check it.
- Other players: they see what you choose to make visible, as described in Section 7 and set by your privacy settings.
- Lawful requests: when the law, a court or a government authority lawfully requires it.
- We do not sell your personal information or "share" it for cross-context behavioural advertising, in the sense of California law. We use no third-party analytics, advertising or AI services to process your data.
11. International transfers
Our database is located in the Asia-Pacific region, and requests pass through Cloudflare's global network.
When data moves out of the EU, the UK or Switzerland, we rely on safeguards such as the Standard Contractual Clauses in Cloudflare's data processing addendum. The developer is based in Australia.
12. Security
- The Game talks to our server over HTTPS and encrypted WebSockets.
- Device keys, recovery codes and redeem codes are stored on the server only as hashes. IP addresses are stored only as salted hashes (exceptions in 7.4).
- The admin console accepts only developer accounts verified through Cloudflare Access.
No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
13. Children and minors
The Game is intended for players aged 12 and over . Steam itself requires users to be at least 13. We do not knowingly collect personal information from children under 13. New accounts can chat only with preset phrases by default, and free text is filtered for contact details. The "Partner" bond requires age 18+ and can be turned off with parental controls. If the birthday you enter shows you are under 13, your account can chat only with preset phrases and cannot set a signature, post or comment; when that birthday is entered, any posts you made are deleted and your signature is cleared. Accounts without a birthday are not restricted this way, and the restriction lifts automatically when you turn 13.
If you are a parent and believe your child has given us personal information, contact support@cloudcitygame.com with your child's friend code and we will delete it.
14. Your rights and controls
In the Game you can:
- change your nickname (once every 30 days) and signature; set chat to "All", "Phrases only" or "Off"; appear offline or set Do Not Disturb; turn off "Show what I'm doing"; turn off your Space; accept only phrases in your guestbook; turn off "Allow crop stealing", "Allow help with my farm" and "Allow Partner bond";
- delete entries you wrote, entries in your own guestbook, and your posts; remove friends, block and report players;
- replace your recovery code (the old one stops working at once);
- untick the screenshot and log before sending feedback, and choose "Not this time" after a crash;
- delete the
Savedfolder to remove all local data.
You can also write to us. Depending on the law where you live, you may ask to access, correct or delete your personal information, to restrict or object to its processing, or to receive a copy of your data. Email support@cloudcitygame.com with your friend code, and we will ask you to complete a simple in-game check to confirm the account is yours . We reply within 30 days. If you were not signed in when you sent feedback or a crash report, we cannot look it up by person. Tell us roughly when you sent it and what it said, and we will do our best to find and delete it.
If you are in the EU or the UK, you also have the right to complain to your local data protection authority.
15. About artificial intelligence
All dialogue in the Game, including Xiaoxing's answers, comes from pre-written text. Nothing is generated by AI while you play. Voice chat travels only between players and never passes through our servers. We never send any of your data (including chat, feedback or recordings) to an AI service. Some content made with the help of AI tools during development is disclosed on the Game's Steam page, as Valve requires.
16. Changes to this policy
When we update this policy, we will show the new effective date on this page and announce it in the Game. If a change adds a new category of data or a new purpose, we will tell you before it takes effect and ask for your consent again where consent is needed.
17. Contact us
Dawn Productions
237 Mowbray Rd, Chatswood NSW 2067, Australia
support@cloudcitygame.com