Privacy policy
1. Who processes the data
The data processing operator is Valtreon Technology Ltd, Seychelles. Contact for privacy questions: support@eorunners.online. This policy applies to the EORunners service (eorunners.online).
2. What data we collect
Email — at registration, for login and address confirmation.
An argon2id password hash — we do not store the password itself.
Session httpOnly cookies — inaccessible to JavaScript.
A salted, hashed IP address for anti-fraud — we do not store raw IPs.
Run history for authenticated users, the chosen interface language, and settings in localStorage (skin, XP). No payment data is collected in demo mode.
We also store registration country (GeoIP, without storing the source IP), first-touch referrer, landing URL and UTM (eorunners_ft in localStorage), payment history and submitted TXID. Wallet Link stores address, provider, allowance, approve_txid and status. Payment-provider requests, responses and callbacks are logged for support and investigation, excluding authorization secrets. Telegram notifications may include country, source and payment ID when the operator enables those fields.
3. Purposes of processing
Providing the game and saving progress, authentication and account security, protection against fraud, and user support by email.
4. Retention period
Account data is stored as long as the account exists. Cookies and tokens — within their lifetime (access — minutes, refresh — up to 30 days). IP hashes — for a limited time. localStorage is stored in the browser until you clear it.
5. Your rights
You can request access to your data and its correction, deletion of your account, withdraw consent, and clear cookies and localStorage. To exercise your rights, write to support@eorunners.online.
6. Cookies and local storage
access_token / refresh_token — httpOnly cookies of an authenticated session.
eorunners_ref — the affiliate code from a ?ref= link (30 days).
eorunners_skin — the selected scene skin (localStorage).
NEXT_LOCALE — the selected language (cookie). XP and the session id — localStorage.
7. Web analytics
The operator may enable self-hosted Matomo and third-party Google Analytics 4 and Yandex Metrika; these services and data transfers are described below.
We collect: interface events (page views, run start and outcome, language and mode changes, deposit steps), approximate geolocation down to city level, and device/browser type.
For self-hosted Matomo analytics: Your IP address is anonymised (the last bytes are masked) and never stored in full. Balance amounts and payment details are never sent to analytics.
Analytics runs only when enabled by the operator; it is off by default.
If the Operator enables the optional third-party support widget, it loads in an embedded frame from its vendor; it is off by default and never receives your balance or payment data.
If the Operator enables service notifications, some event data (such as your email, nickname and amounts) may be sent to the Operator's private Telegram channel — a third-party service. This is off by default.
If the Operator enables Yandex.Metrika, visit data is sent to Yandex (a third party); with Webvisor enabled, your on-page actions (mouse movements, clicks, scrolling, form input) are additionally recorded as a session replay. This is off by default.
When first-party analytics is enabled (off by default), a random cookie identifies the browser for up to 90 days. We retain visit sources (UTM tags, referring domain, landing route, country and language) for 90 days and link source snapshots to registration and the first confirmed deposit. Snapshots are kept with the account record; internal reports use confirmed deposit totals. No raw IP address is stored in this visit history.
8. Meta Pixel (Facebook Ads)
Meta Pixel is enabled by the operator and loads only after you accept advertising cookies. Meta Platforms receives visited page URLs, device and browser information, the connection IP address and advertising cookie identifiers, plus registration, deposit-request and confirmed-payment events. Payment events include the actual amount, currency and an opaque transaction identifier. Event parameters exclude your balance, password, email, payment credentials and game seeds.
Your choice is saved in browser localStorage; Meta may set _fbp and _fbc cookies. You can change or withdraw consent at any time using Advertising cookies. Rejecting does not restrict access to the game.