Lunekin Privacy Policy

Last updated: 18 October 2026

1. Who we are

The controller of your personal data is Pier Luigi Segatto, Italy. Contact for any privacy request: astilos.test@gmail.com.

2. What this policy covers

Lunekin, the browser game at https://lunekin.pages.dev and the desktop game distributed on Steam, and the online services behind them (the game server and the database that keep your progress, leaderboards and rivals).

3. Accounts and identity

The game creates an account the first time you play, without asking you anything:

• In the browser, as a guest. The game signs this device in anonymously with our database provider (Supabase). This creates an account with a random identifier and no name or email. The session is kept in your browser's local storage; if you clear your browser data, that account cannot be reached again from this device.

• With an email and a password. If you have an account with credentials, you can sign in from PROFILES → SIGN IN. We then process your email address; your password is handled by Supabase Auth and is never stored by the game itself. There is no sign-up or password reset by email.

• With Google or Discord. You can create an account, or sign back in on any device, with your Google or Discord account (PROFILES → SIGN IN), and a guest can keep everything by linking one of them (PROFILES → LINK YOUR PROGRESS). Google or Discord then share with Supabase Auth your email address, your account identifier with them and, if you have them, your name (or username) and profile picture. The game uses them only to sign you in, and shows your email or name only to you, in PROFILES: they are never public. We never receive your Google or Discord password; their own privacy policies apply to those accounts.

• On Steam. The desktop game identifies you with your Steam account: our server verifies a Steam authentication ticket with Valve and stores your SteamID, linked to your game account. We do not receive your Steam password or payment details.

One account holds up to three tamer profiles.

4. What we collect, and why

4.1 Your tamer profile

• Battle name and portrait (the trainer you picked). These are public: other players see them on the leaderboards and, when your team is their rival, as the rival's name on their battle screen.

• Progress: tamer level and experience, journeys started and won, best day reached, Ranked points, the endless record, which creatures and items you have discovered, achievements, tutorial and news flags, and your game settings (music and effects volume, battle speed, texture quality).

• Collection: the cards you own, your Lunes, dust and packs, and a log of every pack opened (what it contained).

4.2 Your games

• Every journey: its state at each day (your team, gold, items, choices), the official result of each battle with the inputs needed to replay it, and the team you fielded each day, which enters the pool of rivals other players face (with your battle name and trainer).

• Integrity checks: when a saved journey does not match what the server computed, the server records a flag on that journey. Flags never block play.

4.3 Gameplay telemetry and crash reports

The game sends short events to our server, tied to your profile. Each event carries the platform (web, Steam or desktop), the game data version and a random session identifier that exists only while the page is open (it is not stored on your device). Events sent during a journey also carry that journey and its day. The events are:

• session_started: how long the game took to load, the game version, screen size and your text-size and reduce-flashing settings;
• onboarding_step, tutorial_step, tutorial_finished, tutorial_abandoned: which step of the first launch and of the tutorial you reached;
• run_started, day_entered, run_ended: the mode, the trainer, the day reached, lives and gold, how a journey ended;
• battle: won or lost, the KIND of rival (another player's team, the generated stand-in or the Apex — never the other player's name), its strength bracket, lives left, duration, damage dealt/taken/healed/shielded, the game version and the creatures in your team;
• packs_opened: which pack and how many;
• client_error and crash: a cleaned error message (addresses, file paths and identifiers removed), the screen where it happened, a fingerprint used to group identical errors and the position in the game's own code where it started (a game file name and two numbers). No stack trace is sent; the technical details stay on your device (in the crash screen and, on desktop, in the local crash log);
• server_error: when the server fails on one of your requests, the same cleaned message, the kind of request, a fingerprint and the position in the server's code — written by the server, never your data;
• pool_fallback_procedural: that a battle was played against a generated rival because no real one was available.

They are used to balance the game, to understand where new players get stuck and to fix bugs. Raw events are kept for 90 days; after that only daily counts per event type, platform and version remain, with no link to a profile. There is no advertising, no profiling for marketing and no third-party analytics SDK.

4.4 Technical data

• Server logs: for each request, the method, the path, the status, the duration and the profile identifier. Never your password, tokens or the content of the request.

• Our providers' logs: like any online service, Supabase, our server host and our web host process your IP address and similar technical data to deliver the service and protect it from abuse, and keep their logs for the limited time set by their own policies.
• Rate limiting: the server counts requests per account (or per IP address when there is no session) for one minute, in memory, to stop abuse.

• Check against automated sign-ins: in the browser, when this device creates its guest account and when you sign in with an email and a password, the game first runs Cloudflare Turnstile, a check that tells people from automated scripts. Usually you see nothing; sometimes you are asked to tick a box. For this check Cloudflare processes your IP address and technical information about your browser and device, and gives the game a one-time token that our database provider verifies. It is used only to stop accounts being created in bulk.

4.5 On your device

The game keeps your saves, settings and session in your browser's local storage (on Steam, in the game's data folder on your computer, mirrored by Steam Cloud). This is needed to play and needs no consent. The game sets no advertising or tracking cookies, and it loads its fonts and art from its own site; the only script from outside is the Cloudflare check of section 4.4.

4.6 Steam

On Steam, the game unlocks your achievements and shows "Day N — biome" as your Steam status. Valve's own privacy policy applies to your Steam account.

4.7 Problem reports

From Settings → REPORT A PROBLEM (also during a battle) you can write to us about a bug or anything that went wrong. We receive your text, tied to your profile, and this context, which the game adds by itself and lists in the panel before you send:

• appVersion, dataVersion: the version of the game and of its data;
• platform, backend: web, Steam or desktop, and whether the game talks to our server or directly to our database;
• scene: the screen you opened the settings from;
• runId, day, seed, mode: the journey you were playing, if any (its identifier, day, seed and mode);
• sessionId: the random session identifier of section 4.3;
• recentErrors: up to 5 of the latest errors of this session, cleaned as in section 4.3 (a message and a fingerprint);
• screen, textScale, reduceFlashing: the size and pixel density of the game window, your text-size and reduce-flashing settings.

Never your battle name, your email, your IP address or a web address. The text is yours: please do not write in it personal data of other people. You can send up to 5 reports a day. They are read by Pier Luigi Segatto, who manages the game, in the game's private admin, to fix the problem; we may use your profile identifier to find your account if you ask us about it. A report stays until it is handled; once it is closed it is deleted after 90 days. If the game cannot reach our server, it copies your text and this context so you can paste them yourself into a message to us at astilos.test@gmail.com.

5. Legal bases (GDPR art. 6)

• Contract (art. 6.1.b): your account, profiles, progress, collection, journeys, leaderboards and the rival pool — this is the game you asked to play.
• Legitimate interest (art. 6.1.f): telemetry and crash reports (to balance and fix the game), integrity checks, logs, rate limiting and the check against automated sign-ins (to keep the service fair and safe). You can object at any time by writing to astilos.test@gmail.com.
• Your request (art. 6.1.b): the problem reports you choose to send (section 4.7).

6. What is public

Your battle name, your trainer portrait, your Ranked points (with peak, journeys and wins) and your endless record appear on the public leaderboards, and the teams you field can be met by other players as rivals, with your battle name and trainer. Nothing else about your profile is public.

7. How long we keep your data

• Your account and everything in it: until you delete it (section 12) or delete a profile. There is no automatic expiry today.

• Problem reports: until they are handled; a closed report is deleted 90 days after closing (section 4.7).

• Database backups: 14 days.

• Server and provider logs: the limited time set by each provider (section 4.4).
• Data on your device: until you clear it, or delete the account from the game.

8. Who processes your data

• Supabase (database and sign-in) — region EU (Ireland).
• Render (game server) — Frankfurt, Germany.
• Cloudflare (web hosting, and the check against automated sign-ins of section 4.4).
• GitHub (code and database backups).
• Valve / Steam (desktop version only).
• Google and Discord, only if you choose to sign in with them (section 3), under their own privacy policies.

Some of these are based in the United States; those transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the provider's Standard Contractual Clauses.

9. Security

Access to the database is protected by row-level security; privileged credentials are held only by the game server and the people who manage the project, never by the game you run; the web game runs under a strict Content Security Policy. Backups are only accessible to the people who manage the project.

10. Payments

Nothing is sold inside the game, and it processes no payment data. The "Lunes" currency is earned only by playing.

11. Children

Lunekin is meant for players aged 16 or over, or the age of digital consent in your country if it is lower (never under 13). The game does not ask for your age; if you are younger than that, please ask a parent or guardian before playing. If we learn that we hold data of a child below that age without consent, we delete it.

12. Your rights, and deleting your account

You can ask us for access to your data, its correction, its deletion, a copy of it (portability), to restrict or to object to its processing, by writing to astilos.test@gmail.com. You can also complain to your data protection authority (in Italy: the Garante per la protezione dei dati personali, www.garanteprivacy.it).

Delete your account from the game: PROFILES → DELETE ACCOUNT, then type DELETE. It erases, for good, every tamer of the account with its collection, Lunes, journeys, leaderboard places and problem reports, the account itself, its sign-in identity (guest, email, Google or Discord), and the saves on that device. On Steam it erases your game account and the link to your SteamID (not your Steam account). A single tamer can be deleted from PROFILES → DELETE.

13. Changes

We will publish any change on this page, with its date, and tell you in the game when it matters.

14. Contact

Pier Luigi Segatto — Italy — astilos.test@gmail.com

Lunekin Terms of Use

Last updated: 18 October 2026

1. Who we are

Lunekin is provided by Pier Luigi Segatto, Italy ("we"). Contact: astilos.test@gmail.com. By playing Lunekin you accept these terms and our Privacy Policy (https://lunekin.pages.dev/legal/#privacy).

2. Who can play

You must be at least 16, or the age of digital consent in your country if it is lower (never under 13). Below that age you may play only with the consent of a parent or guardian.

3. Your account

• The game creates an account for your device the first time you play (as a guest), or you sign in with an account that has an email and a password, or — on Steam — with your Steam account. One account holds up to three tamer profiles.

• A guest account lives in your browser: if you clear the browser's data, use a private window or another browser, you start a new account and the old one cannot be reached from there.
• Keep your credentials to yourself. You are responsible for what happens with your account.
• You can delete your account at any time from the game (PROFILES → DELETE ACCOUNT). It cannot be undone: every tamer, collection, journey and leaderboard place of the account is erased.

4. Your battle name

Your battle name is public: it appears on the leaderboards and to the players who meet your team as a rival. It must be 2 to 16 characters, and it may not be offensive, impersonate the game or its staff, or copy a name already taken. The game refuses such names automatically; we may also rename or remove a profile whose name breaks these rules.

5. Lunes, packs and cards

• Lunes, dust, packs, cards and every other item of the game are a licence to use them inside Lunekin. They have no value in real money, cannot be sold, transferred, exchanged or refunded, and exist only inside your account.
• They are earned only by playing: nothing is sold inside the game.

• In the online version the official state of your collection is the one kept by our server.

6. Fair play

You agree not to cheat, not to use bots, scripts or modified clients, not to exploit bugs, not to tamper with the game's network traffic, and not to attack or overload the service. Battles are decided by our server: results that do not match are flagged, and we may correct leaderboards, reset progress or suspend accounts involved in cheating.

7. Rivals and other players

Your fielded teams join the pool of rivals other players face, with your battle name and trainer. When no real rival is available the game generates one ("Rite Echo").

8. The service

We work to keep the game online, but it may be interrupted for maintenance, updates or reasons beyond our control. The game keeps playing on your device when the cloud is not reachable, and tells you so. An update may require the latest version to keep playing online. We may change, add or remove content, and balance the game, at any time.

9. Ending

You can stop playing and delete your account at any time. We may suspend or close an account that breaks these terms, telling you why when we can. If we ever shut the game down, we will announce it in the game at least 30 days in advance.

10. Intellectual property

Lunekin — its code, art, music, names and characters — belongs to Pier Luigi Segatto or its licensors. You may not copy, sell or redistribute it, except for sharing screenshots and videos of your own play.

11. Liability

The game is provided "as is". Nothing in these terms limits the rights you have as a consumer under the law of your country, or our liability where the law does not allow it to be limited.

12. Law and disputes

These terms are governed by Italian law. If you are a consumer, you keep the protection of the mandatory rules of the country where you live, and you may bring a claim before the courts of that country.

13. Changes

We may update these terms. We will publish the new version on this page with its date and, for important changes, tell you in the game before they apply.

14. Contact

Pier Luigi Segatto — Italy — astilos.test@gmail.com