Privacy Policy

1. Introduction

FrostWeb Studios, LLC (“we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use any of our services.

This policy applies to all FrostWeb Studios services, including but not limited to:

• Websites: frostweb.studio, accounts.frostweb.studio (the account hub), forums.frostweb.studio, and the storefront at shop.frostweb.dev
• Games: Ayndora, Murica AF, and any future titles published by FrostWeb Studios
• Applications: the FrostWeb mobile app, the Ayndora Companion App, launchers, and any other companion or utility applications
• Forums: FrostWeb community forums and associated communication features
• APIs and Backend Services: the FrostWeb Identity (account) service, the shop service, game APIs, and chat services

By accessing or using any of our services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree with the practices described in this policy, please do not use our services. This Privacy Policy is governed by the laws of the State of Florida, United States of America.

2. Information We Collect

We collect the information needed to run a FrostWeb account and the services attached to it: information you provide directly, information recorded automatically when you sign in and use our services, and information received from the sign-in and payment providers you choose to use.

2.1 Information You Provide

When you create and use a FrostWeb account, you provide the following information:

• Account Registration: Every registration path (password, Google, Steam, Epic Games, and the mobile app) collects your email address, a password, your first and last name, your date of birth, and optionally your country. Your email address is verified by a link we send you, which expires after 24 hours. Your password is stored only as a bcrypt hash, never in plain text; every account has one, including accounts started with Google, Steam, or Epic Games.
• FrostWeb Tag: You choose a display name, and we attach a random four-digit number to it (for example, Sinidious#5967). Together they form your FrostWeb Tag, which is public everywhere on FrostWeb: websites, launchers, chats, and forums. Your first and last name and your date of birth are private and are not shown to other users.
• Consent Records: We record the time you accepted the Terms of Service and the version you accepted (registration cannot complete without accepting them), and the time you opted in to marketing email, if you ever did. If you never opted in, that record is empty.
• Profile and Addresses: You may add an avatar image, and you may keep an address book (a label, address lines, city, state or region, postal code, country, and a default flag) used for billing and shipping. Both are optional. If you change your email address, the new address must be verified before it replaces the old one.
• Forum Posts and Communications: Content you post on our forums, including threads, replies, private messages, and any other user-generated content.
• Support Requests: Information you provide when contacting our support team, including descriptions of issues, attachments, and communication history.
• Payment Information: Card and bank details are entered on Stripe’s or PayPal’s pages and never reach FrostWeb systems. We store your Stripe customer id; your subscription plan, status, and billing period; your order history (items, amounts, and status); and invoice and receipt references. For PayPal purchases we store the PayPal order and subscription ids.

2.2 Information Collected Automatically

When you sign in to and use our services, the following is recorded automatically:

• Sign-in Activity: Each sign-in creates a record of your IP address, your browser’s user agent string, the browser and operating system derived from it, and an approximate city and country derived from the IP address. These records are kept for 90 days, or for as long as the session they belong to remains active.
• Known Devices: We compare the IP address, browser, and operating system of a new sign-in with your earlier sign-ins. A sign-in that does not match a known device may be asked for a two-factor code again and triggers a new-sign-in email alert.
• Security Data: Whether two-factor authentication is enabled, the time your password last changed, counters of failed sign-in attempts, and any temporary lockout that results from them.
• Audit Log: A log of actions taken on your account, such as changes to your email, password, security settings, or connected accounts, kept for security investigation.
• Gameplay Data: When you play our games, the game servers keep the data needed to run them, such as your characters, progress, inventory, and in-game actions.
• Cookies: The account service sets a small number of strictly necessary cookies to keep you signed in and to protect your account. We do not set analytics or advertising cookies on any FrostWeb website. See our Cookie Policy for the full list.

2.3 Information From Other Services

When you sign in with or link an external account to your FrostWeb account, we receive and store a limited amount of information from that service:

• Google Account: If you sign in with Google or link your Google account, we store your Google account id and receive the email address associated with it.
• Steam Account: If you sign in with or link your Steam account, we store your Steam id and read your entitlements for FrostWeb games from Steam to mark those games as owned on your account.
• Epic Games Account: If you sign in with or link your Epic Games account, we store your Epic Games account id and read your entitlements for FrostWeb games from Epic to mark those games as owned on your account.
• Other Connections: Linking to Discord or Twitch may be offered. When you link such a service, we store the provider’s account id and your public handle on that service.

We only receive the information necessary for sign-in, account linking, and recognising the games you own. We do not access your contacts, messages, or other private data from these services.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Account Creation and Authentication: To create and manage your FrostWeb account, verify your email address, confirm you meet the minimum age, and provide secure sign-in across all FrostWeb services.
• Providing Game Services: To deliver our games and related services, including multiplayer functionality, in-game chat, leaderboards, inventory management, character progression, guild systems, and companion app features, and to show your FrostWeb Tag to other players.
• Purchases and Subscriptions: To process your orders through Stripe or PayPal, run your FrostWeb Premium subscription and its renewals, issue invoices and receipts, show your transactions in the account hub, and mark the games you own on Steam or Epic Games.
• Security and Fraud Prevention: To detect and prevent fraud, unauthorized access, abuse, and other malicious activities. This includes recording sign-in activity, recognising known devices, re-prompting for two-factor codes on unfamiliar devices, and locking accounts temporarily after repeated failed sign-in attempts.
• Communications: To send you service emails, including email verification messages, password reset links, security alerts (such as a sign-in from a new device), purchase receipts, account status updates, and important policy changes. We send marketing email only if you opted in, and you can opt out at any time.
• Diagnostics and Improvements: To diagnose technical issues from server logs and error reports and to improve the stability of our games, websites, and applications. We do not run analytics or advertising trackers on our websites.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests, and to enforce our Terms of Service and other agreements.
• Forum Moderation: To monitor and moderate user-generated content on our forums to ensure compliance with our community guidelines, Terms of Service, and applicable laws, and to maintain a safe and respectful community environment.

4. Information Sharing

We do not sell your personal data. FrostWeb Studios has never sold and will never sell your personal information to third parties for advertising, marketing, or any other commercial purpose.

We share your information only in the following limited circumstances:

• Infrastructure Providers: Google Cloud hosts our services, and Cloudflare provides DNS, content delivery, and security in front of them. Our databases are self-hosted, with encrypted nightly backups kept for 90 days.
• Email Delivery: SparkPost delivers our transactional email: verification links, security alerts, and receipts. SparkPost receives your email address and the message content.
• Payment Processors: Stripe and PayPal process payments and subscriptions. They collect your card or bank details directly on their own pages and share with us only the references described in Section 2.1. Their handling of your payment data is governed by their own privacy policies.
• Sign-in and Game Platforms: When you sign in with or link Google, Steam (Valve), or Epic Games, those platforms authenticate you and we exchange the account identifiers and, for Steam and Epic, the game entitlements described in Section 2.3.
• Google Fonts: The marketing site at frostweb.studio loads its fonts from Google Fonts, so Google sees your IP address when the page loads. The account hub serves its own fonts and does not contact Google.
• Community Forums: Our forums at forums.frostweb.studio run on Discourse, which we host ourselves; it is not a third party. A forum account is created for you automatically when you register, with a handle derived from your FrostWeb Tag.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to comply with legal obligations.
• Protection of Rights and Safety: We may disclose information when we believe it is necessary to protect the rights, property, or safety of FrostWeb Studios, our users, or the public, including to investigate potential violations of our Terms of Service.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.
• Cross-Service Sharing Within FrostWeb: Your FrostWeb account information is shared across our own services to provide a unified experience. Your identity, sign-in status, FrostWeb Tag, and game ownership flow between the account service, the storefront, game servers (such as the Ayndora API), chat services, launchers, the mobile app, forums, and administrative tools. This is what makes one account work everywhere.

5. Data Security

We take the security of your personal information seriously and implement a range of technical and organizational measures to protect your data:

• Password Hashing: All user passwords are hashed using the bcrypt algorithm before storage. We never store passwords in plain text, and we record when your password last changed.
• Token-Based Sessions: We use short-lived access tokens and longer-lived refresh tokens, held in HttpOnly, Secure cookies, to manage signed-in sessions. Tokens are validated on each request.
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using HTTPS with TLS (Transport Layer Security) protocols.
• CSRF Protection: Our web services implement Cross-Site Request Forgery (CSRF) protection using the double-submit cookie pattern to prevent unauthorized actions on your behalf.
• Two-Factor Authentication (2FA): You can protect your account with a TOTP authenticator app. We store the TOTP secret encrypted and your backup codes as hashes.
• Sign-in Monitoring: Repeated failed sign-in attempts lock the account temporarily. A sign-in from a device we do not recognise can require a fresh two-factor code and sends you an email alert. Your recent sign-in activity is visible in the account hub, where you can end any session.
• Backups: Our databases are self-hosted and backed up nightly; backups are encrypted and expire after 90 days.
• Security Reviews: We review our infrastructure, codebase, and operational processes to identify and address vulnerabilities. Reports can be sent to [email protected].

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to implementing and maintaining industry-standard safeguards.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: Your personal data is retained for as long as your account exists. This includes your account details, consent records, addresses, gameplay data, forum posts, and purchase history.
• Sign-in Activity: Sign-in records are deleted after 90 days unless the session they belong to is still active.
• Deleted Accounts: When you request account deletion, your personal data is removed from our active systems within 30 days. Copies in encrypted backups expire after a further 90 days at most. Anonymized aggregated data that cannot be used to identify you may be retained.
• Purchase Records: Order, invoice, and receipt records are kept for as long as accounting and tax law require, even after account deletion.
• Audit Logs: Security-related audit logs, including authentication events, security setting changes, and administrative actions, are retained for security investigation and compliance purposes. These logs may be retained for a longer period to support fraud detection and legal obligations.

7. Your Rights

You have several rights regarding your personal information. You can exercise most of them directly in the account hub at accounts.frostweb.studio:

• Access Your Data: The account hub shows the details, addresses, security settings, connections, sign-in activity, and transactions we hold for your account.
• Correct and Update Information: You can edit your name, date of birth, country, email address (the new address must be verified), avatar, and addresses in the hub. Display name changes are limited to once every 30 days, and your four-digit number re-rolls when the display name changes.
• Delete Your Account: You can request deletion by emailing [email protected]. Deletion is completed within 30 days; backup copies expire after 90 days.
• Export Your Data: You can request a copy of your personal data in a portable format by emailing [email protected].
• Opt Out of Marketing: Marketing email is sent only if you opted in at registration. You can opt out at any time using the unsubscribe link in those emails or by asking [email protected] to clear the opt-in. You will continue to receive essential service emails such as verification links, security alerts, and receipts.
• Manage Connected Accounts: You can link or unlink Google, Steam, and Epic Games at any time in the account hub. Unlinking removes the stored provider id from your account.
• Review Sign-in Activity and End Sessions: The account hub lists your recent sign-ins with browser, operating system, and approximate location, and lets you end any single session or sign out everywhere. If you see a sign-in you do not recognise, end it, change your password, and contact [email protected].
• Two-Factor Authentication: You can enable or disable the authenticator app and regenerate backup codes in the hub. We recommend keeping two-factor authentication enabled.

To exercise any rights not available through the account hub, or if you need assistance, please contact us at [email protected]. We will respond to your request within a reasonable timeframe.

8. Children’s Privacy

FrostWeb Studios services are not intended for children under the age of 13. You must be at least 13 years old to create a FrostWeb account, use our games, access our forums, or interact with any of our services. We collect your date of birth during registration to confirm age eligibility; it is never shown publicly.

We do not knowingly collect personal information from children under the age of 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take prompt steps to terminate the associated account and permanently delete all personal information collected from that child.

If you are a parent or guardian and believe that your child under 13 has provided personal information to FrostWeb Studios, please contact us immediately at [email protected] so we can take appropriate action.

Our practices regarding children’s privacy are compliant with the Children’s Online Privacy Protection Act (COPPA) and applicable regulations.

9. Florida-Specific Rights

As a company based in Florida, we comply with all applicable Florida privacy and consumer protection laws. Florida residents may have additional rights under the following statutes:

• Florida Information Protection Act (FIPA): We comply with FIPA requirements regarding the protection of personal information and data breach notification. In the event of a qualifying data breach, we will notify affected individuals as required by law, generally within 30 days of discovery.
• Right to Know About Data Breaches: If a breach of security affects your personal information, you have the right to be notified in a timely manner. Our notification will include a description of the breach, the types of information involved, and steps you can take to protect yourself.
• Right to Data Security Measures: You have the right to expect that we implement reasonable security measures to protect your personal information. We maintain administrative, technical, and physical safeguards designed to protect against unauthorized access, use, modification, and disclosure of personal information in our custody.
• Florida Deceptive and Unfair Trade Practices Act: We adhere to the requirements of the Florida Deceptive and Unfair Trade Practices Act, which provides additional protections against deceptive or unfair data collection and handling practices. We are committed to transparent and honest data practices as described throughout this Privacy Policy.

10. International Users

FrostWeb Studios is based in Florida, United States, and our services are operated from within the United States. All personal information we collect is processed and stored on servers located in the United States of America.

If you access our services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence. By using our services, you explicitly consent to the transfer of your personal information to the United States and the processing of that information as described in this Privacy Policy.

We strive to apply appropriate safeguards to protect your information regardless of where it originates. If you have questions about international data transfers, please contact us at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will update the “Effective Date” at the top of this page.

For material changes that significantly affect how we collect, use, or share your personal information, we will provide prominent notice through one or more of the following methods:

• An email notification sent to the address associated with your FrostWeb account
• An in-service notification or banner displayed when you next access our services
• An announcement on our website or forums

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our services after any changes to this policy constitutes your acceptance of the updated terms.