What we collect, and what we don't.

1. What this is about

Lumenia Reborn is a community project. This notice explains the data that arises when you visit this site and when you use an account, and how to turn off the measurement of site use.

2. Measuring how the site is used

We measure how the site is used so that we can improve it. For this, PostHog runs on a server of our own. No external analytics service receives this PostHog event stream; a counting script of the toplist CountUser runs separately from it and is described in section 10. The measurement is on by default. You can turn it off at any time (section 4). If your browser sends “Do Not Track” or “Global Privacy Control”, it starts off, unless you explicitly turn it back on (section 4); then your explicit choice applies.

What is collected: pages viewed and when, the approximate time spent, clicks on links and buttons (which link, without any input), performance figures of the site (load time, response time, layout shifts), rough device and browser details (browser, operating system, device type, screen size, language, time zone), the approximate area of origin (section 6) and the page you came from. Addresses are shortened before sending: parameters and add-ons are dropped, only campaign details such as utm_source and a short origin code (ref) stay.

While the measurement is on, the site recognises you on later visits: visits over several days are merged under a random identifier into one pseudonymous website profile, including where your first visit came from (campaign details and referring page). This profile contains neither your name nor your e-mail address. If the link you came through carries a source code (for example ?ref=…), we record it only if it is one of our fixed short names for lists and channels; any other value is not taken over and is only counted as “unknown”. While the measurement is off, the code appears only on the first page view and is not stored on your device.

Recording of your visit: while the measurement is on, we record your visit as a short film of the page, to see where visitors get stuck. What is recorded: mouse movement, clicks, scrolling and the structure of the page. What is not recorded: input (forms and input fields are missing from the recording entirely), the text of the pages (it is replaced by placeholders), your account name and every page around your account (sign-in, registration, password, account, support, vote). The recordings are kept on our own server and deleted after 30 days. If you turn the measurement off (section 4), recording ends immediately, and your earlier recordings are deleted with your deletion request. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is recorded, unless you explicitly turn the measurement back on (section 4).

3. Cookies and storage of the measurement

While the measurement is on, the site stores the following in your browser. Everything belongs to this address, except the cookie lr_consent; the last two entries are created by the counting script of a toplist (section 10).

• ph_phc_wTJkeyft4vLm5nReBy3WPagRMtzfZ4A8gUQ8a38NXwLz_posthogCookie. The random identifier so the measurement recognises you on later visits, plus session and where your first visit came from. Valid only for the address on which you open the site. Lifetime: 365 days.
• ph_phc_wTJkeyft4vLm5nReBy3WPagRMtzfZ4A8gUQ8a38NXwLz_posthoglocalStorage. A copy of the same details, until you turn the measurement off or clear the storage yourself.
• ph_phc_wTJkeyft4vLm5nReBy3WPagRMtzfZ4A8gUQ8a38NXwLz_window_id ph_phc_wTJkeyft4vLm5nReBy3WPagRMtzfZ4A8gUQ8a38NXwLz_primary_window_exists ph_phc_wTJkeyft4vLm5nReBy3WPagRMtzfZ4A8gUQ8a38NXwLz_posthog ph_phc_wTJkeyft4vLm5nReBy3WPagRMtzfZ4A8gUQ8a38NXwLz_session_registered_propertiessessionStorage. Assigns the tabs of your browser to one session. Valid until you close the tab.
• lr_consentlocalStorage. Remembers only your explicit choice to turn the measurement off or back on. No expiry; you can delete the entry yourself.
• lr_consentCookie, valid for all addresses under lumeniareborn.com (the shop too). Holds only the same choice as the entry above: version, off or on, and the time, for example 1.denied.1760400000000; no identifier and nothing about you. Set when you explicitly turn the measurement off or back on, and on your next visit if you had chosen earlier. Lifetime: 365 days; you can delete it yourself.
• lr_reportedlocalStorage. Only after a sign-in, when the measurement is off in your browser or the account knows it as off: remembers that your opt-out has been reported to, or confirmed by, that account, so it is not reported again at every sign-in. If the account knows your opt-out from another browser, it turns the measurement off here too. Holds a random salt and, per account, a check value derived from it (32 characters, no account name in plain text), at most 10 entries. Deleted when you turn the measurement back on; you can delete the entry yourself.
• cu_last_f5696c436a7d704f2d6f25b3e09bc613Cookie, set by the counting script of the toplist CountUser (public pages only, section 10). Remembers when a visit was last counted. Lifetime: 3 hours.
• cu_session_f5696c436a7d704f2d6f25b3e09bc613localStorage, also from the counting script of the toplist. A random session identifier with no link to you. No expiry; deleted when you turn the measurement off, or you delete it yourself.

While the measurement is off, it stores none of this, apart from the lr_consent note (storage and cookie) after your choice and, if you sign in, the lr_reported note. It then works only with a random identifier in the memory of the open page and does not recognise you.

4. Turning off the measurement and deleting data

With the switch below, which is also in the footer of every page, you turn the measurement off. This is what happens: as its last event, the site sends the notice “measurement withdrawn” with your previous identifier, and a deletion request with the same identifier. It then deletes the cookie and storage of the measurement as well as the two entries of the toplist counting script (section 10), assigns a new random identifier that is not connected to the old one, and no longer measures in a recognisable way. Your deletion request is carried out in the analysis.

An explicit “turn back on” takes precedence over your browser’s signal. Access to or deletion of your earlier data without the switch is available through the Discord (section 12); give us the identifier the switch shows you.

5. Link to your account

If you create an account or sign in while the measurement is on, the site sends your measurement identifier to the account service, and at registration also where your first visit came from (campaign details such as utm_source and the referring page as a domain). The account service uses this only to connect your website profile in the measurement with the pseudonymous account events from section 8; these details are not stored in the account database. The connection runs through the pseudonym, not through your account name or e-mail address. If the measurement is off for you, none of this is sent.

6. What we do not do

Input in forms (account name, e-mail address, password) is never collected, not even in the recording of your visit (section 2). Your IP address does not reach the storage of the measurement, not even truncated: at the entry point of the measurement it is replaced by a placeholder address that is the same for all visitors from the same country, before anything else happens to it. The country of origin is determined by the upstream service (Cloudflare); from the placeholder address the measurement derives only the country of origin, no region and no city. No address of a visitor is held in the analysis or in the technical buffer, not even a truncated one. The server logs of the measurement contain no IP addresses of visitors, not even truncated ones. The browser identifier (user agent) is evaluated only at the moment of the request at the entry point, to tell automated access (search-engine crawlers, scripts) apart from visitors; it is not stored. Only “automated yes/no” as well as browser, operating system and device type are stored, and the browser itself supplies these three.

7. Retention

The raw measurement data, the website profiles and the pseudonymous account events from section 8 are deleted after 12 months.

The recordings of your visit (section 2) are deleted after 30 days. A deletion request under section 4 overwrites the content of your recording sooner.

What remains briefly after a deletion (measured upper limits, no promise beyond them): The recording file itself stays until the 30-day period ends, because it can also contain sessions of other visitors; the content of your session in it is overwritten. Short-lived caches of the measurement system can hold identifiers for up to about 8 days. The backups of the measurement are made daily and overwritten after ten days at the latest; if a backup fails, the last copy is kept longer, until the next successful backup. Deleted or withdrawn data disappear from the backups once they are overwritten. There is no copy outside the server.

8. Account and gameplay

When you create an account we store your account name, e-mail address, credentials as well as your characters and progress. We use them only to run the game: signing in, confirmation and reset e-mails, help with questions. Account name, e-mail address and credentials do not flow into the measurement. To fend off abuse (very many attempts in a short time) the account service briefly holds the IP address in working memory. When you sign in to the game and when you trade in the game, the game server stores your IP address for security and abuse prevention (for example bans and detecting multiple accounts) for 30 days; after that it is deleted.

If you arrive through a partner's link (for example ?ref=…), the account service stores the short name of that link with your account at sign-up, to settle the partnership. This only happens while the measurement is switched on; if you switch it off, the entry is deleted. It is deleted after 120 days at the latest.

There is one exception, and it is pseudonymous: the account service reports three events to the same measurement on our server: account created, account confirmed and first sign-in to the game. The identifier is a pseudonym, a string calculated from the account name and a secret key. Account name, e-mail address and IP address are not transmitted. The pseudonym can be linked to an account only with the key; we keep the key apart from the measurement data (on the account server and in our password vault). Purpose: counting how many accounts are created, confirmed and actually played. These events are deleted after 12 months.

9. What the site stores in your browser to work

After you sign in, the site sets a session cookie so you stay signed in (up to 7 days). Your browser also remembers the chosen language and a few progress hints in the account area locally. This serves only the function of the site and is not part of the measurement. Apart from the cookies and storage entries named in this notice (sections 3 and 9), the site sets no others.

10. Delivery of the site

The site is delivered through an upstream protection and delivery service (Cloudflare). Like any such service, it processes connection data such as the IP address as a technical necessity. The site loads its fonts from its own domain.

Links to Discord and to server lists lead to third-party services; their notices apply there.

Counting for a toplist: while the measurement is on, the site loads a counting script from countuser.com on public pages (not on account, sign-in, vote and support pages, and not when the address carries parameters). CountUser runs the toplist we are listed on. The script comes from CountUser and runs on our site. At most once every three hours it sends the address of the page you opened, a random session identifier and our identification code to countuser.com; CountUser also learns your IP address in the process. Purpose: CountUser counts the visitors for its ranking. The script creates the cookie and the storage entry from section 3 for this. If you turn the measurement off (section 4), or your browser sends “Do Not Track” or “Global Privacy Control”, the script is not loaded, or is removed at once, and its two entries are deleted. If you move to such a page within the site, the counting script is removed at once and not requested again. One limit remains: if you move at the very moment the script is still loading, it can run with the then-current address of that page (including parameters) and send it once; we cannot stop a script from CountUser from the outside. What CountUser does with the data is governed by its own privacy notice.

If you go from the vote page to GameTop, TopG, GTOP100, MMTOP200, MMOHUB or PSW while signed in, we pass your account name in the link so the vote can be credited to your account. The site then reports the account name and IP address of the vote to us, GameTop also the time, GTOP100, MMTOP200 and PSW also whether the vote was valid. For RealmRanking (button on the vote page) you enter your account name there yourself when you vote; RealmRanking then reports the account name, IP address and time of the vote to us. We do not store the IP address in plain text, only as a non-reversible check value used to detect repeated votes.

If you go from the vote page to RaGEZONE while signed in, we also pass your account name in the link. RaGEZONE then reports only the account name and the month of the vote to us, no IP address. There, one vote counts per month.

X100TOP, VTOP100 and ServeurListe send no report. There we only ask once you press “Check my vote” on the vote page while signed in. For this, when you click the vote button we note in your session when you pressed it. We send your account name to X100TOP; VTOP100 receives it in the link and in our request. ServeurListe knows no names: we send it the IP address you are currently using with us, and the site tells us whether a vote came from that address. Here too we store the IP address only as a non-reversible check value.

11. Shop and payment

You reach the shop at shop.lumeniareborn.com. You sign in there with your game account; shop accounts are game accounts. The shop sets no cookies of its own. Your sign-in to the shop is kept for only 15 minutes in your browser’s session (sessionStorage) and disappears when you close the tab.

Payment goes through Paymentwall. Paymentwall receives from us a shop pseudonym as customer identifier (not your account name, not your email address), the order reference, the name of the package and the price. You enter your payment details directly in Paymentwall’s window; we never see them. Paymentwall also collects IP address and device data there for fraud checks. What Paymentwall does with them is governed by its own privacy notice.

Your choice about the measurement (sections 2 to 4) applies in the shop too, and you change it with the same switch. The shop currently sends no events to the measurement; it only reads the cookie lr_consent, which holds your choice.

12. Contact

Questions about privacy, and requests for access, objection or deletion, reach us through the switch in section 4 (it shows you your identifier), through the official Discord, or by e-mail to [email protected]. Give us the identifier the switch shows you: with it we find your data.

Go to the official Discord