Privacy policy

Version 2026-11-06d-steam

In two lines

To let you play, we keep your name, your Steam account, and your game save; if you leave it with us, your email too. Other players can also see your name and your Showcase, and the Showcase can be turned off in the settings. We do not sell your data to anyone, we do not profile you, and we do not send you ads. You can delete everything yourself, whenever you want: it disappears from the game immediately, and from the backup copies as they are replaced.

Who processes your data

Reperta is a game made by a single person, not a company: Leonardo Messina, who publishes it under the name OneTap Core. He is the data controller, and you can reach him through the in-game support form or by writing to onetapcoresupport@gmail.com. There is no data protection officer: for an activity like this one, the law does not require one.

What we collect, and why

The character NAME, which you choose: it is used to let other players recognize you, and appears next to your finds and on your listings in the Market. If you change it, we also keep the list of names you have had and the day you changed them: it lets us trace back to you the records written under the earlier name, and keep the name you leave reserved for a few months, so that nobody takes it to pass themselves off as you.

Your STEAM ACCOUNT, which you log in with: from Steam we receive its number, which tells us who you are, and whether you own the game, because those who haven't bought it yet play the demo. When a demo character is about to be created, we also ask Steam how long your account has existed, if your profile shows it: an account younger than 7 days cannot play the demo, to stop those who create them by the dozen. We need that date at that moment, and we don't keep it. When you buy gems, we also receive from Steam the country of your account, because in some countries certain items are not sold.

Your EMAIL, only if you leave it with us: it is optional, even for buying gems, and it is only used to send you the code that confirms it, the confirmation of each purchase with what you accepted, and the notice before we delete your character. It is not used to log in or to recover your character, and we send you nothing else.

The GAME SAVE: what you have found, how much gold you have, which worlds you have unlocked, how long you have played and how long it took for each piece to arrive. It is the game. From everyone's games, taken together, we also measure how long it takes to reach each thing, to fine-tune the game.

The MESSAGES you write to other players, so we can deliver them; your FRIENDS, BLOCKS and TRADES; and the SUPPORT REQUESTS you send us, with the GAME LOG if you choose to attach it: the last lines the game writes on your computer, which may contain the times you played and your Windows user name. If you leave us an email in the support form, we only use it to reply to you.

The LETTERS we write to you inside the game and the MEASURES taken against your character, such as a warning or a suspension, with the date, the reason and the rule: they serve to tell you why, and to answer you if you dispute it.

The REPORTS you make, and those about one of your messages or your name: we explain them in «Reports from players».

Your DECLARATION that you are at least 14 years old, with the day you made it.

The IP ADDRESS of whoever connects, to stop those who try to force their way into other people's accounts, and to count how many demo characters are created each day from the same network: at most 5. That count is deleted after two days.

The TECHNICAL LOG of the connection: one line per minute on how the server is doing, with the name of anyone who was refused a request at that moment. It is used to find faults.

Your GEMS: every time you receive or spend some, what you bought with them, when and at what price. We never see your card details: the payment goes through Steam, and only Steam sees them.

Time zone

Your computer's TIME ZONE, that is, how many hours you are ahead of or behind Greenwich, and when you last changed it: they are used to count the game's hours in your time zone: the evening of the Night Battlefield, the night of the Forest, the Alignment of the Temple and the Hermit's day. They don't tell us where you are: whole countries share the same time zone.

What other players see

Your character's NAME appears next to your rarest finds, on your Market listings, in the Night Battlefield leaderboards, in the monument leaderboards next to the gold you contributed, and among the friends of anyone who adds you.

The Renown LEADERBOARD: every player can see it and search it for a name. You appear there with your name, Renown, position and the day you created your character, even with your Showcase turned off.

Your SHOWCASE: anyone who searches for your name, or has you as a friend, sees your rank, level, class, Renown, how many artifacts you have in your collection, your Night Battlefield podiums and six of your pieces — the rarest, the one with the highest finish, the one with the lowest serial, the best preserved, the first and the latest you found — with their preservation, serial, the day you found them and after how much play time.

The Showcase is on from the start, because showing your collection is part of the game. You can turn it off whenever you like in Settings → Account: from that moment nobody sees it any more and your name no longer shows up in the Showcase search; you stay on the Renown leaderboard, but without the button to open it. Players you have blocked cannot see it, and searching for your name they will not find you among the Showcases or on the Renown leaderboard.

The Showcase contains no email, no messages, no purchases and nothing else: only the game. And we do not store it anywhere: it is rebuilt from your collection every time, so a piece you sell leaves its case on its own.

Steam friends

If you play through Steam, the game reads your list of Steam friends on your computer and sends it to us, so we can tell you which of them play Reperta and let you send them a friend request. We match it against the game's characters and keep only which characters belong to your Steam friends: friends who don't play are discarded right away, without being saved. We rewrite that list every time you open the game or Steam friends, and it goes away if you turn the option off or delete your character.

We show your character's name to your Steam friends who play, and only to them: to show up to someone, each of you has to be on the other's list. The option is on by default and you can turn it off whenever you like in Settings → Account: from then on you don't show up to anyone and we no longer keep your list. People you have blocked can't find you in any case.

We do this to give you the game you asked for, that is, under the contract; for your friends who appear in the list, under our legitimate interest in helping you find each other, which anyone can refuse by turning the option off. The INVITE button opens the Steam window and everything stays there: nothing reaches us.

Private messages, and who looks at them

The messages you exchange with a friend stay between the two of you. There are two exceptions: this one, and reporting, when your friend sends us one of your messages (we explain it in “Reports from players”).

Every new message goes through an automated check that looks for six serious things: grooming of minors, unwanted sexual content, threats, hate, harassment and scams. What reads it is a program outside our server: it is run by Groq, an American company. It receives only the text of the message — not your name, not the name of whoever receives it, not your email, nothing that says who you are — and the terms under which we use it forbid it from doing anything else with it: it cannot train its models on your words, and it does not keep them — not even briefly, not even to look into its own faults, because we have turned on the setting that forbids it: the message goes out, it is read, and nothing of it stays anywhere. Groq is outside the European Union, and we are telling you here so that you know.

If it finds nothing, and it almost always finds nothing, nobody reads that message and no trace of the check remains.

If it finds something, it writes a report with that message, the two names and the reason, and sends it by email to the support mailbox. A person reads it and a person decides: no program blocks, deletes or warns anyone on its own. Reports are deleted automatically after 120 days, on the server and in the support mailbox.

We do this because a game that offers you a private channel and then never looks at whether someone is being hurt in it has chosen not to know. If you would rather not have this, you can simply not use the chat: everything else works the same.

The name you choose, and who looks at it

When you choose your character's name, or change it, an automated check reads it to see whether it might offend someone. It is the same program that looks at private messages, run by Groq under the same terms described above, and it receives the name and nothing else: not your email, not your previous name, nothing that says who you are.

If it thinks the name might offend, it tells you right away, and you decide: another name, or this one anyway. If you keep it, the name is sent by email to the support mailbox, and a person decides. If that person judges it offensive, we immediately replace it with a neutral one, and the next time you log in we ask you for a new one, without charging you anything.

If the check doesn't respond at that moment, the name goes through anyway, and the check reads it as soon as it can: if it thinks the name might offend, the name goes straight to the support mailbox, without the warning, and a person decides, as above.

A name judged offensive stays banned for everyone, forever: we keep the word, and nothing that says who had chosen it. The report is deleted after 120 days, from the server and from the support mailbox. If the check finds nothing, no trace of it remains.

Reports from players

Anyone who plays can report to us a message they received, or another player's name, if they think it goes against the game's rules or against the law; and anyone can also do so by email. A report carries that message or that name, the name of whoever reports and of whoever is reported, the reason chosen from a list and, if the person reporting writes them, their own lines.

It stays on our server, and a person reads it and decides; we tell whoever sent it what was decided. The support mailbox only receives a notice of how many new reports there are and of what kind, with no texts and no names.

We do this because the law requires it for illegal content (Regulation (EU) 2022/2065, Article 16), and to enforce the game's rules. If a report raises the suspicion of a crime that endangers someone's life or safety, the law requires us to inform the authorities (Article 18): in that case we pass on to the police what is needed to understand what happened and who is involved.

Reports are deleted after 120 days, or earlier, if whoever reported or whoever was reported deletes their character.

Who else handles your data

netcup GmbH, in Germany, which hosts the server the game runs on.

Brevo, in France, which delivers our emails.

Groq Inc., in the United States, which runs the automated check on private messages and names, and prepares draft replies to support requests for us: it receives the text of a message, the name you choose or the text of the request, and nothing else, and does not know whose they are. A person reads and corrects the draft before replying to you: no program replies to you on its own. What it does, in full, is written above in “Private messages, and who looks at them” and in “The name you choose, and who looks at it”. The same applies to support requests: it learns nothing from your words and does not keep them.

These three work for us: they process your data only to do the job we ask of them, and cannot use it for their own purposes.

Google, which provides our support mailbox, a Gmail account: it receives your support requests, the reports from the chat and name watchman, which are deleted from there too after 120 days, and, every night, the copy of the gem log. On Google Drive we also keep the database backup copies, encrypted.

GitHub, owned by Microsoft, where we keep the same backup copies, encrypted: GitHub stores the files, but cannot read them.

Valve, with Steam: Reperta is played on Steam, and the Steam account, the purchase of the game and that of gems are processed by Valve, on its own behalf and under its own privacy policy. From Steam we receive only what we need to recognize you, to know whether you own the game, to know that you have paid and from which country you are buying, and, when a demo character is created, how long your account has existed. We send Steam the achievements you unlock while playing, linked to your Steam account, so that it can show them to you.

Groq, Google, GitHub and Valve are American: data that passes through them may leave the European Union.

The AUTHORITIES, when the law requires us to tell them something: the police, if a report or a message raises the suspicion of a crime that endangers someone's life or safety (Regulation (EU) 2022/2065, Article 18), and the authorities that order us to.

Why, and on what legal basis

The law requires every use of your data to have a basis, and we have three.

The CONTRACT, that is, the terms you accept in order to play: the character, the game save, the messages, the Market, trades and purchases are needed to give you the game you asked for. Without a name and a Steam account, the character cannot be created.

A LEGAL OBLIGATION: the confirmation of every purchase on a durable medium, that is the file the game saves on your computer, and the email if you left one with us and confirmed it (Italian Consumer Code, Article 51); reports of illegal content, and what the law requires us to pass on to the authorities (Regulation (EU) 2022/2065, Articles 16 and 18).

Our LEGITIMATE INTEREST, weighed against your rights: IP addresses, the age of the Steam account and the technical log (account security, keeping the demo safe from fake accounts, and faults), the watchman of chat and names and reports about the game's rules (the safety of, and respect for, those who play), letters and measures (enforcing the rules, and answering those who dispute them), measurements on everyone's games (fine-tuning the game), the backup copies, and the acceptance and gem logs (proving what happened, should it ever be disputed). You can object to these uses by writing to us: if we have no reasons stronger than yours, we stop.

We do not ask for your consent: the checkbox on the privacy policy only says that you have read it.

For how long

As long as you have your character, and as long as you enter the game at least once every 2 years: after that, as the terms say, we may delete it. If you delete it, it all disappears from the game immediately: the character, email, messages, collection, and everything else.

A demo character, however, lasts 6 months from when it is created: if you don't buy the full game within that time it is closed, and after another 90 days we delete it, as the terms say. Before closing it and before deleting it, we ask Steam whether you have bought the game. If you had bought gems with that character, though, we don't delete it when the demo ends: it stays closed, and we keep it like any other. While it is closed you can delete it yourself: log in through Steam and, in the box that tells you it is closed, choose to delete it.

For a while it still remains in the backup copies. Of the copies the server makes every day on its own disk, the last 3 are kept and the older ones are overwritten, and of their encrypted versions it keeps 14; of the encrypted ones we take off the server, to Google Drive and GitHub, the last 7 are kept, one a day, plus one for each of the 4 weeks before, and the older ones are deleted. We do not use them to bring back anyone who has left.

Then only three things remain, and they are these.

From the Night Battlefield leaderboards, your placement remains without your name, because it is the record of a competition and deleting it would change the history of whoever came second. From the monument leaderboards you disappear, and whoever was below you moves up.

From the acceptance log, the row WITH your name remains: it says that this name, on that day, read this policy, accepted the terms in that version and declared they were at least 14 years old. We keep it because a row without a name would no longer prove anything, and that log exists to prove that we showed you the rules. We do not use it for anything else, and after 10 years it is deleted.

From the gem log, the rows WITH your name remain: how many gems you received and spent, on what and when — for example a purchase, with its price. We keep them because there may be real money behind those gems, and that log is how we prove what you bought if you, we or the payment processor ever dispute it. Every night a copy of that log arrives by email in the support mailbox, so that it is not lost if the server breaks. We do not use them for anything else, and on the server they are deleted after 10 years.

The rest is kept for less time. The emails we send you stay on the server for 30 days after they are sent, then they are deleted. Reports, both the watchman's and those from players, are deleted after 120 days, from the server and from the support mailbox, where they go to the trash, which empties itself within a month. The technical log of the connection rewrites itself within a few weeks.

What you can request, and how

You can view your data, have it corrected, take it with you, have it deleted, ask us to use it less, and object to the uses we make of it on grounds of legitimate interest. You can do the deletion yourself, in Settings → Account (for a closed demo character, from the box that appears when you log in through Steam): you don't have to ask anyone for permission. For everything else, write to us using the support form or at onetapcoresupport@gmail.com: we reply within a month.

If you think we are mishandling your data, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it), or with the authority of the country where you live.