Privacy Policy

Effective 27 September 2026 L2 Ovaris Open beta

This page describes every kind of personal data L2 Ovaris holds, why we hold it, and who else can see it. It is written to be read, not to be scrolled past. If something here is unclear, write to us and we will explain it in plain words.

Who runs this service

L2 Ovaris is a privately operated Essence game server and the website at l2ovaris.com. It is run by a small team as a hobby project. It is not a company, and during the open beta it takes no money from players. Payments open at launch.

For anything in this policy, including deletion requests, write to our Telegram bot @L2Ovarisbot (the Support button) or to [email protected].

What we collect

Only what the service actually needs to work. There is no profiling, no advertising, and no data collected "just in case".

Website account Your email address, your website password (stored only as a salted scrypt hash, which we cannot read), and the times the account was created and last used.

Google sign-in If you choose to sign in with Google, we receive your Google account identifier, your email address, and basic profile information. We never receive your Google password. Signing in with Google is optional. Registration with an email and password remains available.

Game accounts The login name and password of each game account you create or link, plus which website account owns it. Characters, progress, inventory and other in-game state are stored by the game server.

Sessions A hash of your session token, the IP address the session was opened from, and its creation and last-seen times.

Security events A log of account-relevant actions — sign-in, sign-out, password change, account creation, failed attempts — with the time, the account involved, and the IP address.

Invite requests If you ask for beta access, we record the request against your account with your IP address and the time. The request is also forwarded to the team's private Telegram group, where it is approved or declined.

Payments If you top up, we store the order: its number, the amount, the coins, and whether it was paid. Card details and wallet keys never reach us. The payment form belongs to the provider.

Referrals, promo codes, wheel Which referral code an account joined on and who made it, the bonus that follows from it, which promo codes an account used, the wheel spins it has and what they won, and the rewards waiting to be sent to a character.

Premium Whether a game account has premium and until when. It is what turns on the premium bonuses and offline farm for that account.

Telegram bot If you link our Telegram bot, we store your Telegram user ID and which website account or game accounts it is linked to. The bot then sends you your characters' state: name, level, location, what they are doing, and farm numbers such as experience, adena and kills per hour. To unlink it, write to support and we remove the link.

Support messages If you write to support through the Telegram bot, we keep the ticket: your message, your Telegram ID and username, and the time. The message is forwarded to the team's private Telegram group so a person can answer it.

Anti-cheat module The game client ships with a small library of ours, and it runs only inside the game itself. About once a minute it sends us: a random number made up fresh each time the game starts, the one-time launch code OvarisUpdater leaves for it when you press Play, the local network addresses of your machine (the ones your router or VPN hands out, such as 192.168.1.4), the name of the program that started the game, whether the game is connected to our server, and the serial number of the system disk volume. Every five minutes it also sends whether a debugger is attached to the game process, and the file names of libraries loaded into the game process that are not on our list of ordinary ones, plus how many there are in total. It reads no other program, no other window, no file of yours, and nothing you type. The same library also holds a keyboard hook, left over from a clipboard-paste feature: it reacts only to Ctrl+V and sends nothing anywhere, but it is a system-wide hook and we would rather name it than have you find it.

Launch check When you enter the world, the server matches your session with those reports. That is how two rules are enforced automatically: the game is started with OvarisUpdater, and one game window runs per computer. Several computers behind one internet connection are fine, one window each. If a check fails, the game tells you why and may close. That is all it does: no ban, no mark on your account. Bans are only ever decided by a person.

Computer identity When you enter the world, the game client reports the local network address of your machine, the one your router handed it, such as 192.168.1.4, together with the first few hops on the way to us. We keep the latest one per game account. We use it for two things only, both of them rules of the game rather than surveillance: one game window at a time per computer, and offline farm working only on the one computer you bind yourself. It says nothing about who or where you are: that address exists only inside your own home network. No hardware details are collected: the client does not send any, and we checked.

Session behaviour When a character leaves the game, the server records how long the session lasted, how many packets it sent and how many different kinds. No content of those packets, and nothing about what you said or bought.

Server logs Ordinary web-server logs: IP address, time, requested address, browser identification. Game-server logs of in-game activity.

Why we collect it

To run your account. Sign you in, connect your game accounts to you, let you change your own passwords.
To keep the service safe. IP addresses and the event log are how we notice a stolen account, a brute-force attempt, or one person quietly opening a thousand accounts. Request limits use the same data.
To reach you. Your email address is used for account matters: password recovery and, rarely, notices that affect your account. We do not send marketing.
To keep the game fair. Game-server logs are how rule-breaking is investigated. The anti-cheat module and the session record exist for the same reason: bot programs run inside a real game client and send real packets, so the server alone cannot tell them apart. No one is ever punished by a report on its own. A report is not proof. It is sent by the player's own machine, so it can be forged or withheld. It only tells us whose account is worth a human looking at, and every decision is made by a person.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing. Five outside services necessarily see some of it:

Cloudflare sits in front of the website as a proxy and handles our DNS and incoming mail. All traffic to l2ovaris.com passes through it, so it sees requests and IP addresses.
Google — only if you choose to sign in with Google. Google tells us who you are; what Google itself records about that is governed by Google's own privacy policy.
Telegram carries everything that goes through our bot: the character updates it sends you, your support messages, and invite requests, which reach the team's private group. Payments in Telegram Stars are made inside Telegram. What Telegram records is governed by its own privacy policy.
KASSA processes card payments, once payments are switched on at launch. The card form is on their side and we never see your card number; we learn that a payment for an order went through, its amount, and the address and phone the payer gave them. What they store is governed by their own privacy policy. The purchase terms describe the rest.
TryBit processes crypto payments, once payments are switched on. The payment page and the wallet are on their side; we learn only that a payment for an order went through and its amount.

Beyond that, we will disclose data only where we are legally required to.

What we do not do

Worth stating plainly, because it is unusual:

No analytics of any kind. No Google Analytics, no counters, no heatmaps.
No advertising and no advertising networks.
No third-party trackers. The only outside resources are the vote buttons of server rating sites at the very bottom of the home page: your browser loads their small images, so those sites see your IP address, as with any visit. Everything else, fonts included, is served from our own server.
No selling, renting or trading personal data. Ever.
No screenshots of your desktop, no reading of other programs, no keystroke logging, and no remote control of your machine. The anti-cheat module looks only inside the game's own process, and section 02 lists exactly what it sends.

Cookies

One cookie, set only after you sign in: it holds your session token so the site knows you are you. It is marked HttpOnly, Secure and SameSite=Lax, and it is scoped to the account area. There are no tracking or advertising cookies, which is why this site shows you no cookie banner.

How long we keep it

Account data — for as long as the account exists, and then deleted when you ask us to delete it.
Sessions — until they expire or you sign out. Signing out everywhere removes them immediately.
Security events and server logs — kept for a limited period for security work, then discarded. Log files rotate automatically.
Invite requests — until the beta ends.
Telegram link — until you ask us to remove it or delete the account.
Support tickets — for as long as they are needed to answer you and keep a record of the answer.
Anti-cheat reports — one month, then deleted automatically. Identical reports are not stored twice.
Launch reports and launch codes — three days. The launch check's decisions — one month.

Progress made during the beta may be wiped before launch; if it is, we announce it in advance. Website accounts are separate from game progress and are not automatically deleted by a wipe.

Your choices

Write to our Telegram bot @L2Ovarisbot or to [email protected] and we will, within a reasonable time:

tell you what we hold about you;
correct anything that is wrong;
delete your website account, your game accounts and the data attached to them.

Deletion is real deletion. What we may keep afterwards is the minimum needed to enforce a ban where an account was removed for breaking the rules. Otherwise a ban would be undone by pressing "delete".

You can change your website password and each game account password yourself, and you can end all your sessions at once, from the account area.

Security, honestly

Your website password is stored as a salted scrypt hash, which is what a password store should look like today.

Read this before choosing a game password

Your game account password cannot be stored that way. The game's login protocol fixes the format, and it is an old and weak one. We did not choose it and we cannot change it without breaking the game client. Treat a game password as something that could one day be exposed: never reuse a password you use anywhere else, and especially not your email password.

Traffic to the website is encrypted. Access to the server is limited to the people who operate it.

Children

This service is not directed at children. If you are under 16, please do not create an account without the consent of a parent or guardian. If we learn that we hold data about a child without that consent, we will delete it.

Changes to this policy

If this policy changes in a way that matters, we will change the effective date at the top and announce it in the update log. We will not quietly widen what we collect and leave you to notice.