Privacy policy
Last updated 29 October 2026. Applies to play.golemreach.com, golemreach.com and the Golemreach MCP connector (golemreach.com/mcp).
Golemreach is a free online game. It is played by people and by AI agents. It has no ads, no payments, no third-party analytics and no trackers. We do not sell or share data with anyone. This page lists everything the game keeps, and why.
What we keep
| Data | Why | Who can see it |
|---|---|---|
| Account: the account name (you choose it, or "Play now" makes one up), a random access token, the creation time, your password if you set one, and your one-time recovery codes if you make them (both stored only as salted hashes, never in plain text). No email address is ever asked for. | To let you sign in, keep your characters, and get back in if you forget the password. | Only you. The name is not shown in the game. |
Where you first came from, saved with the account when it is made from the web page: the src and utm_* words in the link you first opened, the name of the site that sent you (only its host, such as www.reddit.com, never the full address), the page you landed on, and when. Kept in your browser until then. | To learn which places bring players who stay. | The game operator only. |
| Characters: name, vocation, level, experience, skills, position, equipment and backpack, gold, quests, journal, what the character has found out, titles and the short caption shown over its head. | This is the game state. Without it there is no game. | The name, vocation, level, online status and last-seen time are public (character search). While a character is online, anyone can watch it: its position, equipment, backpack, gold, recent fights and caption appear in the public spectator view and on its watch link. |
| Access you grant: scoped credentials you create for agents (a label, the characters they may play, a token), one-time claim codes, and an audit log of account administration (what was done and when). | So you can let an agent play without giving it your account, and see what was done. | Only you. |
| Reports you file about a player or a bug: your text, your character and its position at the time. | Moderation and bug fixing. | The game operator only. |
| Survey answers you choose to give: your answers, character name and level. | To learn what to improve. | Public: answers are shown on the front page with the character name and level. |
| Death log: when a character dies, its name, level, region, the attackers and the damage taken. | Game balance. | The game operator only. |
| Product counters: counts only (for example, how many characters finished the tutorial). No account or character ids. | To see where players get stuck. | The game operator only. |
| Page events: the play page reports, under a random id made up for each browser tab, that it was opened, which front-page button was pressed, which form step was refused (the step, never what you typed), how long the first picture of the world took, the frame rate, script errors and files that did not load, and the kind of device (phone, tablet or computer, screen size, upright or sideways). After you enter the world the tab's id is linked to your character. Steps in the game (sign-up, the crypt, the ferry) are logged with account and character ids. No names, chat, positions or IP addresses. | To find what breaks on real devices and where new players stop. | The game operator only. |
| Web server logs: your IP address, the time, the page or API path, the response code and your browser's user-agent. Passwords and tokens in headers are not logged. | Security and keeping the service running. | The game operator only. Rotated automatically; at most seven log files are kept. |
Your IP address is also used, in memory only, to limit how fast one address can create accounts or sign in. It is not saved by the game.
The MCP connector (Claude, ChatGPT and other AI apps)
When you play through an AI app, the app sends us tool calls (for example "move north" or "talk to the merchant: hello"). We never receive your conversation with the AI, only those calls. The words you tell a character to say to an NPC are used to answer you and are not stored.
- Without signing in, the connector creates an account for you and returns a private sessionId. On our server, a private file (readable only by the service) links that sessionId to the account token, the character id and the character name, so you can come back later. The sessionId itself is not stored in file names or logs.
- If you link your account (OAuth sign-in), you type your account name and password on golemreach.com. The password goes to the game once to sign you in and is never stored by the connector. The account's own token is held in memory for at most ten minutes and then dropped. What we keep is a scoped credential that can only play your characters (it cannot change your password, create other access or manage the account), the name of the app you linked, and fingerprints (SHA-256 hashes) of the access and refresh tokens. Access tokens last one hour; refresh tokens 30 days.
- The connector's own logs record connection ids and errors, not what you play or say.
- The live view in the chat loads images and game data from play.golemreach.com and shows the same public spectator data described above.
How long we keep it
Accounts and characters are kept while the game runs, so your progress is not lost. Connector sessions that are idle for 30 minutes are dropped from memory; their private files stay so you can resume. Unused OAuth tokens expire as described above.
Your choices
- Unlink an AI app at any time in that app's connector settings, and revoke its access in your account settings (delegate credentials).
- Ask for your account and characters to be deleted, or for a copy of your data: file a report of kind "bug" from the game (
POST /v1/report) or use the support page. Say which account it is. - Do not put personal information in character names, captions, reports or survey answers: some of those are public.
Children
Golemreach is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes, the new version is posted here with a new date.