Privacy Policy

Effective October 18, 2026. The Plane of Tara is operated by MSage. Email [email protected] with privacy or account requests.

Who can play

The game is for people aged 13 and older. We ask new players to confirm eligibility. We do not ask for a birth date or collect identity documents. If we learn that an account belongs to someone under 13, we will stop providing access and delete its personal data unless a legal obligation requires otherwise.

Data used by the game

Registered accounts use a username, email address, password hash, display name, and account identifiers. Google sign-in, when available, uses the Google account identifier, email address, and display name returned by Google; we do not receive the Google password. Guests receive a temporary account identifier and numbered display name. We store each player's profile bio and icon, equipped avatar, creations, island settings and placements, inventory, friendships, preferences, explored map areas, and age and terms acknowledgments. Chat is visible to people on the same island. The server stores recent chat to deliver it and removes chat records older than 24 hours. Moderation and operational logs can contain usernames and chat messages and are accessible to the game operator. The server records an account's last IP address for security and IP bans.

Purchases and Shards

The shop stores Tara Shard balances and a ledger of purchases, spending, grants, collections, and gifts, plus owned digital items and wish lists. Stripe handles card entry and payment processing. We receive payment status and a Stripe Checkout reference to credit a purchase; we do not store full card numbers. Stripe processes the checkout information you provide under its privacy policy.

Why we use it

We use this data to sign players in, run the shared world, save their work, deliver purchases, show friends and profiles, respond to support and privacy requests, and protect the service from abuse. We do not run advertising, sell player data, or send marketing emails from the game. Players choose what they put in public profiles, chat, and creations; other players can see that content.

Services and storage

Game data is held in a SQLite database on the AWS Lightsail game server. Cloudflare routes and protects web traffic, forwards mail sent to [email protected], and runs cookieless Web Analytics for page-view and performance metrics. Resend processes email addresses and delivery details to send account verification and password reset messages. Google Identity Services loads on the sign-in screen when configured and may receive browser information. A nearby active TV loads YouTube's privacy-enhanced embedded player and starts muted; players can enable sound. Radio audio is paused while music rights are reviewed. These providers have their own privacy practices: Cloudflare, Resend, Google and YouTube. Browser storage remembers the cookie notice choice, settings, and optional home-screen suggestion dismissal; an essential session cookie keeps the player signed in.

Retention and choices

Accounts and creations remain until the account or content is deleted. Unused guest accounts are removed after their 90-day session expires and the server is restarted. Operational logs, including the dashboard chat feed, are normally pruned after 24 hours. Records of moderator item removals remain with the account until that account is deleted so we can apply the repeat-infringer policy. Players can change their display name and bio in Profile, and can request account and data deletion in Settings → Account. Deleting an account removes its game database records and created islands and items; other players' copies or screenshots outside the game cannot be recalled. Stripe and other providers may retain payment, security, or delivery records as required by law or their own policies. Email [email protected] for access, correction, or deletion requests. We may need to verify ownership before fulfilling a request.

Security and changes

Passwords are stored as hashes; session cookies are HttpOnly and SameSite=Lax. No online system is risk-free. We may update this policy when features or hosting change and will post the revised date here.