A quick explanation for younger visitors
You can look around this website without an account. Accounts are available only to people aged 16 or over. If you create one, we need an email address to make sure it belongs to you, a password to protect your account and your truthful confirmation that you are at least 16. If you are under 16, please do not register.
We do not show your email address or password to other visitors, and we do not ask for a parent or guardian's email address. We do not use your account to send advertisements or track you for advertising. You can download your account information or delete your account in the Account panel after confirming your current password. You can also contact us to ask what we hold or request deletion; a parent or guardian may help you exercise your rights where appropriate.
Who is responsible
Objective Online Company S.R.L. is the controller of personal data used to operate The Worlds of Origin website and its accounts. CUI: 38481980. Trade Register: J2017019036407. Registered office: Str. Iani Buzoiani nr. 3, bl. 16, sc. B, ap. 73, Sector 1, Bucuresti, 011571, Romania.
For privacy questions and requests, email mail@objective.srl. You do not need to create an account to read this notice or contact us.
Browsing the website
Our hosting service receives information needed to deliver pages, including your IP address, the requested address, request time, browser information and the result of the request. We use operational and security logs to keep the website available, investigate faults and prevent abuse. This supports our legitimate interests in operating a reliable and secure service.
The public website does not use advertising cookies, audience analytics, social-media pixels or embedded third-party videos. Server health monitoring measures our infrastructure; it does not record your activity inside the game. The public game and gameplay analytics are not available yet.
Creating and using an account
When you register, we use your email address, a protected password hash, an internal account identifier, registration and verification times, account status, and records of your terms acceptance and declaration that you are at least 16. We do not currently collect your country, exact age, date of birth or identity document during registration.
We use this information to provide the account you request, verify that you control the email address, sign you in and help recover access. The legal basis is taking steps at your request and performing our account agreement. The email address and password are necessary for an account; you can browse the public pages without providing them.
We also use short-lived session identifiers, verification or password-reset tokens, and limited records of attempts to prevent misuse. Security measures and restricted administrative records support our legitimate interests in protecting accounts. We do not keep your password in readable form or send it to our email provider.
Protecting account information
We use HTTPS to protect connections to the website, restricted access to private account records and one-way password hashing. Our account service and email delivery provider need to process your email address to verify it and deliver necessary messages. Account records are not currently encrypted with a key that only you hold. We limit access to the people and services needed to operate and protect your account.
Account emails
Brevo delivers verification, password-reset and other necessary account messages on our behalf. We provide the recipient address and the message content needed for that email. Brevo processes delivery and operational information to deliver messages and protect its service. Account emails can include a shared illustration hosted on our website. If your mail app loads it, our hosting service receives an ordinary image request; the illustration URL has no account identifier.
Registration is not a newsletter subscription. We do not use account verification emails for marketing. We do not use email engagement information to personalise advertising or build player profiles.
If you contact us
We use your address, message and relevant account details to answer you and resolve the matter. The basis is our legitimate interest in responding to enquiries, our account agreement when the request concerns that agreement, or a legal obligation when you exercise a statutory right. Please send only the details necessary for your request.
Who can receive information
Access is limited to people who need it to operate the service, answer requests or investigate security problems. Google Cloud provides hosting, backups, logs and infrastructure monitoring. Brevo provides transactional email delivery. Our email service processes correspondence you send to our contact address. These providers receive the information required for their respective services.
We do not sell personal information. We may disclose relevant information to professional advisers or authorities when legally required or necessary to establish, exercise or defend legal claims.
Where information is processed
Our main application server is hosted in Google's Belgium region and its scheduled disk backups use European storage. Providers may also process limited information outside the European Economic Area, for example through support and subprocessors. European storage alone does not mean that every operation stays within Europe.
Where a transfer requires safeguards, we rely on the applicable provider agreement and a lawful transfer mechanism, such as an adequacy decision or the European Commission's standard contractual clauses. You can ask us for information about the safeguards relevant to your data and how to obtain a copy, with confidential information protected where necessary.
How long information is kept
- Verified account records: while your account remains open. You may request closure at any time. Limited information may be retained afterwards where a legal obligation or a specific unresolved claim requires it.
- Unverified registrations: deleted by routine cleanup after 30 days without email verification.
- Account sessions: expire after 30 minutes without activity or 12 hours from sign-in, whichever comes first.
- Verification links: valid for up to 24 hours; password-reset links are valid for up to one hour. Replaced or used links stop working.
- Abuse-prevention counters: removed during routine cleanup once the relevant limit period has been expired for 24 hours.
- Completed account-email jobs on our server: removed after seven days. Restricted administrative audit records are kept for 90 days.
- Routine web and system logs: removed through the server and hosting service's log rotation. Entries retained separately for a specific security incident or claim are restricted to that purpose and deleted when the investigation or applicable legal retention period ends.
- Brevo transactional delivery records: used for message delivery, troubleshooting, abuse prevention and sender reputation. Provider retention and deletion controls apply; a request to us can include the relevant delivery records held on our behalf.
- Support correspondence: kept while the enquiry remains open and for any continuing account issue, legal obligation or claim that requires the correspondence. We review resolved enquiries and remove information no longer needed for those purposes.
- Routine backups: rotate over 14 days. Information removed from active systems can remain in a restricted recovery copy until that copy expires. Where a specific incident requires a recovery copy to be retained longer, it is kept only for that purpose and reviewed for deletion.
Requests to erase information also cover relevant service providers. If a backup is restored, deletion requests must be applied again before the restored data returns to ordinary use.
Your choices and rights
You can download your account information or delete your account in the Account panel after confirming your current password. Deletion removes your active account, verification/reset links and queued account messages, and ends all sign-in sessions. A message already being sent cannot be recalled. Restricted backups, operational logs and email-provider records follow their separate retention periods; contact us for requests covering those records. You can also ask to access or correct your personal data, erase it, restrict its use, or receive a portable copy where the legal conditions apply. You can object to processing based on legitimate interests because of your particular situation. Where we rely on consent for a future optional feature, you may withdraw it without affecting earlier lawful processing.
Email mail@objective.srl. We may need proportionate information to confirm your identity. We normally respond within one month and without charge. If a lawful extension or exception applies, we will explain it. You may complain to Romania's ANSPDCP or the relevant supervisory authority in your country, and you may seek a judicial remedy.
Children and automated decisions
We do not offer accounts to people under 16. If you believe an account belongs to somebody below that age or that an age declaration is incorrect, contact us so we can investigate, restrict the account and remove information where appropriate. Privacy protections also apply to account holders who are 16 or 17.
We do not use personal data for decisions based solely on automated processing that have legal or similarly significant effects. Automated rate limits can temporarily restrict repeated requests to protect the service; contact us if you believe you have been blocked incorrectly.
Future features
Purchases, gameplay analytics and public game saves are not part of the current public service. Before introducing features that change how personal data is used, we will update this notice and provide any additional information or choices required. External websites you visit through our links have their own privacy practices.