XOrA Network

Privacy Policy

Version 2026-09-24. Last updated September 24, 2026.

This notice describes what XOrA Network actually collects through account.xoranetwork.com and the private game server behind it, and what it does with that information. It is a notice. It is not a checkbox that gives away privacy-law rights.

Who operates the service

XOrA Network operates the account website and the Nakama server those accounts talk to. Account data is stored on that infrastructure. Transactional email is sent by Resend from noreply@xoranetwork.com. If you choose Discord sign-in or linking, Discord receives the sign-in request under Discord’s own terms.

Account information

When you create an account with email, the service stores:

Username and display name. On this form the display name starts as your username.
Email address. The site does not treat the address as verified ownership.
Password. Nakama keeps it as the account credential. The account website does not keep a separate copy of the password.
The Terms of Service version you accepted, and the time you accepted it.

You can later add a profile photo. Photos are JPEG, PNG, WebP, or GIF files up to 8 MB, stored on the account server and shown from your profile URL. The profile does not include a location.

Discord

If you create an account or link with Discord, the service stores a Discord identifier so it can recognize that login. It uses the Discord username, and the email Discord returns when one is present, to create or match the XOrA Network account. Google sign-in is not offered.

Social features

While you use the site, Nakama stores:

Friend relationships and friend requests.
Direct messages between friends.
Notifications, such as friend requests, messages, and player reports.
Player reports, including who filed the report, who was reported, and the reason, so moderators can review them.

Security information

If you turn on an authenticator app, the service stores an encrypted copy of the authenticator secret. If you save secret questions, it stores a salted hash of each answer, not the answer itself. Answers are compared without regard to letter case. You choose either an authenticator app or email codes, not both at once. Email codes and password-reset messages are one-time codes sent through Resend. The service stores a hash of an email code while it is waiting for you to enter it, then discards the challenge when it expires or is used.

Three incorrect passwords can lock the account in Nakama. A correct password, or a moderator unlock, clears that lock. Moderators can also reset a password or clear an authenticator.

Sign-in data

A signed-in browser holds cookies for the session, refresh, a cross-site request check, remember-me, and a short-lived two-factor challenge when a code is required. The site uses the request IP address to limit repeated sign-in attempts. Those limits are kept in memory on the account server and are not added to your profile.

The site background video and music player play files that ship with the website. They are not tied to your account.

How the information is used

XOrA Network uses this information to:

Create and sign in to your account.
Show your profile, friends, messages, and notifications.
Send password-reset messages and, if you chose email codes, one-time sign-in codes.
Let moderators review reports and lock, unlock, or reset accounts.
Record which Terms of Service version you accepted.
Protect the service from repeated sign-in attempts.

XOrA Network does not sell personal information and does not run third-party advertising on the account site.

Children

The service is not directed to children under 13, and the registration form is not an age-screening checkbox. If XOrA Network learns that it has collected personal information from a child under 13, it will delete the account and the personal information it holds for that account. A parent who believes that has happened can use the report tools while signed in, or contact the operator through the account that holds the information.

How long it is kept

Account, profile, friend, message, report, and security records stay until you delete the account or a moderator removes them. Deleted information may temporarily remain in backups of the Nakama database and the photo store until those backups are rotated or expire. Email challenges and sign-in rate limits are short-lived. Terms acceptance stays with the account so XOrA Network can tell which version you accepted.

Your choices

You can edit your profile, turn an authenticator app or email codes on or off, replace secret questions, and unlink Discord from Security. You can ask a moderator to unlock an account or clear an authenticator. Deleting the account removes the Nakama account that the site uses for sign-in.

This notice may be updated by posting a new version on this page. The Terms of Service explain the contract for using the account.