Privacy Policy

Exodus2 Online ("we", "us") operates the website exdonline2.com and the Exodus2 Online game for Windows, Android and iOS. This policy applies to both the website and the game.

In short: we collect only what we need to run your account, save your progress and keep the game fair. We do not sell your personal data and we do not show advertising. The game apps contain no advertising, analytics or tracking SDKs. The Android app contains one security component (freeRASP by Talsec) that helps keep the game fair; see section 2.

Account data (you give it to us)

• Account ID and password. The password is never stored in readable form; it is stored as a hash.
• Real name — used only to verify you when you ask for account recovery. It is never shown to other players.
• E-mail address — used to confirm your registration and to send password-reset codes. We do not send marketing e-mails.
• The invite code you registered with (if any) and the date you accepted our rules.

Game data (created while you play)

• Your characters, items, progress, guild, rankings and in-game currency balances.
• Chat messages. Public chat is logged on our servers for moderation and abuse reports. Private messages are stored only while they wait for an offline recipient.
• Voice chat (only where it is enabled): your voice is relayed in real time to the players you talk to. It is not recorded or stored. The microphone is used only while you hold the talk button.

Invites

• If you joined through a friend's invite link, we record who invited whom and the invite reward given to the inviter.

Technical and security data

• IP address, recorded when you log in to the game, register or use certain website features.
• A device identifier: the app sends only a one-way hash of your device ID combined with our app ID, never the raw ID. On Windows the client also reports network adapter information (adapter name, MAC address and local IP). We use this only to enforce bans and fair-play limits, such as how many accounts may play from one device.
• Performance summaries (mobile app): while you are in the game world, the app sends a small performance summary about once a minute: the game zone you are in, frame rate, stutter counts, network rate and latency, graphics tier, device model, OS version, GPU, RAM and app version, together with your account number. It contains no chat, no character name, no real-world location and no device identifier. We use it only to find and fix lag and frame-rate problems.
• Auto-play summaries (Windows and mobile apps): while you are in the game world, and especially while Auto Hunt, Auto Level or Auto PvP is switched on, the game sends a short summary about once a minute together with your account number and app version (in the mobile app, inside the same report as the performance summary): the game zone, your character level, which auto features are switched on and whether premium is active, experience gained, deaths, potions used, and counters and codes that describe the decisions the auto-play made. When the auto-walker gets stuck it also records your approximate in-game position (map coordinates inside the game world). It contains no chat, no character name and no real-world location. We use it only to find and fix auto-play problems.
• Problem reports (mobile app): when you use Report a problem, we receive what you write, a screenshot of the game screen, your account number and character name, your device and app version, frame rate, ping, the zone you are in and a short excerpt of the game log from that session. Nothing is sent unless you press Send.
• Crash reports (mobile app): if the app crashes or stops responding, the next time you open it the app sends us the technical crash report that the operating system prepared for it (on iOS, the Apple MetricKit diagnostic report): the type of crash, the program code locations involved, device model, OS version, app version and the device's region format setting, together with your account number. It contains no chat, no character name, no real-world location and no device identifier. We use it only to find and fix crashes.
• Device security checks (Android app): the app includes the freeRASP security component from Talsec. It checks whether the app has been modified or re-signed, whether a debugger or hooking tool is attached, and whether the device is rooted, an emulator or running a cloned copy of the app. When a check fails, the app sends us which checks failed together with your account number, device model and app version. freeRASP also sends technical data about the device and the app (such as device model, operating-system version, app version and package name) and the check results to Talsec, which provides the component. We use this only to keep the game fair. If a cheating tool or a modified app is detected, the game may close itself. These checks do not access your contacts, photos, messages or location.
• Other game diagnostics are written to a log file on your device only. They leave the device only if you choose to share that file with us for support.

Support

• Messages you send to our support (Discord tickets or e-mail).

What we do not collect

• No advertising identifiers (IDFA / Android advertising ID) and no advertising in the game.
• No access to your contacts, photos, camera or location.
• No tracking of your activity in other apps or websites.
• The microphone is used only for push-to-talk voice chat, and only while you hold the talk button. If you never use voice chat, the game never turns the microphone on.

• To create and run your account, save your game progress and provide the game and website. This is necessary to provide the service you asked for.
• To keep the game fair and safe: anti-cheat, ban enforcement, fraud prevention and moderating chat. This is our legitimate interest and yours.
• To process invite rewards and to keep the records the law requires.
• To send you service e-mails only: registration confirmation and password reset.
• To answer your support requests.

We do not use your data for advertising or marketing profiles.

Where the GDPR or a similar law applies, our legal bases are:

• Contract: account and game data needed to provide the game you signed up for.
• Legitimate interests: security, anti-cheat, fraud prevention and moderation.
• Legal obligation: records we are required to keep by law.

• Your character name, level, rebirth, tribe and PvP statistics on the public rankings. Your guild name and guild master are shown too.
• Rare in-game achievements and player-shop listings may be announced with your character name in our Discord server.
• If you share your invite link, the page it opens shows your main character's name. Players you invited can be seen by you in "My Account". Their character names or a masked account ID are shown.
• Your real name, e-mail address and IP address are never shown to other players.

We share data only with providers that help us run the service. We give each one only what it needs for its task:

Our servers and these providers may be located outside your country. We may also disclose data if the law requires it, or to protect players and the service against fraud or abuse.

The website uses only what it needs to work. There are no advertising or analytics cookies.

On the device, the game stores your settings. If you choose "remember me", it also stores your saved login on your device.

• Unconfirmed registrations: deleted after 30 minutes. Verification and reset codes: expire after 30 minutes.
• Public chat logs: 72 hours. Undelivered private messages: up to 7 days.
• Account and game data: kept for as long as your account exists, so you can come back to your characters.
• Invite reward records: kept as long as needed for fraud prevention and legal obligations, even after the account is deleted.
• Ban and security records: device hashes and IP addresses tied to a ban are kept for as long as the ban applies.
• Performance and auto-play summaries, crash reports and problem reports: kept only as long as needed to investigate and fix the problem, then deleted.
• Device security check results: kept only as long as needed to investigate cheating, then deleted.

You can ask us to:

• give you a copy of your data;
• correct it;
• delete your account;
• stop a particular use of your data.

You can change your password yourself in "My Account".

To delete your account, e-mail contact@exdonline2.com from the e-mail address registered on the account, or open a support ticket on our Discord server. We may ask you to confirm ownership, for example with a code sent to that address.

Once confirmed, we delete the account, its characters and the personal data listed above within 30 days. Invite reward and security records that we must keep (section 7) are the only exception. Deleting your account is permanent, and items and characters cannot be restored.

If you live in the EU, the UK or another region with data-protection laws, you also have the right to complain to your local data-protection authority.

Passwords are stored hashed, and the website uses encrypted connections (HTTPS). Access to player data is limited to the server administration.

No online service can promise perfect security. Please use a password you do not use anywhere else, and never share it. Staff will never ask for your password.

If a data breach affects you, we will inform you and, where the law requires it, the relevant authority.

Exodus2 Online is not intended for children under 13, or under the minimum age for online services in your country. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

We may update this policy when the game or website changes. We will update the date at the top and announce important changes on the website or our Discord server.