Welcome to Oblivion 7.4!

Download Create Account

Last updated: 3 October 2026

This policy explains which personal data Oblivion collects when you use the website and play the game, why, how long it is kept and which rights you have. Oblivion is a private game server run by one person, not by a company. We collect only what is needed to run the game, keep it secure and handle purchases.

1. Who is responsible

The controller of your personal data is the Oblivion team. Contact for all privacy questions and requests: [email protected].

2. What we collect

Your account

  • Account number and password. The password is never stored in readable form, only as a salted one-way hash (bcrypt).
  • Email address, used to recover your account and to contact you about it.
  • The country you choose when you register.
  • Real name and location, only if you enter them yourself in your account settings.
  • The date your account was created and the IP address it was created from.
  • Recovery key status, premium time and shop points.

The game

  • Your characters: name, level, skills, vocation, outfit, items, houses, guild membership, deaths and kills, login times and the IP address of the last game login.
  • Text messages shown to your character in the game (chat including messages from other players, NPC dialogue, looking at things, system messages). The server writes them to a log file per character so we can investigate reports of harassment, scams, cheating and bugs.
  • Posts you write on the forum.

The website

  • IP address, browser type and the pages requested, in the web server logs.
  • Failed login attempts, counted per IP address and account for 15 minutes to stop password guessing. Addresses that attack the server may be blocked for a while.
  • A session cookie that keeps you logged in (see section 8).

Purchases (when the shop is open)

  • What you bought, when, the price and the account it was delivered to, plus the order and transaction reference from the payment provider.
  • Payments are handled by the payment provider. We never see or store your card or bank details.

Cheat and bot detection

To keep the game fair, the game server checks how characters act (for example speed, timing and patterns of actions) to detect bots, cheats and exploits. If we ever add checks that run on your own computer inside the game client, we will describe exactly what they look at in this policy before they are switched on.

Recorded play sessions

When you create an account you agree that we may record your play sessions. A recording contains what your character does and sees in the game while you play, including chat and interaction with other players. Recordings are only used to enforce the Oblivion Rules and to fight cheating, bots and abuse; only the team looks at them, and they are never published or sold. Recordings start when our anti-cheat system is switched on, which will be announced in the news.

3. Why we use it (legal basis)

  • To provide the game and your account (contract, GDPR art. 6(1)(b)): logging in, playing, keeping your characters and items, highscores, recovering your account, delivering purchases.
  • To keep the game secure and fair (legitimate interest, art. 6(1)(f)): protecting accounts, stopping attacks, detecting cheating, bots and abuse, handling player reports, backups.
  • Recorded play sessions (your agreement at registration, and our legitimate interest in a fair game, art. 6(1)(a) and (f)).
  • To follow the law (legal obligation, art. 6(1)(c)): keeping records of purchases as required by Swedish bookkeeping law.

We do not sell your data, do not use it for advertising and do not build marketing profiles.

4. What other players can see

Like on other Tibia-style servers, the website shows character information publicly: name, level, vocation, residence, guild, deaths, the country flag of the account and, if you entered them, your real name and location. On the character page you can hide your other characters and your account details. Forum posts are public.

5. Who else receives data

  • Our hosting provider, which rents us the server the game and website run on (located in France (EU)).
  • Cloudflare, Inc. All website traffic passes through Cloudflare, which protects the site against attacks and runs the "I am not a robot" check (Turnstile) on registration. Cloudflare processes your IP address and technical request data for this.
  • Brevo (Sendinblue SAS, France) sends the website's emails, such as Lost Account codes and recovery keys, so it processes your email address and the content of those emails.
  • Google delivers the fonts the website uses, so your browser sends your IP address to Google when it loads them.
  • The payment provider you choose when buying points (for example PayPal), which receives the payment details you give it.
  • Authorities, only if the law requires it.

Cloudflare and Google are US companies. Transfers to them are covered by the EU-US Data Privacy Framework or the EU standard contractual clauses.

6. How long we keep it

  • Account and game data: as long as your account exists. When you ask us to delete your account, it is deleted within 30 days.
  • Failed login counters: 15 minutes.
  • Web server logs: about 2 weeks.
  • Game message logs: 30 days.
  • Recorded play sessions: 30 days, longer only for recordings needed for an open investigation of cheating or abuse, until it is closed.
  • Backups of the database: up to 30 days, after which they are replaced by newer ones. A few offline archive copies may exist longer until they are replaced.
  • Purchase records: 7 years, as required by Swedish bookkeeping law.

7. Your rights

You have the right to get a copy of your data, to have wrong data corrected, to have your data deleted, to restrict or object to its use and to receive it in a portable format. Send your request to [email protected] from the email address of your account; we answer within one month. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the data protection authority in your own country.

8. Cookies

The website only uses cookies that it needs to work: a session cookie that keeps you logged in and protects forms (deleted when you close the browser), and Cloudflare's security cookies that protect the site against bots. There are no advertising or tracking cookies, so no cookie consent is needed.

9. Children

You need to be at least 13 years old to create an account on your own. Younger players need the consent of a parent or guardian. Players under 18 need a parent's or guardian's permission to make purchases.

10. Security

Passwords are stored only as bcrypt hashes, the website uses encrypted connections (HTTPS), login attempts are rate-limited, access to the server is restricted and the database is backed up regularly. No system is perfectly safe: use a unique password and create a recovery key.

11. Changes

If we change how we use your data, we update this page and the date at the top, and announce important changes in the news.