Privacy draft

Privacy and security information

This page is a practical privacy summary for the Beta website. It is not a final legal policy and must be reviewed before official launch.

Account data

Seabyss accounts are expected to use PlayFab for account identity. The website should only receive sanitized account information from the Seabyss Web API.

Game data

Profile data can include display name, masked account identifiers, progression, currencies, equipment, and Beta status. Missing fields should be shown as "Not available yet" instead of being invented.

Security principles

  • No PlayFab SecretKey, payment secret, admin token, SSH credential, or password belongs in public HTML, CSS, or JavaScript.
  • Passwords must only be sent over HTTPS to the secured backend API.
  • Session cookies should be HttpOnly, Secure, and SameSite.
  • The public website must never modify currencies, inventory, or purchases directly.

Support contact

Players can contact support@seabyss.com. Seabyss support will never ask for a password.

Legal validation pending

A complete privacy policy, data retention rules, regional compliance review, payment provider language, and incident response wording must be validated before official launch.