--- title: "Ace of Spades Revival Privacy Notice" description: "What the Ace of Spades Revival site, accounts, friends, lobbies and official game servers store about you, why, for how long, who processes it, and how to get it deleted." canonical: "https://www.aosplay.net/privacy" markdown: "https://www.aosplay.net/docs/privacy.md" last_updated: "2026-09-29" content_type: "WebPage" keywords: ["Ace of Spades Revival privacy","AoSPlay privacy notice","BattleSpades account data","Steam sign-in privacy","delete Ace of Spades Revival account"] --- # Ace of Spades Revival Privacy Notice > What the Ace of Spades Revival site, accounts, friends, lobbies and official game servers store about you, why, for how long, who processes it, and how to get it deleted. This notice covers aosplay.net, revival accounts, Steam sign-in, friends and lobbies, the server list, progression, the Workshop and Skin Studio, and the official game servers. The service stores as little as it can: it never asks for an email address, a real name, a payment method or a hardware ID. ![Blue Ace of Spades construction blueprint texture](https://www.aosplay.net/game/ui/prefab_selection_blueprint.webp) _Credentials, public profile data, security records and gameplay statistics are stored separately, each for one narrow purpose._ ## At a glance | Value | Meaning | | --- | --- | | NO | email or real name | | NO | ads or analytics trackers | | 1 | cookie, for sign-in | | 30 DAYS | answer to a data request | ## Who runs the service and how to reach us This service is run by the Ace of Spades Revival project. It is a free, non-commercial community project and is not affiliated with Jagex, Valve or the original developers of Ace of Spades. Questions, data requests and deletion requests go through the project Discord: open a ticket or message a moderator and say it is a privacy request. You never need to post personal details in a public channel. ## What the service stores Only what a feature needs. Nothing below is sold, and nothing is used for advertising. - Password account: username (also your nickname), an Argon2id password hash, a hashed recovery code, creation and last sign-in times, and your player identifiers. - Guest profile: a generated Guest-XXXXXXXX nickname and the public half of a random signing key made on your device. The private key never leaves it. - Steam sign-in: your SteamID64 and your current Steam display name. Sign-in happens on Steam's own page; the service never sees your Steam password. - Sessions: a hashed session token, its expiry, a shortened user-agent string and a pseudonymised network address (see the next section). - Friends and lobbies: friend requests and friendships, blocks, lobby membership and invitations, and your presence (online, in a lobby or in a match, and where). - Progression: experience, level, inventory items, crate openings and equipped cosmetics. - Match statistics: per-mode scores and counters reported by game servers, with the server and match they came from. - Workshop and Skin Studio: the files you upload, their titles and descriptions, the author name you give and the account that uploaded them. - Hosted servers: if you register a server, its public IP address, ports, name, map, mode and player count, because that is the server list. - Moderation: bans, their reason and duration, and a log of moderator actions. ## IP addresses and logs The website does not store your raw IP address with your account. Sessions, sign-in events and rate limits keep an HMAC-SHA-256 pseudonym of it, keyed with a server secret: it lets the service spot repeated abuse from one network without being able to read the address back. There are three places where a real IP address does appear. A moderator can ban an address or a range, and that ban stores it. A registered game server's address is published in the server list. And the hosting platform writes ordinary request logs, which include the address and user agent of every visitor. A game server has to know your IP address to exchange game traffic with you. The official servers write it to their operational log together with your nickname when you connect or disconnect. Those logs rotate by size and are used for crash and abuse investigation only. Matches hosted through the relay pass through a relay host, which sees the addresses of the host and the players for as long as the match runs. Community servers are run by their own operators. They see the same information an official server does, and this notice does not cover what they do with it. ## What is never asked for No email address, real name, date of birth, postal address, phone number, payment information or social profile. Guest continuity does not read a motherboard serial, disk serial, MAC address or any other hardware identifier. Raw passwords are never written to the database or to logs. A Steam session ticket from the retail client is validated at the game server and is not stored by the website; only its SHA-256 digest is kept, so the same ticket cannot be replayed. ## Cookies and browser storage The site sets one cookie, aos_session, and only after you sign in. It is HttpOnly, SameSite=Lax and Secure, and holds a random token rather than account data. Moderators get a second, separate sign-in cookie for the admin console. Both are strictly necessary, so there is no cookie banner. Skin Studio keeps your unsaved drafts, your chosen editor mode and the author name you typed in your browser's local storage. That data stays on your device until you publish or clear it. There are no analytics scripts, advertising trackers, social media pixels or third-party fonts. Fonts and images are served from aosplay.net. ## Why the data is used To run what you asked for: signing in, joining servers with the right identity, friends and invites, progression, leaderboards and hosting your uploads. To keep the service secure: rate limits, ban enforcement and investigation of abuse or cheating. And to keep it working: error and crash diagnosis. For visitors in the EU, the UK and similar jurisdictions, the basis is performance of the service you signed up for, and the legitimate interest in keeping a free community service secure and fair. Nothing relies on consent, because nothing optional is collected. ## What other people can see Your nickname, your public player ID, your statistics and leaderboard positions, the cosmetics you have equipped, and anything you publish to the Workshop under the author name you chose. Friends can also see whether you are online, in a lobby or in a match. A Steam-backed profile shows the SteamID64 it belongs to. Your password hash, recovery code, sessions, network pseudonyms, block list and moderation notes are never public. ## Who else processes the data The service uses a small number of providers, each only for the job named here. They process data under their own terms and may do so outside your country. - Vercel: hosts the website and API, keeps request logs, and stores uploaded Workshop files (Vercel Blob). - Railway: hosts the PostgreSQL database that holds accounts, friends, progression, statistics and Skin Studio submissions. - Valve (Steam): handles Steam sign-in, returns your Steam display name, validates retail session tickets, and carries Steam invites and the Steam server list. Only used if you play or sign in through Steam. - Server hosting companies: the official game servers and relay hosts run on rented servers in Europe and North America. - GitHub: hosts the source code and the server downloads. The site links to it; it receives nothing from your account. - Discord: the community chat is a separate platform under Discord's own privacy policy. The site only links to it. ## How long it is kept Short-lived records expire on their own. Account data stays until you ask for it to be deleted. - Guest sign-in challenges and Steam device sign-ins: 5 minutes. - Join tickets for a game server: 10 minutes, and one use. - Sessions: 30 days by default, or until you sign out or change your password. - Server list entries: about 90 seconds after the server was last seen. - Friend and lobby event history: 7 days. Presence: one day after you disconnect. - Account, friends, inventory, statistics and uploads: until deletion is requested. - Sign-in security events and the moderator action log: kept for security review. They have no automatic expiry yet and are removed with the account they belong to where the database links them. - Bans: for their duration, and afterwards as a record of the decision. - Hosting request logs and database backups: for the period set by the hosting provider. ## Your choices and how to delete your data You can ask what is stored about you, ask for a copy, have something corrected, object to a use, or have your account and its data deleted. Where the law gives you more rights than that, you keep them, including the right to complain to your data protection authority. Deletion removes the account, its credentials and sessions, friends and blocks, lobby history, inventory and progression, and its statistics and leaderboard entries. Published Workshop items are removed or made anonymous, as you prefer. An active ban may be kept so it cannot be escaped by deleting and re-registering. Copies in backups age out with the backups. 1. **Ask.** Open a ticket in the Discord, or message a moderator, and say it is a privacy request. 2. **Identify the account.** Give your public player ID or nickname. You will be asked to prove the account is yours by signing in; never send a password. 3. **Get an answer.** Requests are answered within 30 days, and deletion is confirmed when it is done. > **No self-service yet — Deletion is done by a person.** The account page cannot delete an account on its own today, so requests are handled by hand. Signing out, changing your password and removing friends work from your account at any time. ## Younger players The service does not ask for anyone's age and is not aimed at children under 13. A parent or guardian who believes a child has created an account can ask for it to be deleted through the same route. ## Changes to this notice When the service starts storing something new, or a provider changes, this page is updated before the change goes live and the date at the top changes with it. Larger changes are announced in the Discord. ## Frequently asked questions ### How do I delete my Ace of Spades Revival account? Ask in the project Discord (discord.gg/aosbb) and say it is a privacy request. After you prove the account is yours by signing in, it is deleted and you get a confirmation, within 30 days at most. ### Does the site use cookies or trackers? One sign-in cookie, set only after you sign in. There are no analytics, advertising or social media trackers. ### Does guest mode track my computer hardware? No. Guest continuity uses a random signing key generated on your device, not a hardware fingerprint. ### Can the operator read my password? No. Only an Argon2id hash is stored. Recovery replaces the password using a separately hashed one-time recovery code. ### What does signing in through Steam share? Your SteamID64 and your Steam display name. You sign in on Steam's own page, so the service never sees your Steam password, email or friends list. ### Can a game server see my IP address? Yes. Any online game server needs it to send you game traffic. Official servers keep it only in rotating operational logs; community servers are run by their own operators. ## Related reading - [Ace of Spades Revival Player Identity](https://www.aosplay.net/account) ([Markdown](https://www.aosplay.net/docs/account.md)) - [A master server for reconnecting the community](https://www.aosplay.net/master-server) ([Markdown](https://www.aosplay.net/docs/master-server.md)) - [Ace of Spades Revival Credits and Licences](https://www.aosplay.net/credits) ([Markdown](https://www.aosplay.net/docs/credits.md)) --- Source: [Ace of Spades Revival Privacy Notice](https://www.aosplay.net/privacy) Maintained by Ace of Spades Revival contributors.