Your data
Privacy
We know you by your Second Life avatar, not by your name or your email. Here is everything we keep, why, who sees it and for how long.
Last updated 27 September 2026.
The short version
- We identify you by your Second Life avatar. We never need your email address, real name, postal address or payment card. The one place you may give an email address is for forum notices, and only if you want them: it goes straight to the forum, and this website does not keep it.
- We set no advertising or analytics cookies, show no ads and sell no data. The only cookies are the ones that keep you signed in and carry you safely between our pages and the game.
- Your character profile is public by default, like a character in a shared world. One switch on your profile hides it.
- You can delete your account from your profile at any time, and ask us for a copy of what we hold.
Who we are
SL Colonies Roleplay is run jointly by Samuel Lison, in Australia, and Jayson Wiggans — known in the game as Drakkhis — our lead developer, in Belgium. We decide together how your data is used and share responsibility for it.
For anything about your data, write to Samuel Lison at [email protected] or to Jayson Wiggans at [email protected]. Either of us will deal with it, and you only need to write once.
Because one of us is in the European Union, EU data protection law applies to us directly, and Belgium’s Data Protection Authority is our lead authority there. We have not appointed a representative in the United Kingdom; if you are in the UK, contact us directly.
What we keep, and why
The legal basis in each row is the one the GDPR asks us to name. “To run the game” means we need it to provide what you signed up for; “our legitimate interests” means we have weighed your interests against ours, and you can object (see Your rights).
| What | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Your avatar: its key (UUID), username, display name and profile picture | You, when you verify your avatar; Linden Lab's public profile page | To know which avatar is yours and show your name and picture | To run the game |
| Your account: which avatars are yours, and your Discord user ID if you link Discord | You | To sign you in and keep your avatars together | To run the game |
| Your character and progress: race, profession, level, stats, inventory, titles, achievements, the names of the recipes you know, colony membership, and your CXP balance on each day it changes | The game, as you play | To run the game and show your character on the site | To run the game |
| Money: memberships, platinum, gems, shop orders, deliveries, Trading Post listings, bids, sales, payouts and refunds, with the amounts in L$ and the Second Life transaction details | You, the game, and our in-world bots | To deliver what you paid for, pay what we owe, and keep business records | To run the game; and a legal obligation to keep tax records |
| Support conversations and the screenshots you attach | You | To help you | To run the game |
| Things you write for others to see: your backstory, realm pages, colony names and descriptions, crate labels, colony chat | You | To show them where you put them | To run the game |
| Sign-in sessions, and short-lived records of repeated attempts (including your IP address, for one hour) | Your browser | To keep you signed in and stop abuse, like someone guessing verification codes | Our legitimate interest in keeping accounts safe |
| That you chatted, and how much, in our Discord, forum chat and Second Life group — never what you said | Our Discord bot, our forum, our in-world bot | To award social points | To run the game |
What we do not collect: your email address, real name, postal address, phone number, payment card details or precise location. An email address you choose to give for forum notices is passed straight to the forum, which keeps it; this website does not. Payments are made in Linden dollars inside Second Life, so we never see how you funded them.
What other people can see
SL Colonies is a shared world, so some of what you do is visible to other players. We show these because a game where you can see who is making, selling and leading things is the game — that is our legitimate interest. You can object to any of them by writing to [email protected].
- Your character profile: your avatar name and picture, race, profession, level, titles, achievements, backstory, and broad bands (never exact figures) for how much you have crafted and learned. It is public until you switch it off on your profile. The leaderboards on Colonists show the top ten on each board, with exact figures; hiding your profile takes you off them too.
- Realm pages: a realm appears only if its owner switches listing on, and shows the owner’s name. Owners can name moderators on their page; if you are named, you can remove yourself from your profile.
- The Trading Post: a crate shows the name of the avatar who made it, and the crate’s own page shows who opened it.
- Sale announcements: when you buy from our shop or one of our vendors, our Discord posts your avatar name, what you bought and where.
- Colonies: a colony’s name, description and crest are public; its members, their chat, and when each was last in-world are visible only to fellow members.
Publicly, we never show your coins, CXP, inventory, or when you were last in-world.
Who receives it
We do not sell your data or share it with advertisers. It reaches these services because the game runs on them:
| Who | What they receive | Why |
|---|---|---|
| Linden Lab (Second Life) | Your avatar key when we look up your public profile; the messages, items and payments our bots send you in-world. Pictures of realms, colonies and crates load in your browser straight from Linden Lab. | Second Life is where the game is played |
| Discord | If you link Discord: your Discord ID alongside your avatar name, membership level and roles; your support tickets, in threads our helpers use; your colony's chat, in its private channel; sale announcements | Our community and support run there |
| Our forum | Your account number, username, display name and profile picture when you sign in; support transcripts in a private archive section; and an email address, only if you choose to give one for forum notices. The forum keeps that address and uses it only to email you notifications, summaries and announcements; you can change it, or switch those emails off, in your forum preferences | The forum is ours, and signs you in through this site |
| Proton Mail | Only if you gave the forum an email address: the forum's notifications, summaries and announcements to you | It sends the forum's email |
| Cloudflare | Every visit to the site passes through Cloudflare's network, including your IP address | It delivers and protects the site |
| Amazon Web Services | Your game data | It hosts the game's database and server |
| YouTube (Google) | On pages with a tutorial video, your browser loads the video's preview picture from YouTube. Pressing play loads the video from youtube-nocookie.com. | Our tutorials are hosted there |
| Our backups | A nightly copy of the website's database and pictures, on a storage device we own | So nothing is lost if a disk fails |
Where it is stored
The website and the forum run on our own server in Australia, and our lead developer works on the game from Belgium. The game’s database is hosted by Amazon Web Services. Cloudflare, Discord and Linden Lab operate internationally, including in the United States. If you are in the European Union or the United Kingdom, you give your data to us directly as someone outside those places; for the services above, we rely on the standard data protection terms they offer.
How long we keep it
| What | How long |
|---|---|
| Your account, avatars and character | Until you delete your account |
| Sign-in sessions | 30 days, or until you sign out |
| Verification codes | 10 minutes |
| IP addresses (in records of repeated attempts) | 1 hour |
| Other records of repeated attempts | 30 days |
| Money records: payments, memberships, orders, Trading Post sales and payouts | 5 years, then kept only without your identity |
| Support tickets and messages | 12 months after the ticket closes |
| Support screenshots | 90 days after the ticket closes |
| Messages our bots send you | 90 days |
| Colony chat | 12 months |
| Your characters' CXP balance, day by day | 24 months |
| Colony invitations | 90 days after they are answered |
| Records of which shops you visited, and cached avatar names | 90 days after they were last updated |
| Announcements our bot has already posted | 30 days |
| A copy of your data that you asked for | 7 days after we make it |
| Your requests for a copy of your data | 12 months after we decline one, or after its copy expires |
| The game's log of in-game actions | 12 months, except the entries a shop's takings and trades are worked out from, and colony rewards, which are kept as long as they are needed |
| Backups | 14 days |
When you delete your account, everything the website holds about you is removed within one month, with two exceptions. Records of money that changed hands are kept with your identity taken out, so a sale or refund can still be checked. And your avatar key is kept for 30 days, so that a new account cannot be made on that avatar by accident in the meantime. Copies in our backups are gone within 14 days after that.
Your rights
Wherever you live, you can ask us to:
- Send you a copy of what we hold about you, in a file you can take elsewhere. Use Request a copy of my data on your profile: once we have checked it, your notifications give you a download link that works only while you are signed in to your account, for 7 days. We never send it by email.
- Correct something that is wrong. Most of it you can change yourself on your profile.
- Delete your account, using the button on your profile, or by writing to us.
- Stop using your data for something, or object to something we do on the basis of our legitimate interests, such as showing your name on a crate or in a sale announcement.
Write to [email protected] with your avatar name. To make sure a request really comes from you, we send a one-time code to your avatar in Second Life, the same way you sign in. We answer within one month, and tell you if we need longer and why.
If you are unhappy with how we handle your data, tell us first and we will acknowledge your complaint within 30 days. You can also complain to the data protection authority where you live: in the European Union, your country’s authority, or Belgium’s Data Protection Authority, our lead authority; in the United Kingdom, the Information Commissioner’s Office; in Australia, the Office of the Australian Information Commissioner.
Cookies and browser storage
Every cookie we set is needed for something you asked for, so none needs your consent. We set no advertising, tracking or analytics cookies.
| Name | What it does | How long |
|---|---|---|
| slc_session | Keeps you signed in | 30 days, or until you sign out |
| slc_oauth_state | Protects your sign-in with Discord | 10 minutes |
| slc_sso_pending | Carries you from the forum's Log In button through our sign-in | 15 minutes |
| slc_crate_pending | Carries a one-time crate ticket from an in-world object to your profile | Up to 1 hour |
| slc_market_pending | Carries a one-time market ticket from an in-world hub | 9 minutes |
| slc_vendor_pending | Carries a one-time ticket from an in-world vendor | Until the ticket expires, usually minutes |
| slc.cart.v1 (stored in your browser, not a cookie) | Remembers your basket while you are signed out | Until you empty it or clear your browser |
Children
SL Colonies Roleplay is for adults, 18 and over, like Second Life itself. We do not ask for proof of age — we cannot check it, and we would rather not hold identity documents — but if we have good reason to believe an account belongs to someone under 18, we may ask the account holder about it, close the account and delete its data. If you think a child is using the game, tell us at [email protected].
Decisions made automatically
We make no automated decisions that have legal or similarly serious effects on you. Some protections act automatically — for example, too many wrong verification codes block further tries for a short while — and a person can review any of them if you ask.
Keeping it safe
Connections to the site are encrypted. Sign-in tokens are stored only as fingerprints, never in a form that could be used to sign in. Access to the databases is limited to the accounts that need it, and screenshots and pictures are stripped of hidden details such as location before they are stored.
Changes to this notice
When we change it, we update the date at the top and announce anything significant in the Herald and on the forum before it takes effect.
The terms of use cover how the game, memberships and the Trading Post work.