KURPrivacy Policy
Last updated: 6 October 2026
This policy explains what personal data we process when you play KUR or visit this website, why, how long we keep it and what your rights are. We collect little: no advertising, no third-party analytics or tracking, and we never sell your data.
1. Who we are
KUR is published by Muraena Games, the trading name of LUANN SILVA UNIPESSOAL LDA, a company registered in Portugal (“we”, “us”). We are the controller of the personal data described here. For anything related to your data, write to hello@muraenagames.com; the person responsible for data protection is the company’s manager, reachable at the same address.
2. Purposes
We process personal data only to:
- run your game account and keep your progress;
- keep the game fair and secure, including detecting automated play and abuse;
- investigate the bugs you report and answer your messages;
- deliver this website and protect it against attacks.
We do not use your data for any other purpose without telling you first and, where the law requires it, asking for your consent.
3. What we collect
| Data | Why |
|---|---|
| Steam identity. Your SteamID, received from Steam when you sign in. We verify the sign-in ticket with Steam and do not keep the ticket. | To create and recognise your game account. |
| Game account. An internal account ID, a hashed session token, your starting hero and language preference. | To run your account and keep your preferences across devices. |
| Game progress. Your save: heroes, items, floors reached, achievements and the log of game commands used to replay and verify progress. | KUR is played online and the server keeps your progress. |
| Play activity. Daily totals per account: number of game commands, timing statistics between them, hours of the day you were active and time connected. | Fair play and detection of automated play (bots). |
| Bug reports you send. The text you write plus automatic context: game version, operating system, language, current floor and screen. No IP address is stored with a report. | To investigate and fix the problem you reported. |
| Messages you send us. Your email address and what you write. | To answer you. |
| Connection data. Your IP address and basic request data (browser or client, time, page requested), seen by our servers and network provider while you play or visit this site. | To deliver the game and this site, protect them against abuse and limit request rates. Not stored in our game database. |
We do not process payment data. Purchases are handled by Valve through Steam under Steam’s own terms and privacy policy. We do not collect sensitive data such as health, beliefs, political opinions or sex life, and we do not ask for your real name, address or phone number.
4. Legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): your account, progress and connection data, which we need to provide the game you chose to play.
- Legitimate interests (Art. 6(1)(f) GDPR): play activity for fair play and security, bug reports and messages to keep the game working, and connection data to protect the website. You can object at any time (see section 9).
- Legal obligation (Art. 6(1)(c) GDPR): when the law requires us to keep or disclose data.
5. How long we keep it
- Account, progress and preferences: while your account exists, and deleted when you ask us to delete the account.
- Play activity: 90 days, then deleted automatically.
- Bug reports: while useful to fix the issue, and no longer than 24 months.
- Messages to us: until the matter is resolved, then deleted, unless we need them to defend a legal claim.
- Connection data: only for as long as our providers keep their security logs.
Deleted data is removed from our database so that it cannot be restored; backups roll over and are not used to bring it back.
6. Who we share data with
We do not sell or give your personal data to anyone. We use these providers, bound by contracts that require them to protect it:
- Valve Corporation (Steam), to verify your sign-in and to record achievements and statistics on your Steam profile.
- Google Cloud, which hosts our game servers and database.
- Cloudflare, which protects and delivers our network traffic and hosts this website.
We disclose data to authorities only when the law requires it.
7. International transfers
Some of these providers may process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.
8. Cookies and local storage
This website sets no cookies of its own and runs no analytics. Cloudflare may set a strictly necessary security cookie to block attacks. The game stores settings and cached content on your device (for example volume, language and window positions); that data stays on your device and you can remove it by uninstalling the game.
9. Your rights
You have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent where we rely on it. Email hello@muraenagames.com and tell us your Steam profile; we may ask you to confirm it is yours. Someone you authorise can also ask on your behalf with written proof of that authorisation. We reply within one month. Deleting your account permanently removes your progress.
If you are not satisfied with our answer, you can complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (cnpd.pt); you can also go to the authority of the EU country where you live.
10. Automated decisions
Our fair-play signals only record and flag patterns for a person to review. No decision that significantly affects you, such as suspending an account, is taken by an automated system alone.
11. Children
KUR is not directed at children under 16, and playing requires a Steam account, which is subject to Steam’s age rules. If we learn that a child has given us personal data, we delete it. Parents can contact us at the address above.
12. Security
- All connections to our servers and this site are encrypted (TLS).
- Session tokens are stored only as hashes, and the game server’s database access is limited to what it needs.
- Only the people who run the game can access the data, and only for the purposes above.
- Our servers run on Google Cloud and Cloudflare infrastructure, which manage the physical security of their data centres.
13. Changes
If we change this policy we will publish the new version here with a new date at least 7 days before it applies, and tell you in the game when the change matters.