Privacy policy

Who we are

Kingdom Connect (kc.vaeleen.com) is the private gathering place for the players of New Valek, in the world of Vaeleen. It is run by The Sphinx Hosting and Game Mastery LLC (“we”) in Arizona, USA. This page explains what the site keeps about you, who can see it, and how to have it removed. Questions go to info@thesphinx.co.

Signing in with Google

Members sign in with Google. When you do, Google tells us your name, your email address and whether Google has verified it, and your Google account’s permanent ID. We ask Google for nothing else: not your password, contacts, files, calendar or photos.

We use this only to recognize you when you sign in and to show the kingdom’s staff who is asking to join. Your Google name becomes your display name on the site, and staff can correct it. Staff can see your email address; other members cannot.

We do not sell information from Google, use it for advertising, or share it with anyone. Kingdom Connect’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Joining

Your first sign-in sends a sign-up request, with your Google name and email address, to the kingdom’s staff (its GMs, AGMs and the site administrator). No account exists until one of them approves it. If a request is declined, we keep it so that trying again doesn’t notify staff again; ask us if you want it deleted.

What you share on the site

The site keeps what you add to it: your profile, biography and characters, posts, comments and reactions, photos and albums, events and replies to them, group memberships, Archive entries, Market listings and messages. Since October 17, 2026 that includes your answers to events (Going, Interested or Can’t go) and invitations, polls and your votes, tags of members in photos, shares of posts and pinned posts. Since Kingdom Connect v1.5.0 it also includes cover photos on profiles and characters (seen by every member, like profile pictures), pinned comments, link previews in posts and comments, and the posts and events you save for later: what you saved, shown under Saved, is seen only by you, and goes when the post or event is deleted. Since v1.5.1 each character also has a character sheet (race, class, faction, patron god, play style, armor, weapons, abilities, professions, gear and build notes), seen by every member like the rest of the character. Only you, and the site administrator, can change your profile, characters, posts, comments, events and listings.

The community is visible only to signed-in members. Who sees each thing depends on where you put it: posts on your wall reach every member, group posts reach every member unless their writer keeps them to the group (then that group and the staff), messages reach the people in the conversation, and Archive entries reach the audience chosen for them. Staff also see what they need to run the kingdom, such as membership, events, attendance and Coin. The site administrator can reach everything on the server in order to keep it running and safe.

Whoever can see an event sees who is going, interested or can’t go; whoever can see a poll sees who voted for what; and whoever can see a photo sees who is tagged in it. Anyone tagged in a photo can remove the tag. The site tells you in its notifications when someone comments on, reacts to or shares what you posted, tags you in a photo, invites you to an event, or when an event you are going to is a day away.

Photos are re-saved when you upload them, which removes hidden details such as where a photo was taken.

Messages and safety

Since October 14, 2026, private and group chats are end-to-end encrypted. Your browser locks each message, picture and edit before it is sent, and only the people in the chat can unlock it: we store and deliver what we cannot read, and so does the site administrator. Each member has a key made on their own device; we keep it only locked with their secret phrase, which never reaches us, so that they can unlock their messages on another device. We cannot recover a forgotten phrase. To deliver messages we still see who is in each chat, who sent each message and when, and reactions, read receipts and typing.

If you block someone for 30 days, you may include your chat’s latest messages in the report. Each is checked against what was sent, and only those messages are shown to the site administrator, to look into the report. Feature requests and bug reports are sent to staff and are not encrypted.

Messages sent before October 14, 2026 are stored as they were sent, without end-to-end encryption. When one of them is edited or deleted, its earlier versions and deleted text are kept, and only the site administrator can review them, only to look into a report, a block between members or another safety concern. When you remove an encrypted message, its encrypted words and pictures are deleted.

Coin, the Market and attendance

Coin transactions and receipts are permanent: they cannot be edited or deleted, so every balance can always be checked. Staff record event attendance and Levels. The site never holds real money or sees card or bank details. A Market listing priced in US dollars is paid directly between the members involved, often with PayPal, as described next.

PayPal in the Market

If you add your PayPal.me link in Settings → PayPal, we keep it, with the date you set it, so that buyers of your USD listings can pay you. Like any PayPal.me link it is public on PayPal’s side, and members who pay you see it. Only you can set, change or remove it, and each time you confirm that it is your own PayPal account. We record each change (the link, and when) so that every payment can be traced to the link its seller chose. Removing it stops new payments to it at once.

When you choose Pay with PayPal, your browser opens the seller’s PayPal.me page with the price in the address. You pay on PayPal’s site, from your PayPal account to theirs, under PayPal’s own privacy statement. Kingdom Connect has no PayPal account or connection: it tells PayPal nothing, never sees your PayPal account, card or bank, and doesn’t learn from PayPal whether you paid. We note that you started paying, tell the seller, and the seller confirms whether the payment arrived.

Each payment its seller confirms, and each refund they record, goes in the USD ledger: the listing, the amount, the buyer and the seller, the PayPal.me link paid, any PayPal transaction number the seller notes, who confirmed it, and the dates. Like Coin records, ledger lines are permanent. The buyer and the seller see them, and so do the kingdom’s GMs and the site administrator, who look after the Market.

Cookies and your browser

The site sets one cookie to keep you signed in, which expires 12 hours after your last visit, and one that remembers your time zone so that times show correctly. Your browser also remembers your place in the message list while the tab is open. There are no advertising, analytics or tracking cookies, and no third-party trackers.

Your browser also keeps the site’s small notification script (a service worker). It shows notifications and opens them, and never stores pages. If notifications are on, your browser notes when it last checked them with the site.

Once you unlock encrypted messages on a device, that browser keeps your message key and your chats’ keys in its own storage, where pages of the site can use them but not read them out, until you sign out or lock the device in Settings → Secure Messages. A notification for an encrypted message shows its words only when your device can open them itself.

Phone and desktop notifications

Notifications stay off until you turn them on for a device in Settings → Notifications. Your browser then gives us an address at its push service, along with encryption keys. The push service is Google’s for Chrome, Microsoft’s for Edge, Mozilla’s for Firefox and Apple’s for Safari. We keep that address with a short description of the device (such as “Chrome on Android”), when you turned it on and when it was last used. We also keep your notification choices.

Each notification is encrypted on our server so that only your device can read it, then handed to the push service to deliver. The push service cannot read it, but it learns that a notification reached your device, when, and how large it was. You choose what your lock screen shows: who a notification is from (the default), who and what, or nothing personal. Email addresses never appear in notifications.

To stop notifications, turn them off or remove the device in Settings → Notifications, sign out on that device, or block notifications for the site in your browser or phone settings. If someone else signs in on the same browser, the previous member’s notifications stop there.

Videos from YouTube and TikTok

When a post links a YouTube video, your browser loads its preview picture from YouTube (Google), and the video itself from youtube-nocookie.com when you press Play. A TikTok video loads only when you choose to load it: the site asks TikTok for its player, then your browser loads the video from TikTok. Those services receive your IP address and browser details, under their own privacy policies.

Event locations and Google Maps

When you type an event’s location, our server sends what you have typed to Google Maps to suggest matching places. Google receives that text from our server, not from your device, and not who typed it. The map shown with an event, or while you type its location, loads from Google in your browser, so Google receives your IP address and browser details and the location shown, under its own privacy policy. Open in Google Maps takes you to Google Maps itself. An event’s Add to calendar → Google Calendar takes its title, time, place and description to Google Calendar, only when you choose it; the calendar file it also offers is made by our server and stays on your device.

Link previews

When you paste a link to a web page in a post or comment, our server visits that page once to read its title, short description, picture address and site name, and shows them as a link preview with your post or comment (Messages never get one, because we cannot read them). Our server says who it is when it visits, visits only public web pages, and keeps what it read for up to a week so the same link is not fetched again. The picture in a preview is not copied to our server: your browser, and the browser of everyone who sees the preview, loads that picture straight from the other site, which receives their IP address and browser details under its own privacy policy, but not which page of Kingdom Connect they are on.

Active Status

We note when you were last active on Kingdom Connect, at most once a minute while you have it open. Members you chat with see a green dot on your picture when you were active in the last five minutes, and in a private chat how long ago you were, up to a day. We never record what you looked at, and your messages stay end-to-end encrypted. You can turn this off in Settings → Active Status; then no one sees it, and you do not see anyone else's. The site administrator's account is never shown as active.

GIFs linked from other websites

When a post, comment or message links a GIF on another website, such as Giphy or Tenor, your browser loads the GIF from that website to show it. That website receives your IP address and browser details, under its own privacy policy, but not which page of Kingdom Connect you are on. A GIF you add from your phone’s keyboard or as a picture is stored on our server like any other picture.

GIF search (GIPHY)

The GIF button in a writing box searches GIPHY, a GIF library run by GIPHY, Inc. (a Shutterstock company). GIPHY requires the search to come from your browser, so when you open it your browser sends GIPHY the words you search for, your IP address and browser details, and loads the GIFs from GIPHY. We don’t send GIPHY your name, your account or what you write. GIPHY handles this under its own privacy policy. The GIF you choose is added to your post, comment or message as a link to it on GIPHY, and shows as described above.

Where it is kept, and for how long

Everything is stored on servers we run in Arizona, USA, and every connection to the site is encrypted. We keep your information while you are a member. Nightly backups are kept for 14 days. The web servers log each request’s IP address, page and browser for about 14 days to keep the site running and protect it, and sign-ins to the administrator account are recorded with the address they came from. When you were last active is kept with your account, overwritten each time; what a link's page said about itself is kept for up to a week.

Your choices

You can change your profile and remove most of what you have posted yourself. To close your account, email info@thesphinx.co. We will suspend it so no one can sign in with it, and on request replace your name and remove your email address. Some records stay because other members’ records depend on them: Coin transactions and receipts, the USD ledger, attendance, and messages you sent in conversations with others. Backup copies are gone within 14 days. You can also ask us what we hold about you.

Age

You must be at least 13 to join. If we learn that someone under 13 has an account or a sign-up request, we will delete it.

Changes

If this policy changes, we will update this page and its date, and tell members on the site about important changes.

The Sphinx Hosting and Game Mastery LLC · info@thesphinx.co