Privacy Policy

Version 2026-10-26 · Effective October 26, 2026

This Privacy Policy explains how Toadstool Labs LLC, an Oregon limited liability company (“Toadstool Labs,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with the Gibbed Online game and related websites and services (the “Service”). It is part of our Terms of Service. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

In short: we collect only what we need to run the game. We do not sell your personal information, do not share it for targeted advertising, and do not use advertising or analytics cookies.

1. Scope

This Privacy Policy applies to information we collect through the Service and when you communicate with us. It does not apply to third-party websites or services that we do not control, even if they are linked from the Service. The Service is intended only for adults 18 and older.

2. Information We Collect

2.1 Information you provide

Account information. Your email address, if you choose to connect one, and the one-time sign-in codes we send to it (we store only a cryptographic hash of each code).
Character information. Your character name and the appearance you select.
Age and acceptance records. Your confirmation that you are 18 or older and your acceptance of the Terms of Service and this Privacy Policy, including the date, time, and version accepted.
Communications. Chat messages and other content you send in the Game, and the contents of emails or other messages you send us, such as support requests, bug reports, feedback, or legal notices.

2.2 Information collected automatically

Gameplay data. Your character’s position, movement, actions, combat events, health, level, experience, inventory, equipment, customizations, quests, contracts, party membership, zone transfers, session times, and other game state needed to run a persistent online world.
Device and connection data. Your IP address, browser type and version, operating system, device and graphics capability information, network connection details, and timestamps of requests. We use IP addresses to operate the network connection, prevent abuse, and enforce rate limits (for example, limits on how often sign-in codes can be requested).
Logs and diagnostics. Server logs, error reports, performance data, and security and anti-cheat signals generated when you use the Service.
Identifiers. Internal account identifiers and session tokens that keep you signed in (we store only a cryptographic hash of each session token on our servers).

2.3 Information from others

Other players may provide information about you, for example in chat or in reports of misconduct. Our service providers may provide information such as email delivery status.

2.4 Information we do not intend to collect

We do not ask for and do not want sensitive information such as government identifiers, financial account details, precise geolocation, health information, or information about racial or ethnic origin, religious beliefs, or sexual orientation. Please do not share such information in chat or with us. We do not currently process payments. If we offer paid features in the future, payments will be handled by a third-party payment processor and we will update this Privacy Policy.

3. Cookies and Browser Storage

We use only storage that is necessary to provide the Service or remember your choices. We do not use advertising cookies, cross-site tracking, or third-party analytics.

Name	Type	Purpose	Duration
`zone_guest`	HTTP-only cookie	Keeps you signed in to your account	Up to 90 days
`gibbed.identity`	Local storage	Keeps your account and session on this device	Until you sign out or clear browser data
Controls and audio settings	Local storage	Remembers key bindings and volume preferences	Until you clear browser data
`gibbed-rift-arrival`	Session storage	Smooths the transition between zones	Until the tab closes

Because this storage is necessary for the Service, blocking or clearing it may prevent the Game from working and may cause you to lose access to a guest account. Our game pages load fonts from Google Fonts, which means Google receives your IP address and browser information when the fonts are requested; see Google’s privacy policy at policies.google.com/privacy.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information for targeted advertising or track you across other websites, we treat all users as having opted out of such activities. We do not respond differently to Do Not Track signals; we honor Global Privacy Control signals as an opt-out request where required by law.

4. How We Use Information

We use the information we collect to:

provide, operate, and maintain the Service, including creating and authenticating accounts, saving characters and progress, running multiplayer sessions, and delivering chat;
send sign-in codes and service-related messages, such as security alerts, changes to our terms, and responses to your requests;
verify eligibility and keep records of your acceptance of our terms;
detect, investigate, and prevent cheating, fraud, abuse, security incidents, and violations of our Terms of Service, and enforce our Terms;
moderate chat and character names and respond to player reports;
debug, troubleshoot, measure performance, and improve and develop the Service and new features;
comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims; and
for any other purpose described to you when the information is collected, or with your consent.

We may create de-identified or aggregated information that cannot reasonably identify you and use it for any lawful purpose. We will maintain such information in de-identified form and not attempt to re-identify it, except as permitted by law. We do not use your information to make decisions about you based solely on automated processing that produce legal or similarly significant effects, other than automated security, anti-cheat, and anti-abuse measures used to protect the Service.

5. How We Disclose Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

Other players. Your character name, appearance, in-game actions, position, party membership, and chat messages are visible to other players as part of the Game.
Service providers. Vendors that process information on our behalf under contractual confidentiality and data-protection obligations, including cloud hosting and database providers, our email delivery provider (Postmark, which delivers sign-in codes), and security and infrastructure providers.
Legal and safety. When we believe in good faith that disclosure is necessary to comply with law, regulation, legal process, or a governmental request; to enforce our Terms of Service; to detect, prevent, or address fraud, cheating, security, or technical issues; or to protect the rights, property, or safety of Toadstool Labs, our players, or the public, including by reporting suspected illegal activity to law enforcement.
Business transfers. In connection with, or during negotiations of, any merger, financing, acquisition, reorganization, bankruptcy, receivership, or sale of all or part of our business or assets, in which case information may be transferred to the successor or acquirer, who will be bound by this Privacy Policy or a policy at least as protective.
With your consent or at your direction.
De-identified or aggregated information that cannot reasonably identify you.

6. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, including to operate your account, comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements. For example:

account, character, and gameplay data are kept while your account exists and deleted or de-identified within a reasonable time after you ask us to delete it, unless we must keep it longer for legal, security, or enforcement reasons;
sign-in code records expire after 10 minutes and are routinely purged;
session records expire after 90 days;
IP-based rate-limit records are kept for minutes to hours;
acceptance records are kept for as long as needed to demonstrate your agreement to our terms; and
records of enforcement actions (such as bans) may be kept as long as needed to prevent ban evasion.

Residual copies may remain in backups for a limited period until overwritten. The Service is in development, and we may delete accounts and data, including through world resets, at any time as described in the Terms of Service.

7. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, including encrypted connections, hashing of sign-in codes and session tokens, and access restrictions. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of your information. You are responsible for keeping your devices, browser, and email account secure. If we learn of a security breach affecting your personal information, we will notify you as required by applicable law.

8. Your Privacy Rights

Depending on where you live, and subject to applicable law and its exceptions, you may have the right to:

access and confirm whether we process your personal information, and obtain a copy of it in a portable format;
correct inaccurate personal information;
delete personal information we hold about you;
obtain a list of the specific categories of third parties to which we have disclosed personal information (as provided under Oregon law);
opt out of the sale of personal information, targeted advertising, and certain profiling (we do not engage in these activities);
withdraw consent where we rely on consent; and
not be discriminated against for exercising your rights.

How to make a request. Email hello@toadstool.tech with the subject line “Privacy Request,” describing your request and including the email address or character name associated with your account. To protect your account, we will verify your identity before acting, for example by confirming control of your account’s email address or session. If you have a guest account with no email address, we may be unable to verify your identity unless you make the request from the device holding the account. You may use an authorized agent where permitted by law; we may require proof of the agent’s authority and verify your identity directly. We will respond within the time required by applicable law (generally 45 days, which may be extended as permitted by law).

Appeals. If we decline to act on your request, you may appeal by replying to our decision or emailing hello@toadstool.tech with the subject line “Privacy Appeal.” We will respond to appeals within the time required by law. If you are not satisfied with the result, you may contact your state attorney general (in Oregon, the Oregon Department of Justice at doj.state.or.us).

Deleting your account. Deleting your account permanently removes your characters, progress, and in-game items and cannot be undone.

Email. We send only service-related messages, such as sign-in codes. We do not send marketing email. If we ever do, we will provide a way to unsubscribe.

9. Users Outside the United States

Toadstool Labs is based in the United States, and the Service is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate, where data-protection laws may differ from those in your country.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on the following legal bases: to perform our contract with you (operating the Service and your account); our legitimate interests (securing the Service, preventing cheating and abuse, and improving the Game), which are not overridden by your interests and rights; compliance with legal obligations; and your consent where required. You may also have rights to restrict or object to processing and to lodge a complaint with your local data-protection authority. You can exercise your rights as described in Section 8.

10. Children

The Service is intended only for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we require every user to confirm they are 18 or older. If we learn that we have collected personal information from someone under 18, we will delete it and terminate the account. If you believe a minor has provided us information, contact us at hello@toadstool.tech.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the version and effective date above and, if the changes are material, provide additional notice, such as within the Game or by email. Changes take effect when posted unless we state otherwise. Your continued use of the Service after changes take effect means you acknowledge the updated Privacy Policy. Where required by law, we will obtain your consent to material changes.

12. Contact

For questions or requests about this Privacy Policy or our privacy practices, contact:

Toadstool Labs LLC
Oregon, USA
hello@toadstool.tech