Privacy Policy

1. Account information

When you register or maintain an account, the game may store your username, email address, one-way password hash, profile/avatar information, account dates and settings. Passwords are not intended to be stored as readable plaintext.

2. Gameplay and economy information

Because the game is persistent, server records may include player statistics, resource changes, inventory, equipment, travel, crimes, missions, combat, bounties, jail/hospital activity, vehicles/racing, businesses/properties, casino play, achievements, challenges, Gang membership/activity, territory, market/trade transactions, messages, NPC interactions, Heat checks, police encounters and other gameplay history necessary to operate or audit those systems.

3. Security and technical information

The service may record IP addresses, login times, browser user-agent information, session/security events, registration and recent-login addresses, failed-login data and a first-party browser-security identifier stored in hashed form. These records help secure accounts, investigate abuse, enforce account limits and diagnose problems. A normal website cannot retrieve your remote device's MAC address, and the game does not rely on MAC-address collection.

4. Demo Realm information

Visitors who use the temporary Demo Realm are assigned a generated Demo Player number rather than a registered account. The service may record demo-session start/end/last-active times, duration, temporary demo stats and city, demo gameplay actions, browser user-agent information, a hashed first-party device identifier and a one-way hash derived from the network address for abuse prevention. Owners can review these demo activity records in the restricted Admin area. Demo visitors do not provide an email address or password to start the demo, and demo identities are not inserted into the live player tables.

5. Support and moderation information

Logged-in support tickets can be associated with your player account. Public Support requests may store the name and email address you provide, your ticket content, timestamps and a one-way hash derived from your submitting IP address for spam/rate-limit protection. The public-support rate limiter is designed not to require storing the raw visitor IP in the guest-support fields. Moderation records may include warnings, suspensions, bans, internal notes and administrative audit entries.

6. Shop and payment information

If you use the optional real-money Shop, payment credentials such as the full card number and card security code are entered into Stripe-controlled payment pages and are processed by Stripe. Thug Life: Underworld Empire does not need to store those full card credentials to fulfill a purchase.

The game may store the player account associated with an order, order number, product and reward snapshots, amount, currency, Stripe Checkout Session, PaymentIntent and Charge identifiers, payer email when supplied by Stripe, payment status, payment/fulfillment timestamps, refund amounts, dispute status/timestamps, webhook event identifiers and technical event hashes. This information is used to confirm payment, prevent duplicate fulfillment, investigate missing or duplicate orders, reconcile refunds/disputes, prevent fraud and maintain accounting/audit history.

7. Why information is used

Information is processed to authenticate players, maintain sessions, preserve progress, execute game mechanics and transactions, fulfill Shop purchases, reconcile payment events, operate communication/support features, detect abuse, enforce rules, secure accounts, investigate incidents, balance the persistent economy and maintain administrative accountability.

8. Cookies and local browser data

Required cookies/local identifiers may support login sessions, CSRF protection, remember-me functionality, security identity, theme/preferences and other core functions. Removing them can sign you out, reset convenience settings or reduce the security history associated with that browser. Optional cookie categories, when offered, can be controlled through the site's cookie controls.

9. Data visibility

Some information is intentionally public to other players inside the game, such as usernames, Thug Profiles, selected titles, leaderboards, Gang information and gameplay states exposed by a feature. Private messages, support records, account email addresses, security details and administrative notes are not intended to become general Thug Profile data, although authorized personnel may access them when required for support, security or moderation.

10. Service providers

Hosting, email delivery, Stripe payment processing, authentication and infrastructure providers may process information needed to provide their part of the service. Stripe processes payment-method information under its own privacy practices and returns transaction information needed for Shop fulfillment and payment reconciliation. The game does not need to disclose player conversations or gameplay records to advertisers in order to operate the systems described here.

11. Retention

Persistent gameplay, economy, Shop order/payment, refund/dispute, Gang, moderation and audit histories may be retained for long periods because they help define the continuing game state, support accounting and investigate disputes, fraud or exploits. Temporary records such as expired remember-me tokens, old reset tokens, short-lived login-attempt data and completed Demo Realm sessions may be cleaned up automatically according to configured retention periods. Retention may vary by data type, legal obligations and operational need.

12. Security practices

The application uses measures such as password hashing, CSRF protections, server-side permission checks and security/event histories. No online service can promise absolute security. Players should use unique passwords, protect their email account, review recent login information and use Log Out Everywhere if unauthorized access is suspected.

13. Access, correction and account questions

Players can review and update supported profile/account fields through My Account. For account, security or privacy questions that are not available through self-service controls, submit a Support Ticket. Verification may be required before account-specific information is changed or disclosed.

14. Public Support

If you cannot log in, the public Support page can be used without an account. Only provide information needed to investigate the issue, and never submit your password, password-reset code or payment credentials.

15. Policy updates

This policy may change as features, security systems or service providers change. The current version is published here with its latest update date.