Privacy Policy

Last updated 2026.

DinoDynasty ("we", "us") operates this website and the DinoDynasty game (the "Service"). This policy explains what we collect, why, and the controls you have over your own data. It's written in plain language on purpose — if anything is unclear, contact us using the address at the bottom of this page.

Who can use DinoDynasty

DinoDynasty is intended for players aged 16 and over. By creating an account you confirm you are at least 16 years old. We do not knowingly collect personal information from anyone younger, and we will close an account and delete its associated personal information if we learn it belongs to someone under that age.

What we collect

• Account basics. The email address you sign in with, and a username (auto-generated at signup; whatever you customize afterward is stored as you entered it).
• Sign-in activity. We record the IP address and browser user-agent string used at signup and at each login, and a login-day counter for streaks. This is used for account security, fraud/multi-accounting review, and abuse response — not for tracking you around the web.
• Gameplay data. Everything you do inside the Service — your park, its dinosaurs, transactions, chat messages, reports you file or are named in, and similar records — is stored so the game can function and so support can help you if something goes wrong.
• Cookies. A single session cookie (httpOnly, not readable by page scripts) keeps you signed in. We do not use third-party advertising or tracking cookies.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Why we keep it

Account and gameplay records are integer-ledgered — every in-game currency movement is logged permanently so the economy stays auditable and disputes can be investigated. This ledger keeps numeric records (amounts, balances, timestamps) even after an account is deleted; see "Deleting your account" below for exactly what does and doesn't get removed.

Your choices

• Export your data. Signed-in players can request a JSON export of their account and gameplay data via GET /api/v1/me/export (or by asking support).
• Delete your account. You can request account deletion at any time via POST /api/v1/me/delete-account (or by asking support). This:
  • Scrubs your username, email address, and any stored IP addresses from the account.
  • Ends every active session immediately — you (and anyone who had your credentials) are signed out everywhere.
  • Renames your park to a generic placeholder ("Shuttered Park #<id>") rather than deleting it outright, because other players' history (trades, charters, rivalries, Hall of Fame records) references it.
  • Leaves the numeric ledger intact — deleting the underlying rows would corrupt other players' running balances. Only your personal identifiers are removed; the numbers stay for economic integrity.
  This action cannot be undone.

Moderation & enforcement

If your account is suspended or banned, we keep a record of the action, the reason, and the evidence (which may include chat logs or reports) for as long as needed to enforce the decision and handle appeals.

Security

Sessions are random, server-validated tokens delivered over an httpOnly cookie. Passwordless sign-in uses a one-time code sent to your email rather than a stored password for players. Staff accounts with elevated access support two-factor authentication. We use standard safeguards (parameterized database access, rate limiting, CSRF protection) throughout the Service — see our Rules page for community-facing conduct expectations.

Changes to this policy

If we make a material change to this policy, we'll update the "last updated" date above and, where appropriate, post a notice in-game.

Contact

Questions about this policy, or a data export/deletion request you'd rather send by email: use the in-game support form.