MORTERRA

Privacy Policy

Last updated October 25, 2026

This privacy notice for Red Arrow Marketing, LLC ("Company," "we," "us," or "our"), the company that operates Morterra, describes how and why we collect, store, use, and share ("process") your information when you use our services ("Services"): the website at https://morterra.com, the Morterra game and its game servers, the Morterra app on Steam and the Morterra Activity on Discord. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact us at help@morterra.com.

SUMMARY OF KEY POINTS

• We collect what the game needs to work: your username, email address, a hash of your password, your characters and game progress, purchase records, and the IP address you sign in from.
• We use one cookie, to keep you signed in. We do not use analytics, advertising or tracking cookies, and we do not show ads.
• Voice chat is relayed live to nearby players and is never recorded. Text chat is not stored in our databases.
• Card payments are handled by Stripe. In the Steam app purchases go through Steam, and in the Discord Activity through Discord. We never see or store your card details.
• We do not sell your personal information or share it for advertising.
• Morterra is not meant for children under 13.
• You can ask us for a copy of your data or to delete your account at any time by emailing help@morterra.com.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT? 2. HOW DO WE PROCESS YOUR INFORMATION? 3. WHAT LEGAL BASES DO WE RELY ON? 4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION? 5. COOKIES AND BROWSER STORAGE 6. HOW LONG DO WE KEEP YOUR INFORMATION? 7. HOW DO WE KEEP YOUR INFORMATION SAFE? 8. WHAT ARE YOUR PRIVACY RIGHTS? 9. CHILDREN'S PRIVACY 10. CONTROLS FOR DO-NOT-TRACK FEATURES 11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS? 12. INTERNATIONAL TRANSFERS 13. DO WE MAKE UPDATES TO THIS NOTICE? 14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

1. WHAT INFORMATION DO WE COLLECT?

Information you give us

• Account details: your username, email address and password. We store only a one-way hash of your password, never the password itself. We also record whether your email address has been verified and when the account was created. If you had an account in the original Morterra, we moved it to Morterra 2 with its username, email address, password hash, titles, friends list, play time and character appearance, so you can sign in as before; the first time you do, your password is re-hashed with a stronger method.
• Profile and game account data: your character's appearance, titles, total play time, your friends list, and the game settings you choose to keep with your account (controls, graphics, audio and voice settings).
• Purchases: for each order, the item, price, currency, status and dates; your owned cosmetics and name colours; your Crowns balance and a history of every change to it (bought, earned with membership, spent, refunded or adjusted by our team); the weekly shop selection made for your account and what you bought or refreshed in it; your agreement to immediate delivery when you pay; your donation total; and your membership status. We also keep the customer and subscription IDs that Stripe gives us, and for purchases made through Steam or Discord the order, transaction, agreement or entitlement IDs they give us. Your card or other payment details go directly to Stripe, Steam or Discord and never reach us.
• Steam and Discord sign-in: if you play in the Steam app or the Discord Activity, Steam or Discord tells us your Steam ID or Discord user ID (and Discord your Discord username), and we keep it with your account so you are signed in there automatically. For the Discord Activity's rewards we also keep how long you have played in the Activity.
• Bug reports: if you send one, we keep what you wrote, your username (if signed in), when and where in the game it happened, your browser and screen size, and your IP address, until the bug is handled (fixed reports are deleted after 180 days).
• Messages to us: if you email us, we keep the email and our reply for as long as needed to help you.

Information created when you play

• Guest play: you can play without registering. We then create a guest account with a generated name, identified by a random secret kept in your browser.
• Game world data: each game world stores your character there: position, health and other stats, inventory, karma, play time, and when you were last online. When a world ends its season, highscores (your username and score) are archived and shown in the game.
• Text chat: chat messages pass through the game server to the other players who should see them. We do not store chat in our databases. If a world is set up to mirror chat to our Discord server, global chat messages and announcements, with the sender's username, are posted to a public Discord channel; private messages are never mirrored.
• Voice chat: voice chat is only available to registered players and is off until you press the talk key (or turn on voice activation) and allow microphone access in your browser. Your voice is sent to the game server and relayed in real time to players near your character. It is never recorded or stored by us. Players never connect to each other directly, so other players do not see your IP address.
• Moderation: if an account is muted or banned, we record that on the account.

Information collected automatically

• IP address and security log: we store the IP address you sign in from with each sign-in session, for account security. We also keep a security log on each account: sign-ins and failed sign-in attempts (with IP address and browser type, deleted after 180 days), and password changes and resets, purchases and moderation actions (with IP address where there is one, kept with the account), so we can help if an account is taken over or a payment is disputed. We also use IP addresses for a short time in server memory to limit repeated sign-in, registration, email and checkout attempts, and game servers use it to keep your connection open. These rate-limiting and connection uses are not stored.
• Server logs: our servers keep basic technical logs (errors and performance figures) to run and fix the Services. Occasionally these can include an identifier, such as the email address a message could not be delivered to.

We do not collect your precise location, contacts, or any sensitive personal information, and we do not receive information about you from data brokers or advertisers.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your information to:

• create and run your account, sign you in, and keep your characters, cosmetics and settings;
• send you account emails: email verification and password reset (we do not send marketing email);
• run the multiplayer game, including chat, voice chat, friends and highscores;
• process purchases, donations and membership renewals, and give you what you bought;
• keep the Services safe: prevent cheating, spam, fraud and abuse, enforce our Rules and Terms, and investigate problems;
• comply with the law, for example keeping payment records for tax purposes.

3. WHAT LEGAL BASES DO WE RELY ON?

If you are located in the EU or UK, we rely on the following legal bases: Contract, to provide the game, your account and anything you buy; Legitimate interests, to keep the Services secure, prevent abuse and moderate the game (for example, storing sign-in IP addresses and rate limiting); Legal obligation, to keep financial records and respond to lawful requests; and Consent, for using your microphone for voice chat, which you can withdraw at any time by turning voice chat off or blocking microphone access in your browser.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

• Other players see your username, character, name colours and badges, chat messages, voice, highscores, and, for players on your friends list, which world you are playing in.
• Service providers who process data for us: our hosting providers (who run our servers), our email delivery provider (which sends verification and password reset emails), and Stripe (payments; we send Stripe your email address and an account reference when you check out). Stripe's use of your data is covered by Stripe's privacy policy.
• Discord, if chat mirroring is turned on for a world, receives global chat messages and usernames as described above. Discord's privacy policy applies to its service.
• Valve (Steam) and Discord, when you play or buy through them: we ask Steam or Discord to confirm who you are and to process and report on your purchases (for Steam, we send your Steam ID, the item, its price and your language). Their privacy policies apply to their services: Valve's privacy policy and Discord's privacy policy.
• Legal reasons: when required by law, or to protect the rights, safety and property of our players, the public, or us.
• Business transfers: if Red Arrow Marketing, LLC is merged with or sold to another company, or if Morterra is sold, your information may be transferred as part of that deal, subject to this notice.

We do not sell your personal information, and we do not share it for targeted advertising.

Cookie Policy

5. COOKIES AND BROWSER STORAGE

Cookies are small data files that a website places on your device. We use a single, first-party cookie, which is strictly necessary for signing in:

Name: mt_session. Purpose: keeps you signed in. Provider: morterra.com. Type: first-party, HTTP-only. Expires: 30 days if you choose "remember me"; otherwise when you close your browser (and our server forgets it after a day).

We do not use analytics, advertising or social media cookies, web beacons or tracking pixels, so we do not ask for cookie consent. Because the cookie is strictly necessary, the sign-in features will not work if you block it, but you can still play as a guest. When you pay, Stripe's checkout opens inside our page or on Stripe's own checkout page, and Stripe may set its own cookies there for payment processing and fraud prevention.

The game also saves some things in your browser's local storage: your settings and key bindings, voice volumes, the players you ignore, which hints you have seen, the world you last played, and your guest secret if you play as a guest. Except for settings you choose to keep with your account (see section 1), this stays on your device and is not sent to us. Clearing your browser's site data removes it (and, for guests, the link to the guest account).

6. HOW LONG DO WE KEEP YOUR INFORMATION?

• Account data (including guest accounts) is kept until you ask us to delete it.
• Sign-in sessions, with the IP address, are deleted when they expire (at most 30 days). Email verification and password reset links expire and are then deleted.
• Rate-limiting data exists only in server memory and is cleared automatically.
• Game world characters are deleted when the world is wiped (currently about once a month). Season highscore archives are kept.
• Payment records are kept for as long as tax and accounting laws require, even after an account is deleted.
• Backups: our databases are backed up hourly; hourly copies are kept for 48 hours and daily copies for 30 days. Deleted data therefore disappears from backups within about 30 days.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

Connections to our website and game servers are encrypted (HTTPS and secure WebSockets). Passwords are stored only as strong one-way hashes, sign-in tokens are stored only as hashes, sign-in attempts are rate limited, and payment notifications from Stripe are verified. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will never be able to defeat our security. If we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires.

8. WHAT ARE YOUR PRIVACY RIGHTS?

Depending on where you live (for example, in the EEA, UK, Canada or certain US states), you may have the right to: request access to and a copy of your personal information; correct it; delete it; restrict or object to its processing; receive it in a portable format; and withdraw consent. We give these rights to all our players wherever they live.

You can change your password, appearance and settings yourself on the account page. To get a copy of your data, correct your email address, or delete your account, email help@morterra.com from the email address on your account (or tell us your username and how we can confirm the account is yours). We will reply within 30 days. Deleting your account removes your account, sign-in sessions, friends, cosmetics and membership, and your characters on our game worlds; it does not refund past purchases, and we keep payment records only where the law requires. We will not treat you differently for using your privacy rights.

If you are in the EEA or UK and are unhappy with how we handle your data, you also have the right to complain to your local data protection authority.

9. CHILDREN'S PRIVACY

Morterra is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Players aged 13 to 17 need a parent or guardian's permission to play. If you believe a child under 13 has given us personal information, please contact us at help@morterra.com and we will delete the account and its data.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

We do not track you across other websites and do not use third-party tracking, so there is nothing for Do-Not-Track or Global Privacy Control signals to switch off. We treat any such signal as a request not to sell or share your information, which we do not do anyway.

11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Yes. Under the California Consumer Privacy Act (CCPA), California residents have the rights described in section 8: to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for using these rights. You can also use an authorized agent; we may ask for proof that the agent is authorized to act for you. We will respond within 45 days.

In the past twelve (12) months we collected the following categories of personal information: Identifiers (username, email address, account ID, IP address); Commercial information (purchase, donation and membership records); Internet or other electronic network activity (your activity in our game, such as characters, play time and highscores); and Audio information (voice chat, relayed live and not recorded). We do not collect sensitive personal information. The sources, purposes, retention and recipients are described in sections 1, 2, 4 and 6. We have not sold or shared personal information, as those terms are defined in the CCPA, and we do not disclose personal information to third parties for their direct marketing ("Shine the Light").

If you are under 18, live in California and have an account, you can ask us to remove content you have publicly posted on the Services (for example, your username in the highscores) by emailing us.

12. INTERNATIONAL TRANSFERS

Red Arrow Marketing, LLC is based in the United States. Our website and game servers may run in the United States, the European Union or other countries, so your information may be processed outside your country. Where the law requires it, we use appropriate safeguards (such as the European Commission's Standard Contractual Clauses offered by our service providers) for these transfers.

13. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top and will be effective as soon as it is accessible. If we make material changes, we will post a notice on the site or email you.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, or want to use your privacy rights, email us at help@morterra.com. The company responsible for your information (the "data controller") is Red Arrow Marketing, LLC.

Rules · Terms of Service · Privacy Policy