What we collect, why, how long we keep it and who else handles it.

Quick Summary

• We collect only what's needed to run accounts and the game and to keep them safe.
• We never sell or rent your information, and we show no advertising.
• We hold no payment details: New Horizons is free and takes no money.
• You can change your username, email address and password yourself, and delete your account from your account page.

1. Information We Collect

• Account details: your username, your email address, when the account was made and when it last logged in to the game, whether it has a game key, whether you've asked to test the game, and whether it has been suspended or closed and why. Staff may keep notes on an account for moderation; they are removed with the account.
• Your password, never as you typed it. We store a one-way hash of it (Argon2id). We can check a password against the hash, but nobody, including us, can read your password back from it.
• Where you log in from, roughly. For each account we keep the last ten networks it has logged in from (the first part of the IP address, not the whole of it), so we can ask for an emailed code when a login comes from somewhere new. For each browser logged in to this site we keep the kind of browser and system ("Chrome on Windows", nothing finer) and when it logged in, so your account page can show you where you're logged in.
• Two-step login, if you turn it on: the key your authenticator app shares with us, stored encrypted, and one-way hashes of your backup codes.
• Game data: what you make and do in the game, such as your pirates and their names and looks, items, ships, guilds, friends and quests.
• Chat and reports: what you say in the game passes through our servers and may be recorded and reviewed for moderation, along with reports made by or about you.
• Technical records: our servers record connections, including the internet (IP) address they come from and the time, and what an account did, so we can investigate cheating, abuse and faults.
• Messages you send us: if you write to us, we keep the correspondence.

We don't ask for your real name, home address, date of birth or phone number, and we ask that you don't share them in the game.

2. How We Use It

• To run your account and the game, and to let you log in.
• To send the emails described below.
• To keep the community safe: moderating chat and names, and acting on reports.
• To find and stop cheating, abuse and attacks on our systems.
• To find and fix faults.

We don't use your information for advertising or profiling, and we don't sell, rent or trade it.

3. Emails We Send

A code when you make an account, forget your password, change your email address or log in from somewhere new, and a notice when something important about your account changes: its password, email address, username or two-step login, or a request to delete it. We don't send marketing email.

4. Cookies and Browser Storage

• One cookie of ours, set when you log in to this site. It keeps you logged in for up to 30 days or until you log out. The page's scripts can't read it, and it's sent only to our login service.
• Your username, remembered in your browser's own storage so the menu can show that you're logged in. It stays on your device.
• Cloudflare may set cookies of its own to protect the site and, where the sign-up page shows one, to check that you're a person (Cloudflare Turnstile).

We use no advertising or cross-site tracking cookies.

5. Who Else Handles It

These companies process information for us so the services can work. Each sees only what its job needs:

• Cloudflare serves this website and the game's files, and runs the sign-up check. Like any web host, it sees the IP address you connect from.
• Our server hosting provider carries your connection to the login service and the game.
• Brevo delivers the emails we send to your address.
• Have I Been Pwned tells us whether a new password has appeared in break-ins at other sites. We send it only the first five characters of a scrambled (hashed) form of the password, never the password, your username or your address, so it can't tell whose password is being checked or what it is.

We may also disclose information when the law requires it, or to the authorities when someone's safety is at risk.

6. How Long We Keep It

Account and game data are kept while your account exists. Website logins expire after 30 days. Technical records and moderation records are kept as long as they're useful for safety and fair play, then cleared out. When an account has been closed for a serious breach of the Terms of Use, we may keep enough to stop the same person returning.

During testing, game data may be reset without notice, as the Terms of Use explain.

7. How We Protect It

Connections to this site, the login service and the game are encrypted. Passwords are stored only as hashes, new passwords are checked against lists of passwords leaked from other sites, a login from somewhere new takes a code from your email, and you can turn on two-step login with an authenticator app. Access to the account database is limited to the few people who run New Horizons. No system is perfectly secure, so please use a password you don't use anywhere else.

8. Your Choices and Rights

• Change your email address and password on your account page.
• Delete your account on your account page, with your password. There is a seven-day wait, in which you can log in and call it off. After that it is permanent: the account's record is removed and its username becomes free. The pirates it had can no longer be reached by anyone.
• See or correct: you may ask what we hold about you and ask us to correct it. Where the records include other people, their details are left out.

We act on a request once we're sure it comes from the account's owner. Depending on where you live, the law may give you further rights over your information, and we'll respect them.

9. Children

New Horizons is for players aged 13 and over, and we don't knowingly collect information from younger children. If you're a parent or guardian and believe your child has made an account, get in touch with us and we'll close it and delete its details. If we learn that an account belongs to a child under 13, we do the same.

10. Changes

We may update this policy. When a change matters, we'll say so on the home page before it takes effect.

11. Questions

For anything about your information or this policy, get in touch with us.

Last updated November 12, 2026.