Plain language, no boilerplate
Privacy & data
RedMoon2 is a hobby server run by a small team. This page says exactly what we store, why we need it, and when it goes away. Last updated 25 August 2026.
What we store when you make an account
Four things, and nothing else:
- Your username. It is how you log in and how staff find you if you ask for help.
- Your password, hashed. We store the hash the game server checks against, never the password itself. Nobody on the team can read it or tell you what it was — if you lose it, it has to be reset.
- Your email address. Used to recover an account and, rarely, to tell you something important about the server. We do not send marketing, and we do not give or sell it to anyone.
- Your 7-digit deletion PIN. It is what the game asks for before it lets anyone delete one of your characters. Treat it like a second password.
What the game server records while you play
A Metin2 server writes logs, and it has to: they are how a lost item is traced, how cheating is caught, and how a dispute between two players is settled by looking rather than guessing. They include your characters and their progress, items and money moving between players, and — because a login has to come from somewhere — your IP address.
None of it is kept forever. The retention policy runs nightly and is deliberately tiered by how privacy-sensitive the data is against how useful it is:
- 30 days — chat and shouts. The highest privacy cost, the least forensic value.
- 90 days — anti-cheat records. Long enough to spot a repeat offender, short enough that a false positive ages out.
- 180 days — login sessions, which contain IP addresses.
- 365 days — item, money and GM-command history: the things an investigation needs a long tail for.
Cookies and tracking on this website
This website runs no analytics and embeds no trackers, advertising, or social widgets. It sets two cookies of its own and both are strictly functional: the language you pick in the header, so the site opens in it next time, and — only once you sign in — the cookie that keeps you signed in. Neither is shared with anyone, and there is no consent banner because there is nothing to consent to. The Discord panel on the homepage shows a number we fetch from Discord on the server — your browser never talks to Discord unless you click the link.
The site sits behind Cloudflare, which handles the connection and absorbs attacks. Cloudflare may set its own cookie and processes your IP address to do that. The staff dashboard on a different subdomain sets a login cookie, but that is for team members and requires an account with staff access.
Discord
Our Discord server is Discord's service, not ours, and what you do there is covered by Discord's own privacy policy. If you link a Discord account to a game account for beta access, we store the connection between the two and nothing more.
Your data, when you want it back or gone
Ask us and we will tell you what we hold about your account, or delete it. Deleting an account removes the account row and its characters. Anything already anonymised, and log entries that record an action rather than a person, may remain until they age out under the schedule above — a trade record that named nobody is not personal data, and removing one side of a trade would falsify the other player's history.
The fastest route is a ticket in Discord.
Children
The game is not intended for children under 13. If you believe a child has made an account, tell us and we will remove it.
Changes
If this page changes in a way that matters — new data collected, a longer retention period — it will be announced in the news and in Discord, not quietly edited.
Written to be read rather than to be legally exhaustive. It describes what the server actually does; if something here is ever contradicted by the code, the code is the bug.