← home · house rules · version 2026-08-22
Last updated: 22 August 2026
Your data is safe by default. The public game shows clearly-fake placeholders, not your real details. Your original 1997 information is kept encrypted, with the decryption key held off the server, and is brought back only if you ask for it and prove it's you — field by field, never automatically. You can have it erased at any time. Everything below is the detail behind those promises.
The 10 Towers is a non-commercial revival and preservation of a 1997–1998 online text game (a MUD). The person responsible for your personal data (the "data controller") is:
Joost Yervante Damad, a private individual in Belgium running this as a non-commercial preservation project (the sole data controller). For any question about your data, or to exercise your rights below, contact joost@damad.be.
If you have any question about your data, or want to exercise your rights (below), use that contact.
We did not collect this data from you recently. It is the original game database from 1997–1998, preserved from the game's own files. If you played The 10 Towers back then, your character record may still exist in that archive. We are telling you about it now, through this notice, because we are bringing the game back online (Art 14 — data not obtained directly from you).
First, the reassuring part: none of this is visible in the live game or sitting on the server to be stolen. In the running game these fields are replaced with obvious fakes, and the real 1998 values are kept only as encrypted data whose key is held off the server — so even someone who broke into the machine could not read them. We list what the original 1998 archive held because the law, and plain honesty, require telling you — not because any of it is exposed today.
For former players, the 1998 records may include:
Some of this free text could, in principle, reveal sensitive information (Art 9) if a player wrote it about themselves in the 1990s. Many players were also children in 1998. We treat the data accordingly (below).
The live game runs anonymized by default. When the game is online to the public, all the personal fields above are replaced with clearly-fake placeholders — your real name, email, homepage, login host and free text are not shown and not present in the public game. The public archive's basis is archiving in the public interest (Art 89): preserving a piece of 1990s online-community history, pseudonymized so it exposes no one.
Your real 1998 identity is restored only if you ask for it. A returning player can reclaim their character: we verify it is really you, you accept this notice, and you choose, field by field, what (if anything) of your original record to make live again — for the authentic "1997" feel. The basis for restoring any of your real personal data is your consent (Art 6(1)(a)), which you can withdraw at any time. Your original record stays encrypted and unreadable by the running game until that moment.
How we check that it's really you. Your character name is on the public roster, so anyone could type it. That's why we ask you to tell us things only you would know: which other characters you played, the email you used then, and whatever you remember — who you played with, what your title said, where you connected from. The keeper reads your claim and compares it against the sealed record. Nothing is restored, and you can't enter the game as that character, until they're satisfied.
That comparison means the keeper looks at the stored details for the character you're claiming, including the old email and login host, for as long as it takes to decide. They are not copied anywhere and every look is logged. If the claim doesn't hold up we restore nothing and the name stays free. We do this under the rule that lets us take reasonable steps to confirm who you are before handing over your data (Art 12(6)).
It happens in two steps, and the reason matters. What you write on a form can't really prove you are who you say — other people from back then remember the same things you do. So first you get the character back: the character itself, everything it was carrying, exactly where it left off, with none of your personal details attached. Your old email, real name and profile text stay sealed. Then the keeper meets you in the game, and that is the part that actually settles it. Once they're satisfied, whatever you asked to have restored comes back.
It's slower, and it's the right way round. Handing your details to the wrong person can't be undone; handing back a character can. If a claim turns out to be wrong we can take the character away again and remove anything that was restored.
You can always reveal more later — so start small. Because your originals are kept safe, you can come back and disclose more whenever you like; there's no rush. The reverse is harder: if you make a field public and later hide it again, that works going forward, but we can't promise to un-show what people may already have seen. So when in doubt, keep it private — you lose nothing by deciding later.
We do not sell your data, show advertising, profile you, or make any automated decisions about you.
To keep the game safe and fair, we look at public activity — what's posted on the public channels and general behaviour patterns (for spam, cheating, or abuse). We act on that to mute, freeze, or ban bad actors. We do this because it's necessary to run the service (a "legitimate interest"). We do not read your private messages or in-game mail to do it.
We keep the game's history for the long term — that's the whole point of preserving it:
In short: kept safely for as long as it's useful for preserving the game and letting you return — and deleted whenever you ask.
You have the right to:
To exercise any of these, contact joost@damad.be (the controller contact above). We respond within one month. There is no charge for a reasonable request.
Most email addresses in the 1998 archive stopped working two decades ago. Trying to contact every former player individually would be impossible or disproportionate, so — as the GDPR allows in that situation (Art 14(5)(b)) — we inform you through this public notice instead. Please share it with anyone who played.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with your data-protection authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données (GBA/APD); you can find its current contact details on its website.
We would, of course, prefer you contact us first so we can put things right.
If we change how we handle your data, we will update this notice and its "last updated" date.