Privacy policy

Last updated 8 October 2026.

Who we are

Eggox is made by Eggvelop ApS, a Danish company (CVR 44287463). We decide what happens with the data described here, so we are its controller under the GDPR. Questions, requests and complaints go to hello@eggox.net.

What we keep

• Your account: your email address, your player name, your password (only as a salted bcrypt hash, so we can't read it), the invite code you joined with, and when the account was made and confirmed. Your email address is encrypted in our database; we only open it to send you mail.
• What you make and do in the game: your spaces and plots, the things you build and where you put them, your characters and outfits, your settings, friends and the experiences you publish. That is the game itself, and the parts you put in shared places can be seen by other players.
• What you say: chat lines (with where and when they were said) and direct messages. We keep them so we can look into a report.
• The age check: only the answer (checked, declined or waiting), which way you checked and when. Never a photo of you, never your ID document, never your date of birth. See below.
• Signing in: one cookie that keeps you signed in (a random key; we store only its hash), and the sign-in keys the Eggox command line holds if you use it.
• Where you're from: the country you pick at the age check, so we can offer your country's own age app.
• Running the service: our servers log requests and errors, which can include your IP address, to keep the game running and stop abuse. Logs rotate away; they don't hold your email address or anything you said.

Cookies and your browser

Eggox keeps a few things in your browser: cookies, and its local and session storage. We ask before anything that isn't needed, and there are no ads, no tracking and no analytics companies watching you play. By kind:

• Necessary (9): Needed for Eggox to work at all: keeping you signed in, protecting forms, remembering your cookie choice and keeping the game running smoothly. They can't be switched off, and they never track you.
• Preferences (16): Remember choices you make, like the size of the UI, the zoom, where you left windows and the country you picked. With these off, Eggox forgets those choices when you close it.
• Statistics (0): Would help us see how Eggox is used. We use none today. If that ever changes, they start off and we ask you first.
• Marketing (0): Would follow you around the web for ads. We use none, and have no plans to.

Every one of them, what it's for and how long it lasts, is in our cookie declaration, which is made from the same list the code is checked against. Change your choice any time: signed out, with the cookie button in the bottom-left corner; signed in, on the Cookies tab of your account page or in the game's Settings.

Why we keep it

• To give you the game you signed up for: your account, your things, your friends. This is our agreement with you (GDPR article 6(1)(b)).
• To keep the game safe and working: stopping cheats, spam and abuse, looking into reports, fixing what breaks. This is our legitimate interest (article 6(1)(f)).
• To check that people who meet others are 18 or over, which you ask for when you start the check (articles 6(1)(b) and 6(1)(f)).
• When the law makes us keep or hand over something (article 6(1)(c)).

We only email you about your account: confirming it, resetting a password, changing your address. No newsletters unless you ask for one.

The age check

Anyone can build in their own spaces. To chat, message, make friends and enter the shared world, you check your age once, one of two ways:

• An EU age app (Denmark's AltID today) answers "18 or over: yes or no" on your phone, signed. We see only that answer.
• Your ID and a selfie, checked by our partner Didit. Didit reads your date of birth from the document, checks the photo is really you and live, and tells us the result. Didit handles your document and photos under its own privacy terms; we never receive or store them.

Who helps us

We don't sell your data and we don't share it with anyone to market to you. These companies run parts of Eggox for us and only handle data on our instructions:

• Hetzner Online (Germany): the servers, the database and file storage, in the EU.
• Cloudflare: sends our emails, so it sees your address and the message, and runs our domain names.
• Didit: the ID check, only if you choose that road.

If a request for your data comes from the police or a court, we hand over only what the law requires.

The Discord server and other sites we link to are run by others, under their own policies.

How long

Your account and what belongs to it stay for as long as you have the account. You can delete it yourself on your account page, at once: your account, your email address, your messages, your age check, everything you made and everything you placed go with it. Copies of your designs that other players already took stay in their bags, since those are theirs. Our backups still hold your data until they roll over, within 30 days. We may keep what the law requires (records of a payment, for bookkeeping) or what we need for an open report, for as long as that takes.

What you can ask of us

You can see what we keep about you, correct it, delete it, take it elsewhere, restrict what we do with it, or object to it. Most of that you can do yourself on your account page: download everything we have on your account as one file, change your email and password, and delete the account. For anything else, write to hello@eggox.net from the address on your account and we'll answer within a month.

If you think we've got it wrong, you can complain to Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk), or the authority where you live. We'd like the chance to put it right first.

Young players

Eggox is for players 13 and over. Players under 18 can build in their own spaces but can't chat, message or meet other players. If you believe a child under 13 has an account, write to us and we'll delete it.

Keeping it safe

Connections are encrypted, email addresses are encrypted in the database, passwords are hashed, and only the people who run Eggox can reach the servers. If something goes wrong that puts your data at risk, we'll tell you and the authorities as the law requires.

Changes

When this policy changes, the date at the top changes too. If the change matters, we'll tell you in the game or by email before it takes effect.