Privacy Policy

Exiva ("Exiva", "we", "us", or "our") is a tracking tool for the Tibia Character Bazaar. It lets you browse auctions with advanced filters and, if you sign in, save a filter as a "Radar" so we can notify you when a matching character auction appears. This policy explains what information we collect, why we collect it, how it is used, and the choices you have.

Exiva is an independent, unofficial fan project. It is not affiliated with, endorsed by, or operated by CipSoft GmbH, the maker of Tibia.

Account information (sign-in).Signing in is optional and only required to create a Radar. Authentication is handled entirely by Google or Discord, whichever you choose — we never collect or store passwords. When you sign in, we receive your account ID at that provider, your name, email address, and profile picture, and we store a corresponding user record so we know which Radars belong to you. Each email address may be linked to only one Exiva account, and that account stays tied to the sign-in provider used to create it.

Saved searches (Radar).When you create a Radar, we store the filter criteria you selected (e.g. world, vocation, level range, price range), a name you give it, your chosen notification language, and its expiration date.

Notification data.If a Radar you created matches a new auction, we use your account email address to send you a notification. We keep a record of which auctions we already notified you about so we don't send duplicate alerts.

Automatically collected data.Like most web services, our hosting and content-delivery providers automatically log standard technical data for security and reliability purposes — such as IP address, browser type, device type, and request timestamps. We do not use this data for advertising or profiling.

Local preferences.We store small pieces of data in your browser (cookies / local storage) to remember your session, your preferred language, and your light/dark theme preference. These are functional, not advertising, cookies.

We do not collect payment information, government ID, precise location, health data, or any other sensitive personal data.

• To authenticate you and keep you signed in across visits.
• To create, display, and manage the Radars you configure.
• To send you email notifications when a Radar you created finds a match.
• To operate, secure, and improve the reliability of the service.
• To enforce reasonable usage limits and prevent abuse.

We do not sell your personal information, and we do not use it for advertising.

We do not sell or rent your personal information to third parties. We share data only with the service providers necessary to operate Exiva, each acting under its own privacy and security obligations:

• Google and Discord— for sign-in authentication, depending on which provider you use.
• Vercel— our application hosting provider.
• Resend— our transactional email provider, used solely to deliver Radar match notifications.
• Our backend API and database infrastructure, used solely to store and process the account and Radar data described above.

We may also disclose information if required by law, or to protect the rights, property, or safety of Exiva, our users, or others.

We retain your account record for as long as you have an Exiva account. Radars have an explicit expiration date shown to you when you create them; once a Radar expires or is canceled, it stops being checked against new auctions, and we periodically purge expired/canceled Radar records. You may delete a Radar at any time from the Radar dashboard, and you may request full deletion of your account and associated data at any time (see Section 7).

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) for all traffic, signed and time-limited authentication tokens between our services, and no storage of passwords (authentication is delegated entirely to your sign-in provider). No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable safeguards.

• Access and correction.You can view your active Radars at any time from the Radar dashboard.
• Deletion.You can cancel any Radar yourself. To request deletion of your account and all associated personal data, email us at contact@exiva.io and we will process your request within a reasonable time.
• Withdrawing consent.You can sign out at any time, which ends your session. Revoking Exiva's access from your Google or Discord account settings will also prevent future sign-ins.

Depending on your jurisdiction (for example, under the GDPR or the CCPA/CPRA), you may have additional rights, including the right to obtain a copy of your data, restrict or object to certain processing, and lodge a complaint with a supervisory authority. You can exercise these rights by contacting us at the email above.

Exiva is not directed to children, and we do not knowingly collect personal information from anyone under the age of 13 (or the minimum age required by your country's law). If you believe a child has provided us with personal information, please contact us and we will delete it.

Our service providers may process and store data in countries other than your own. Where this occurs, we rely on the safeguards those providers make available (such as standard contractual clauses) to ensure your data continues to receive an adequate level of protection.

We may update this Privacy Policy from time to time to reflect changes to the service or for legal reasons. The "Effective date" at the top of this page indicates when it was last revised. Continued use of Exiva after a change becomes effective constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at contact@exiva.io.