Wild West Gunfighter Privacy Policy

Effective date: October 10, 2026
Last updated: October 10, 2026

Read this first:

• What we collect: your account details (email, or sign-in through Discord or X), your game data (your stable, duels, and Virtual Items), Lobby Talk chat messages, and basic technical data such as your IP address in our server logs.
• What's public: your Manager name (or your account username, if you haven't chosen a Manager name), gunfighter names, duel results, after-action reports, and leaderboard standings can be seen by other players and the public. Chat is not private. We recommend choosing a Manager name (Section 4.2).
• No selling: we do not sell your personal information, and we do not share it for targeted advertising. We use only one essential cookie.
• Age: you must be 13 or older to play. Players aged 13 to 17 need a parent's permission (Terms Section 2).
• Deleting your account: email editor [at] innerlizard [dot] com from the address on your account (Terms Section 15.1).

1. About This Policy

Plain summary: This explains what information Inner Lizard collects when you play Gunfighter, why, and what choices you have.

1.1 Who we are. Wild West Gunfighter ("Gunfighter" or the "Game"), sometimes called "MetaDuel: Gunfighter," is run by Inner Lizard LLC, an Ohio limited liability company ("Inner Lizard," "we," "us," or "our"). We decide how your personal information is used. Under European and UK law, that makes us the "controller."

1.2 What this Policy covers. This Privacy Policy ("Policy") covers the "Service" as defined in our Terms of Service (the "Terms"). That means the Game at gunfighter.io (in desktop and mobile browsers), the Game when you play it as a Discord Activity inside Discord, and the related pages, chat, store, and support we offer. We do not offer a mobile app.

1.3 How this Policy fits with the Terms. This Policy is part of the Terms (Terms Sections 1.2, 13, and 22.1). Words with capital letters, such as "Your Content," "Virtual Items," and "stable," mean the same thing here as in the Terms. "Personal information" means information that identifies you or can reasonably be linked to you.

2. Information We Collect

Plain summary: We collect what you give us, the little that Discord or X send us when you sign in, what the Game records as you play, and the technical data in our server logs.

2.1 Account information. When you create an account, we collect:

• your username (your login name);
• your Manager name, if you choose one (Section 4.2);
• your email address (if you sign up by email);
• your password, which we store only as a bcrypt hash;
• whether you have verified your email;
• your confirmation that you are 13 or older;
• the date you accepted the Terms and this Policy, and the version of the Terms you accepted;
• your account settings, such as your email preference, sound and interface settings, and premium status and expiry.

2.2 Information from Discord. When you sign in with Discord or launch the Game as a Discord Activity, we ask Discord only for basic identity information (Discord's "identify" permission). We store your Discord user ID, your Discord username or display name, and the date you linked your account (Terms Sections 3.5 and 10.2).

• If you create your account through Discord, your Gunfighter username is built from your Discord user ID. Choosing a Manager name keeps it out of public view (Section 4.2).
• We do not receive your Discord password or email, and we do not store your Discord avatar.
• We use Discord information only to sign you in, link your accounts, and run the Game inside Discord.
• We do not use Discord information for advertising or profiling, and we do not sell it or give it to advertising or data-broker services.

2.3 Information from X (Twitter). When you sign in with X, we store only your X handle and numeric X user ID. Together they become your Gunfighter username (Terms Sections 3.1 and 10.3). Choosing a Manager name keeps them out of public view (Section 4.2).

• We do not receive your X password.
• We do not store your X email, name, or profile image.
• X's sign-in token is kept only in your server session while you are signed in.
• Loading our sign-in pages contacts X's servers to prepare "Sign in with X."

2.4 Gameplay information. As you play, the Game records:

• your stable and gunfighters, including their names, levels, skills, gear, and avatars;
• your duels, results, after-action reports, and in-game intel;
• your leaderboard standings;
• your Virtual Items, scrip, premium status, and redeemed game codes (Terms Sections 8 and 9);
• game logs we use to resolve duels, fix bugs, and detect cheating (Terms Section 7.3).

2.5 Lobby Talk (chat). When you send a message in Lobby Talk, we store the message, your account username, the name shown with it (your Manager name, if you have one), your gunfighter name, and the time it was sent (Terms Section 6). See Section 5.

2.6 Avatars. Gunfighter avatars come from our own built-in image library, and you cannot upload your own images today. If we add photo uploads later (for example, as a premium feature), staff will review each image before it is approved (Terms Section 6.4), and we will update this Policy first.

2.7 Duel invitation emails. When another player challenges your gunfighter to a Play-By-Email duel, we send the invitation to the email address on your account, if your email preference allows it. The challenger never sees your email address, and we don't send duel invitations to people who aren't players.

2.8 Purchases and game codes. Game codes are sold through our Shopify store (metaduel.myshopify.com), reached from our game code page (Terms Section 8.4).

• Shopify and its payment service, Shopify Payments, handle checkout and payment. Shopify's own privacy policy covers the information you give it.
• We do not receive or store payment card information on our site.
• When you redeem a game code, we record which account redeemed it.

2.9 Support, reports, and legal requests. When you email us, we keep your message and our reply. This includes support questions, abuse reports (Terms Section 6.7), appeals (Terms Section 7.4), account deletion requests (Terms Section 15.1), arbitration notices or opt-outs (Terms Section 20), and DMCA notices (Terms Section 12).

2.10 Technical information.

• Server logs: our web hosting servers keep standard logs of each request. These include your IP address (which can show your general location), browser and device type, the page you came from, the page you requested, and the date and time. Our PHP error logs may also contain these details, or a username, when something goes wrong.
• What we don't store: we don't store IP addresses or browser details in the game database. We read your browser type only to choose the desktop or mobile layout.
• Cookies: see Section 7.

2.11 What we don't collect. We do not collect your precise location, government ID numbers, payment card numbers, health information, or other sensitive information. Please do not send these to us, in chat or anywhere else.

3. How We Use Information

Plain summary: We use your information to run the Game, keep it fair and safe, handle game codes, and talk to you about your account.

We use personal information to do the following. The legal basis we rely on in the EU and UK is shown in brackets (see Section 11.4).

• Provide the Service: create and secure your account, sign you in through Discord or X, run duels, save progress, show leaderboards and after-action reports, deliver Lobby Talk, and send Play-By-Email invitations. [Contract]
• Handle game codes and premium benefits: record redemptions, apply premium time, and handle chargebacks (Terms Section 8). [Contract; Legal obligation for tax records]
• Keep the Game safe and fair: moderate chat and names, investigate reports, detect cheating and multi-accounting, enforce the Terms (Terms Sections 4 to 7), and protect our systems. [Legitimate interests]
• Account emails and notices:
  • email verification and password reset;
  • security and service notices;
  • notices of changes to the Terms or this Policy (Terms Section 22.6).
  [Contract; Legitimate interests]
• Improve the Game: fix bugs and balance gameplay using game records. [Legitimate interests]
• News emails: we do not send newsletters or promotional emails today. If we start, we'll say so here first, and you'll be able to opt out on your account page. [Legitimate interests]
• Legal and safety: comply with the law, respond to valid legal requests, and protect the rights and safety of players, the public, and Inner Lizard. [Legal obligation; Legitimate interests]

We do not use automated decision-making that has legal or similarly significant effects on you. Staff make enforcement decisions (Terms Section 7.4).

4. What Is Public

Plain summary: Your game identity is public. That's your Manager name if you've chosen one, and your account username if you haven't. Don't use your real name.

4.1 Public by design. These may be shown to other players and to anyone on the internet (Terms Section 4.1):

• your Manager name, or, if you haven't chosen one, your account username (Section 4.2);
• your gunfighter names, levels, and avatars;
• your wins and duel results;
• after-action reports;
• leaderboard standings.

Search engines may index public pages, and other people may copy what they see. We can't pull back information that others have already copied.

4.2 Manager name or username: what others see. Your Manager name is the name of the person who runs your stable of gunfighters (Terms Section 4.1).

• Choosing one: you can choose a unique Manager name once. After that, you can't change it yourself.
• Your gunfighters: all of your gunfighters, current and future, are associated with it.
• If you have chosen a Manager name: other players and the public see it instead of your account username. That includes leaderboards, the lobby and Lobby Talk, challenges, after-action reports, and anywhere else a username is shown. Your login username stays private.
• If you have not chosen one: your account username is shown in those places. If you signed up with X, your username includes your X handle and numeric X user ID. If you created your account through Discord, it includes your Discord user ID.
• We recommend choosing a Manager name. It keeps your Discord or X details out of public view. It also keeps your login username private, which makes your account harder to attack.

4.3 Protect yourself. Manager names, like all names, must follow the naming rules and the Code of Conduct (Terms Sections 4.2 and 5).

• Names may not include real full names, phone numbers, addresses, or email addresses (Terms Section 4.2).
• We check Manager names against a list of banned words.
• Staff may reject or reset a name that breaks the rules, or require you to choose a new one, even though you can't change your Manager name yourself (Terms Sections 4.3, 4.5, and 7.4).

Please don't share personal details in chat (Terms Section 5.2).

5. Lobby Talk and Moderation

Plain summary: Chat is live, stored for 180 days, and not private. Staff may read it to keep players safe.

5.1 How Lobby Talk works. Messages appear live and are not reviewed before they appear (Terms Section 6.1).

• What we store: each message, your account username, the name shown with it (your Manager name, if you have one), your gunfighter name, and the time sent, all in our database.
• Pusher: our real-time messaging provider, Pusher, delivers messages to the lobby.
• Who sees what: people in the lobby can see your Manager name (or your account username, if you haven't chosen one), gunfighter name, and level.
• Deletion: messages are deleted automatically after 180 days.

5.2 Who can see chat. Other players in the lobby can see your messages. Inner Lizard staff may read, review, filter, hide, or remove chat, and may keep specific messages longer when they are part of a report or investigation (Terms Section 6.3). Chat is not private or end-to-end encrypted.

5.3 Reports to Discord and law enforcement. We may share information about conduct with Discord or law enforcement when we think it is appropriate (Terms Section 7.1). We will report any content that sexualizes a minor to law enforcement (Terms Section 5.2).

6. How We Share Information

Plain summary: We share information only with the companies that help us run the Game, the platforms you choose to use, and authorities when the law or safety requires it. We don't sell it.

6.1 Service providers. These companies process personal information on our behalf, and may use it only to provide their services to us. Appendix A lists them all.

• HostGator: hosts our website, database, and server logs. Our account and duel emails are sent from our HostGator hosting server.
• Pusher: delivers Lobby Talk messages.
• Shopify: runs our store, with payments handled by Shopify Payments.

6.2 Content delivery services. Some pages load standard code libraries or videos from outside services. These services receive your IP address and basic browser information when your browser loads them:

• jsDelivr: the Bootstrap page-layout library.
• Google Hosted Libraries: the jQuery library, on a few sign-in pages.
• YouTube: tutorial videos, embedded using YouTube's privacy-enhanced (youtube-nocookie.com) mode. If you play a video, YouTube's own policies apply.

6.3 Platforms you use. When you play inside Discord, sign in with Discord or X, or buy through Shopify, those companies also collect information under their own privacy policies (Terms Section 10). We are not responsible for their practices.

6.4 Other players and the public. As described in Sections 4 and 5.

6.5 Legal, safety, and disputes. We may share information when we believe in good faith that it is needed to:

• comply with the law or a valid legal request;
• enforce the Terms;
• protect anyone's safety, rights, or property;
• prevent fraud or abuse;
• take part in arbitration or a court case under Terms Section 20, including with the American Arbitration Association.

6.6 Business transfers. If Inner Lizard is part of a merger, acquisition, reorganization, or sale of assets (Terms Section 22.4), personal information may move to the new owner. The new owner must honor this Policy for the information it receives, or we will give you notice of any change.

6.7 With your permission. We share information in other ways only if you ask us to or agree.

6.8 No sale, no sharing for targeted ads. We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are used in US state privacy laws. That includes the information of players under 16. We do not show third-party ads in the Game.

7. Cookies and Similar Technologies

Plain summary: We use one essential cookie to keep you signed in. No tracking or advertising cookies, so there's nothing to opt into.

7.1 The one cookie we use. We set one cookie, PHPSESSID, which keeps you signed in and keeps your session secure.

• It's marked Secure and HttpOnly.
• It ends when you close your browser.
• On our server, the session expires after about 24 minutes of inactivity.
• We have no "remember me" cookie, and we use no tracking or advertising cookies.

Because this cookie is strictly necessary to provide the Service, we don't ask for consent to it; we just tell you about it here and in a notice on our site. If you block it in your browser, you won't be able to sign in or play. See Appendix B.

7.2 Browser storage. The Game also uses two small items of browser storage, for function only, not tracking:

• A Discord Activity flag: a short-lived note in your browser's session storage that the Game was launched from Discord. It's deleted when you close the tab.
• A Pusher connection setting: the Pusher chat library remembers its connection method in your browser's local storage.

7.3 Inside Discord. When you play as a Discord Activity, the Game runs inside a frame in Discord. Our session cookie works the same way there, but is "partitioned," which means the browser keeps it only for use inside Discord. Discord sets its own cookies under Discord's policies.

7.4 Global Privacy Control and Do Not Track.

• We honor the Global Privacy Control (GPC) signal as a request to opt out of any sale or sharing of your personal information. Since we don't sell or share it, nothing further changes.
• There is no common standard for "Do Not Track" signals, so we don't respond to them separately, but we don't track you across other sites.

8. Children and Teens

Plain summary: Gunfighter is for players 13 and up. If we learn a child under 13 has an account, we close it and delete their information.

8.1 No children under 13. You must be at least 13 to use the Service (Terms Section 2.1). The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not use the Service or send us any information.

8.2 Players aged 13 to 17. Players aged 13 to 17 (or under the age of majority where they live) may play only with a parent or guardian's permission (Terms Section 2.2). Purchases must be made or approved by a parent or guardian (Terms Section 8.8). We do not sell or share teen players' information for targeted ads, and the same moderation rules that protect all players apply.

8.3 If we learn a child under 13 has an account. If we learn that an account belongs to a child under 13 (Terms Section 2.3), for example from a parent's report, the player's own statement, or information from a platform, we will:

• suspend the account right away;
• delete the account and the personal information we hold for it, including email and chat messages, normally within 14 days;
• keep only what the law allows us to keep and we need in order to stop the account being re-created;
• confirm the deletion to the parent or guardian if they contacted us.

We won't let the account continue because of earlier sign-up answers, and the player can't simply re-confirm their age.

8.4 For parents. If you believe your child under 13 has given us information, or you are the parent or guardian of a player aged 13 to 17 and want to see or delete their information, email editor [at] innerlizard [dot] com. We will ask for information to confirm the request.

9. How Long We Keep Information

Plain summary: We keep information only as long as we need it, then delete it or strip out anything that identifies you.

Backup copies of game data follow the same schedule. Some information stays after deletion in de-identified form, such as anonymized duel results, or where other players already saw it, such as a shared duel log (Terms Section 6.5). We may also keep information longer when the law requires it or to resolve a dispute.

10. Closing Your Account and Deleting Your Data

Plain summary: Email us from your account address and we'll delete your account after confirming it's you.

10.1 How to ask. Email editor [at] innerlizard [dot] com from the email address on your account, and ask us to close and delete it (Terms Section 15.1). If you signed in only through Discord or X, include your username (or Manager name) and your Discord name or X handle.

10.2 Verification. We will confirm that the request comes from you before deleting anything. This protects you from someone else deleting your account.

10.3 Timing and effect. We aim to complete deletion within 30 days, as described in Section 9. Closing your account ends access to all Virtual Items, with no refund except where the law requires (Terms Sections 8.7 and 15.1). We may add a self-service option on your account page later.

10.4 Unlinking Discord or X. You can ask us to unlink Discord or X. You can also remove the Game's access from your Discord or X account settings. If you do, sign-in through that service will stop working.

11. Your Privacy Rights

Plain summary: Wherever you live, you can ask to see, fix, download, or delete your information. Some places give extra rights by law.

11.1 Rights we offer everyone. Wherever you live, you may ask us to:

• access: tell you what personal information we have about you and give you a copy;
• correct: fix inaccurate information;
• delete: delete your information (see Section 10);
• portability: give you your information in a commonly used electronic format;
• opt out: opt out of any sale, sharing for targeted ads, or profiling. We don't do any of these, but you can still record your choice;
• withdraw consent: withdraw any consent you have given us.

We will not treat you differently, for example by charging different prices or giving worse service, for using these rights.

11.2 How to ask.

• Where to send it: email editor [at] innerlizard [dot] com with "Privacy Request" in the subject line.
• Verification: we will verify your identity, usually by confirming control of the email on your account.
• Agents and parents: an authorized agent, or a parent or guardian, may make a request for you if they show they are allowed to act for you.
• Timing: we respond within 45 days. If we need more time, we'll tell you why, and we may extend the deadline once by up to another 45 days where the law allows.

11.3 Appeals. If we deny your request, you may appeal by replying to our answer with "Appeal" in the subject line. We will answer within 60 days. If you're still unhappy, you can contact your state attorney general or other regulator.

11.4 EU, EEA, and UK players. If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR gives you these rights:

• access, correction, deletion, restriction, portability, and objection (including to processing based on legitimate interests);
• the right to withdraw consent at any time.

Legal bases. We rely on the legal bases shown in Section 3:

• contract, to provide the Service you signed up for;
• legitimate interests, to keep the Game safe and fair, secure our systems, improve the Game, and send any future news emails, where those interests are not outweighed by your rights;
• legal obligation, for tax records and legal requests.

Complaints. You may complain to your local data protection authority. In the UK, that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to resolve your concern first.

We have not appointed an EU or UK representative.

11.5 California and other US states. Some US state privacy laws, such as California's, give residents the rights in Section 11.1, and we offer those rights to everyone. In the past 12 months, we collected the categories of information described in Section 2:

• identifiers, such as username, Manager name, email, Discord or X ID, and IP address;
• commercial information, such as game codes and premium status;
• internet and electronic activity, such as server logs and gameplay;
• general location, inferred from IP address.

We collected them from the sources in Section 2, for the purposes in Section 3, and disclosed them only as described in Section 6. We do not collect or use sensitive personal information to infer characteristics about you.

12. Security and Breach Notification

Plain summary: We take reasonable steps to protect your information, and we'll tell you if a breach affects you.

12.1 How we protect information. We use reasonable safeguards suited to a small game studio, including:

• encrypted HTTPS connections;
• passwords stored only as bcrypt hashes;
• access limited to staff who need it;
• keeping credentials out of our code;
• regular backups.

No system is perfectly secure, and we can't guarantee the security of information. Please use a strong, unique password and keep your linked accounts secure (Terms Section 3.3).

12.2 If a breach happens. If a security breach affects your personal information, we will notify you and the authorities as the law requires. Ohio law, for example, requires notice within 45 days of discovering a breach. Notice will normally go to the email on your account. If the breach involves information we got from Discord, we will also notify Discord, as Discord's developer terms require.

13. International Users and Data Transfers

Plain summary: Gunfighter is run from the United States, so your information is processed there.

Inner Lizard is in the United States, and our hosting and service providers process information mainly in the United States. US data protection laws may differ from those where you live.

When we transfer personal information from the EEA or UK, we rely on appropriate safeguards, such as:

• a service provider's certification under the EU-US Data Privacy Framework (and its UK Extension);
• the European Commission's Standard Contractual Clauses (with the UK Addendum).

You may ask us for more information about these safeguards.

14. Third-Party Services and Links

Plain summary: Discord, X, Shopify, and other sites have their own privacy policies.

The Service connects to or links to services we don't control, including Discord, X, Shopify, and YouTube (Terms Section 10). Their own terms and privacy policies govern what they collect. Please review them:

• Discord: discord.com/privacy
• X: x.com/privacy
• Shopify: shopify.com/legal/privacy
• Google and YouTube: policies.google.com/privacy

15. Disputes

Plain summary: Privacy disputes follow the same process as other disputes in the Terms, but you never lose the right to complain to a regulator.

Any dispute about this Policy is handled under Terms Section 20. That means first an informal attempt to resolve it, then binding individual arbitration, unless you opt out, and subject to the small-claims and other exceptions. Ohio law governs, as stated in Terms Section 20.8.

Nothing in this Policy or the Terms limits your rights under privacy or consumer laws that cannot be waived (Terms Section 20.9). That includes your right to complain to a data protection authority or state attorney general.

16. Changes to This Policy

Plain summary: If we update this Policy, we'll change the date at the top and, for big changes, let you know first.

We may update this Policy from time to time. When we do:

• Date: we'll post the new version here and update the "Last updated" date.
• Notice of material changes: we'll give reasonable notice where practical, for example by email, an in-Game message, or a notice on our site (matching Terms Section 21).
• Consent: if a change would use personal information we already hold in a materially different way, we'll ask for your consent where the law requires it.
• When changes take effect: changes take effect when posted unless we say otherwise. If you keep using the Service after a change takes effect, the updated Policy applies.

Earlier versions are available on request.

17. Contact Us

Plain summary: Questions or requests? Here's how to reach us.

Inner Lizard LLC
5858 Falling Brook Dr.
Mason, OH 45040
Phone: (513) 268-7234
Email (privacy questions, data requests, account deletion, parents' requests): editor [at] innerlizard [dot] com

Copyright (DMCA) notices: see Terms Section 12.

Appendix A: Service Providers and Platforms

Platforms you choose to use. These are independent companies with their own policies:

• Discord: the Activity and sign-in.
• X (Twitter): sign-in. Our sign-in pages contact X's servers.

Appendix B: Cookies and Browser Storage

This Policy is provided in English. If we provide a translation, the English version controls.