What is stored, and why.

Your account: the email address you confirmed, the name you chose, and your language. Your password is stored only as an argon2id hash, which cannot be turned back into the password. If you use two-step sign-in, its secret is stored encrypted and its recovery codes only as fingerprints. If you sign in with Steam or link it, also your SteamID, your Steam display name and avatar. And when you were last here.

When you sign in, a random session token is created. What is kept is only its fingerprint, when it expires, a scrambled version of your IP address, and your browser description.

For security, Caria Core keeps a log of sign-ins and account changes (a new password, a new address, two-step sign-in turned on or off). It holds no passwords and no plain IP addresses. Failed sign-ins are counted per address, with the address scrambled, so repeated guessing can be paused.

Anything you write here, like a support ticket, is stored so the site can show it back to you, along with which of the two notification switches are on.

If you sent a work inquiry from the services page while it was on the site (until 24 October 2026), what you typed in it is kept: your name, the email or phone you left, your business and your message. Your IP address was not stored with it.

If your browser asks for one of the site's languages first, the site opens in it. If you pick a language yourself, with the language menu at the top or the card in the corner, your browser keeps that choice in one small cookie for a year. It holds only the language's code, such as "en" or "de", and nothing is stored about it on the site's side. Closing the small card in the corner sets one more cookie, which says only that it was closed. Switching between light and dark does the same: one small cookie that says only which one you chose.

If you chat with Bit, the assistant in the corner of the page, the chat is stored with your account: what you wrote, what Bit or a member of staff answered, and any ticket or feedback report it led to. A feedback report keeps a short summary of the problem, without your name or address. Files you attach in the chat (a screenshot or a log file) are kept with it; a picture is saved again as a new image, without the hidden details a phone or camera adds, such as location.

Signing you in and keeping your account safe. Confirming your address, resetting your password, and telling you when something important changes on your account. Showing your name next to your words. Answering your tickets, and telling you when one is answered if you asked for ticket notices. Answering the work inquiries sent before then. Announcements only ever go to addresses whose box is ticked. Nothing else.

Chats with Bit are used to answer you, to open a ticket when you ask for one or when the problem is serious (a crash, lost data, a payment, a security issue), and to collect feedback about the games and Zelie.

Your password in a form anyone could read back, Caria Core included. Tracking profiles, analytics, or anything for advertisers. This site runs no analytics.

Account emails (confirming your address, resetting your password, ticket notices) are sent through Resend, so they see your address and that message. Steam confirms a Steam sign-in and serves your avatar, so Valve sees those requests. Cloudflare delivers the site, so traffic passes through them. The database lives on Caria Core's own server. Nobody else gets your data, and it is never sold.

Bit's answers are written by an AI model from an outside provider in the United States. When you chat, your messages, your display name and the chat so far are sent to that provider to write the answer; your email address, password and IP address are not. Files you attach are not sent to the provider. Under the provider's terms for this kind of use, chats are not used to train its models. Chats are also copied to a private staff channel on Discord, with your display name and account number, so a person can step in.

Sessions last 30 days and expired ones are deleted. Changing or resetting your password, or turning two-step sign-in on or off, ends your other sessions. If your account is banned or deleted, its sessions die with it.

A sign-up that is never confirmed does not become an account: its link runs out after a day and is deleted a week later. Password reset links run out after an hour.

Your account address is used for account mail and for the boxes you ticked, nothing else. A ticket's own address is used for that ticket only. Ask for something to be deleted and it will be.

A work inquiry stays as the record of that conversation. Ask for it to be deleted and it will be.

A chat with Bit is deleted 30 days after it started, and its Discord copy with it. So are the files attached to it. If it became a ticket, the ticket keeps its own copy of the chat for as long as the ticket exists. Its files stay with the ticket too. Feedback reports are deleted after a year.

Ask what Caria Core holds about you, have it fixed, or delete your account and its data. Write from your account address, or give your Steam profile, so it is clear it is you. The support address is in the footer of every page.