Privacy policy

Who we are

The Astral Orchard is an independent Neopets community operated by the Astral Orchard team. This policy covers this website and its member features. We are not Neopets and do not operate your Neopets account.

Our Neopets guild is coming soon and its council is not yet available as a contact route. A direct contact for privacy questions and account requests has not yet been published. We will add those details here when available. Never post passwords, confirmation codes or sensitive account information publicly.

Information you give us

When you register, we store your display name, email address and a password hash. We do not store your password as readable text. Signing in creates a session record that can include your IP address, browser information and expiry time.

If you use account linking, we store your Neopets username, the linking status, request and confirmation times, expiry time and failed confirmation attempts. We use a confirmation code sent through Neomail to check that you control the account.

During closed beta, we store invitations against the member who creates them, an encrypted copy of each code, a lookup hash and creation, use or revocation times. The joining account stores the invitation hash used to register. Members can see the status of their own invitations, but not the recipient’s name or email. Codes are shared manually; we do not send invitation messages.

Reward codes can be redeemed without an account. We store the creating member, an encrypted code, its status, awarded prize, submitted Neopets username and claim progress, including trading-lot and offer references. Your code and private reward URL allow anyone holding them to resume the claim on another device. Keep them private. Used codes cannot award a second prize. Signed-in recipients may also have the prize associated with their account. Anonymous attempt counters are retained for up to a day before cleanup on a later request. Live claims use Trading Post offers; older preview codes retain simulated delivery.

Competition entries include your title, writing, the challenge you entered and the time you saved it. Entries are associated with your Orchard account. Please keep unnecessary personal information out of your entries and display name.

Why we use it

We use account information to register you, authenticate your visits, protect member pages and associate your saved activity with the correct account. Linking information records the Neopian identity you nominate for the rewards programme. Competition information lets you save and edit your work.

Session and request information helps us operate the website, limit repeated login attempts and investigate faults or misuse. We do not use your account information for advertising, sell it, or build advertising profiles. We use Neomail for account confirmation and reward-related communication, not unsolicited marketing.

Cookies and browser storage

Authentication uses a necessary session cookie to keep you signed in. Sessions are configured to last seven days and may be renewed during use. Signing out ends the current session. Blocking necessary cookies prevents member login from working.

Real spin results, re-spin usage, reserved prizes and transfer progress are stored on our server for your Orchard account and are available across devices. Practice spins and earlier preview discoveries remain in browser storage. Your atmosphere preference is stored for the browser tab session. Clearing browser data removes local previews and preferences, but does not delete your server account, real winnings or saved entries.

The site does not currently use analytics or advertising cookies. Our interface fonts and item images are served from the site. External Neopets and item-information links take you to services with their own privacy policies.

Who can see your information

Your linking information and competition entries are displayed privately to your signed-in account. They are not published in a public member directory or gallery. Site operators with database access can access account and entry records when administering the service.

The infrastructure hosting the site processes the information necessary to serve requests and store records. We may disclose information when required by law or where necessary to investigate misuse and protect the service or its members. Linking and prize collection use your Neopets username to direct confirmation messages and Trading Post offers to the right account.

How long information stays

Account details and saved entries remain associated with your account until removed by the site operator or a database reset. The current service does not automatically delete inactive accounts. Session validity is limited to seven days, although expired database records may remain until maintenance removes them.

Changing your linked account removes the previous link record. Linking codes expire after thirty minutes; expiry does not itself delete the pending username. Local spin records remain until you clear the site’s browser storage. Keep a separate copy of important writing.

Your choices and requests

When published, guides will be available without registering. You can decide whether to link a Neopets username, edit competition entries, change your linked account and sign out. A contact route for access to, correction of or deletion of server-held account information is still being prepared, as described above. We may need to confirm that the account belongs to you before acting on a request.

Depending on where you live, applicable privacy law may give you additional rights, including rights to restrict or object to certain uses, receive a copy of your data, or complain to a local privacy regulator. We will consider requests under the law that applies to you. Clearing local storage alone does not submit a deletion request.

Security and policy updates

We use password hashing, server-validated sessions and account checks on protected actions. No website or storage method can guarantee absolute security. Use a unique Orchard password, keep your device secure and tell the site team if you believe someone else has accessed your account.

We update this policy when the way the service handles information changes. The effective date above identifies the current version. Material changes to how member information is used will be explained before those changes take effect.