Registration
MapleTime processes your account name, email, and password to create a game account. Passwords are stored as one-way hashes, not readable text. Website editors never receive your password.
Verification details are kept until your request finishes or expires. Once a request finishes or expires, its result is kept for up to 30 days to support delivery and investigate abuse.
Account access and recovery
A short-lived cookie keeps you signed in on the website. Password or email changes let MapleTime reject older website sign-ins.
Recovery processes the submitted account name and email to check ownership of an already-verified address. The response does not reveal whether an account exists. Reset links expire, work only once, and can only reset a password. Only token hashes, not the reset links themselves, are stored while the request is pending. New passwords are hashed before they are saved.
Abuse prevention
The website keeps short-lived, keyed hashes of network identifiers to limit repeated attempts. It uses Cloudflare Turnstile where enabled for registration, sign-in, and recovery. These identifiers are not published.
Rankings
Public rankings contain character name, level, job, fame, world, guild, and rank. Staff and banned accounts are excluded. Account names, email, password hashes, IP, MAC, HWID, and currency are never included.
Client files
The official play page identifies the released installer and publishes its fingerprint. The website does not request an upload of your client installation.
