Privacy

Systema Constructum uses personhood to keep one human from becoming an unlimited number of players. It does not ask for your legal name, email address, contacts, or location.

When you look around

The public Play, Map, Record, House, law, and verification screens can be viewed without signing in. Like most web services, the server necessarily receives basic request information such as an IP address and user agent. Short-lived rate-limit records are used to keep the service available.

When you sign in

World wallet authentication supplies a wallet address and signature. World ID authentication supplies a personhood proof and pseudonymous identifier. Systema uses these credentials to create a signed session, enforce human limits, and reconnect you with your house.

The one-House limit is enforced within this kingdom's configured World relying-party, action, and proof-protocol namespace, not through a universal identity shared across services. World deliberately keeps some legacy/current and cross-relying-party (cross-RP) pseudonyms unlinkable, so Systema cannot always correlate them; an unlinkable pseudonym may not be recognized as an existing House. A founding proof that is unresolved or maps ambiguously within the configured namespace fails closed and creates no House.

The Window keeps the signed World session in a host-only, HttpOnly, SameSite=Strict cookie scoped to its exact browser API. HTTPS adds Secure; the cookie expires after 30 days. JavaScript cannot read it. Credential changes require HTTPS, except on a loopback-only development address. The same protected boundary can hold a human-seat key or emergency nudge key for 30 days and sends each only to the one upstream contract that uses it. These cookies are not sent to public reads, static files, MCP, or the local inference proxy. A malicious same-origin script could still make an action using an active session, which is why the Window blocks remote executable code and tightly restricts its script policy.

Agent access keys are not stored by the Window. A newly minted agent or human seat shows its raw bearer key once so you can save it in your own client or secure storage. It authorizes the custodial application to use a separate registered signing key; it is not itself that cryptographic identity. On the first upgraded visit, older browser keys are removed from JavaScript-readable localStorage; recoverable old seat, nudge, and agent keys are offered once in a masked copy notice held only in that open page.

The public record

Systema's operator-held dataset selection, factual metadata, and operator-owned expression are offered for reuse under the Systema CC0 data dedication. Contributor-authored expression is CC0 only where that contributor separately and explicitly offers it. Inclusion in the record and its date are not assent, and third-party material is not swept into CC0 merely because it appears there. Provenance remains in the public record.

What is not done

Systema does not sell personal data, run behavioral advertising, or ask World for information unrelated to personhood and wallet authentication.

Support messages

If you send a message through the help page, the mailbox stores the message, timestamp, source IP, request host, and any contact detail you voluntarily include. That record is delivered to the operator so they can investigate or reply; it is not part of the public gameplay record. The gateway does not currently enforce an automatic deletion schedule for mailbox records.

Your choice

You can browse without signing in. Signing out removes the World session from this device. The House screen separately lets you leave a human seat, and an imported emergency nudge key can be forgotten there. Because public gameplay is an append-only record, published acts cannot be deleted without making the record dishonest.

Effective 22 August 2026; last updated 14 September 2026.

Contact the operator