Privacy

A clear view
of your privacy.

The public pages use no advertising trackers or analytics. The account portal creates limited-preview world accounts and lets MutSea users manage their world credentials and web profile.

One MutSea identity

At mutsea.com/account/, create a preview account or sign in with your existing avatar name and world password. Finalverse links to this same portal. We check credentials through the existing MutSea authentication service; the portal does not create a second password database. Password changes update the credential used by the viewer.

Registration and provisioning

Registration collects your chosen first and last avatar name, starter character, password and optional email address. Names are persistent world identities, not necessarily legal names. Email is unverified and cannot reset a password. A private PostgreSQL queue holds the provisioning request encrypted while the native runtime creates the account, appearance, outfit, inventory and home. Password ciphertext is removed when processing succeeds, fails or expires after one hour. A server outage can delay this cleanup until the worker resumes. An opaque, secure HttpOnly registration receipt expires after 24 hours; only its digest is stored server-side.

To limit abuse, registration stores a keyed IP digest with the request and permits up to three attempts per 24 hours. The digest is not a raw IP address. Request identity, avatar choice, completion state and timestamps remain for operations and capacity accounting; completed requests contain no password. World-account authentication continues to use the native MutSea service. No AI provider receives registration passwords.

Profile and world information

When signed in, you can view your account name, avatar ID, creation date, registered email, home and last known world location and status. Optional About text, contact email and preferred contact language are stored in a separate PostgreSQL web-profile record. These preferences do not replace your in-world profile. The contact email is unverified and is not used for password recovery.

Essential account cookies

Secure, HttpOnly, SameSite Strict cookies hold an opaque session identifier and protect account requests against cross-site submission. Sessions expire after 12 hours or 30 minutes of inactivity. The server stores only a digest of the session identifier. Sign out to revoke that browser session; a password change invalidates every web session. Account API responses prohibit caching. Passwords and recovery codes are not saved in browser local storage.

Recovery and security records

Recovery codes are shown once and stored only as digests. Keep a private copy. A password reset invalidates the entire code set; generate fresh codes after signing in again. Email reset is not available. Security audit records contain the operation type, time and, for successful authenticated operations, avatar ID. The portal retains these for 90 days and prunes expired sessions and rate-limit buckets every 15 minutes. Rate limits use keyed digests rather than raw names or IP addresses. Passwords, request bodies, session tokens and recovery codes are excluded from application logs.

To request correction or deletion of web-profile data, contact info@finalverse.com. We must verify account ownership first. Deleting a web profile is separate from deleting a persistent world identity or content.

Appearance preference

A light or dark theme choice is saved only in your browser’s local storage. It is not transmitted. Clear the site’s browser data to remove it.

Operational logs

The web server may record requests, timestamps, IP addresses, browser information and response status to help diagnose delivery and security issues. The site adds no analytics cookies or third-party tracking scripts.

Project enquiries

The project contact links open your email app. Nothing is submitted automatically. If you send a message, we receive your email address and the information you include so we can respond to the enquiry. This does not register a grid account or order a hosting service.

For questions or deletion of an enquiry, contact info@finalverse.com. Do not send passwords or sensitive credentials.

Future services

Broader public hosting and developer services will require their own service terms and privacy information before launch. Links to other websites lead to their own policies.

GitHub downloads and demo video

Client installers and the optional demo recap are served by GitHub Releases and its asset-delivery hosts. Playing the video or following a download link makes requests to those hosts, which receive normal request information such as your IP address and browser headers. Their own policies apply. The video uses a local poster image and requests no preload; this site adds no advertising or analytics script to the player.

Updated October 17, 2026.