In short

We keep what it takes to run your account and keep it safe, and nothing more. There are no ads, no trackers and no analytics on this site, and we never sell your data or share it for marketing.

This page covers legacygamers.net and your LegacyGamers Network account. LegacyGamers Network (LGN) is a fan-run community project run by CrazyBebop. You can browse the site without an account; this page is mostly about what happens once you make one.

Last updated November 1, 2026.

What we keep

  • Your account: your username, email address and display name. Your password is stored only as a bcrypt hash, so we never see or keep the password itself. If you only sign in with Discord or Google, there is no password at all.
  • Discord or Google, if you link them: the account ID they give us, plus that account's email address, name and avatar link. We ask Discord only for who you are and your email, and Google only for your basic profile and email. We never keep their access tokens.
  • Passkeys: each passkey's public key and the name you give it. The private key never leaves your device.
  • Two-step verification: your authenticator app's secret, encrypted. Backup codes and emailed codes are stored only as hashes.
  • Where you're signed in: each sign-in session keeps the IP address it started from and a hash of your browser's user agent. That's how Settings shows your devices, and how we notice a sign-in from a new device. The sign-in pages start a session before you sign in too, to protect their forms.
  • Your security activity: sign-ins, password and email changes, two-step and passkey changes, linked accounts and devices signed out, each with its IP address. You can see yours in Settings.
  • Attempt counters: to slow down password and code guessing, we count attempts by IP address, and by account or a hash of what was typed.
  • Our security log: when something probes the site for common attack paths, or a browser reports something our security policy blocked, we log its IP address, country, the page and the browser's user agent. One-time links (password resets, email checks) are blanked out before anything is logged.

Cookies

The site sets at most two cookies, and both are needed for signing in. That's why there's no cookie banner.

  • LGN_SESSION keeps you signed in. It ends when you close your browser, or after 30 days if you tick "Remember me".
  • LGN_TRUST is set only if you tick "Trust this device", so that device can skip the extra check for 30 days.

Nothing is saved in your browser's storage. The night sky reads your browser's time zone to light the scene for your time of day; it never asks for your location and sends nothing anywhere. Turnstile, Cloudflare's check that you're a person, runs on the forms that need it and follows Cloudflare's own privacy policy.

Who else sees it

These services handle part of your data so the site can work. None of them get it for advertising.

  • Cloudflare hosts the site, so every visit passes through it, and runs Turnstile on our forms.
  • Discord and Google see that you're signing in to LegacyGamers Network when you choose to sign in with them.
  • SMTP2GO delivers our emails: email checks, password resets, sign-in codes and security notices. A sign-in notice includes the IP address, country and device the sign-in came from, so you can spot one that wasn't you.
  • Have I Been Pwned checks a new password against known leaks. It gets only the first 5 characters of a hash of the password, never the password or anything that says who you are.
  • Our own servers hold the database, our monitoring and our backups. We run them ourselves.
  • Our staff can see account details in our admin panel, to help you and to stop abuse.

How long we keep it

  • Your account: until you delete it.
  • Sessions: until you sign out or they expire, after 24 hours or after 30 days with "Remember me". A session that never signed in is deleted after an hour.
  • Security activity: one year.
  • Our security log: 180 days for blocked probes and browser reports, one year for everything else.
  • Password reset links: they work for an hour and are deleted a day later.
  • Sign-in notice records (so we don't email you twice in an hour): 30 days.
  • Attempt counters: cleared when you sign in, or a day after a lockout ends. Any other counter is deleted once it has gone unused for 30 days.
  • Backups: a copy of the database every day, each kept for 14 days.

Your choices

  • See and change your details, sign-in methods, devices and activity in Settings.
  • Unlink Discord or Google, remove a passkey, or sign out your other devices at any time.
  • Delete your account in Settings. Your account, linked sign-ins, passkeys, two-step data and trusted devices are deleted right away. Your security activity stays, no longer tied to your account, until it ages out after a year; that includes a record of the deletion with your username and email, so we can deal with abuse. Backups roll over within 14 days.
  • Download a copy of your data in Settings. Want something deleted that you can't delete yourself? Ask us and we'll take care of it.

LegacyGamers Network isn't meant for children under 13. If you think a child under 13 has an account, tell us and we'll delete it.

If this page changes, we'll update the date at the top, and we'll post about any big change on our Discord.

Contact us

Questions about your data, or a request? Message us on our Discord (opens in a new tab), or email security@legacygamers.net.