It's not based on your IP. It's based on digging through your system attributes and files and other private data to generate a signature to upload home. It's spyware. It also does absolutely NOTHING to address the fact that it still shares the same point of failure that all previous mechanisms used still share: An external, third-party email service. In short, your account STILL has the same point of failure as before, and there's nothing you OR Cryptic can do about it. If there was no fallback method, then security would be limited only to a secret known only to you and Cryptic, and thus no third party could break the chain.

Email-based "recovery" is a blight on the face of Internet security.

Maybe it is something to do with temp internet files then...but I do know that it isn't the same as spyware

The forum, like most forums, likely uses a cookie. I have no guesses on the game itself.

But you're right. It's not spyware. It's not even close to spyware.

Regarding all the "but it goes to your email" silliness, that's actually more secure than security questions and the like. Answers to security questions can typically be easily guessed or even found just be looking around online. If you're that worried that a third-party email provider might somehow compromise your security don't use that provider. Building your own service takes time, patience, and money, but that's the only way you're going to get around any security issues the third-party providers have.

Precisely. Besides if your really worried about security create a new email address and use it for nothing else

This seems to be preventing my Android to use the new STO Gateway that's in BETA testing. Everytime I try to check it from my phone I get the Account Guard thing sending me e-mails when it's supposed to be a 1 time thing.

This feature should be either taken off or make it so the owner of the account can activate it. For the past month I havent been able to play this game cause every code ive been send becomes invalid. I have also sent tickets and the only response I get is how to deactivate it which is useless if you can't get to where you deactivate it without a working code. This feature is unneeded in my opinion.

I didnt know were to say this but here seems appropriate:
I just joined but someone used my email, luckily I changed the password, but I dont like the username can anyone help me?