Privacy Policy

Draft · not yet in force

DR
AFT

This is a placeholder draft, not the final terms. The final text will be published once the operator has supplied its details (legal name, contact, governing law and so on) and approved it; this page will then be replaced as a whole. Until then nothing here is a promise or a contract.

What the final text will set out

Who is responsible for your information. The operator and its privacy contact: [to be supplied by the operator]
What is collected, and why. For example: account details (the email you give when binding), your save and play records, chat messages, technical logs kept to stop cheating and find faults; and, when you pay, the payment details handled by the payment provider.
Where it is kept, for how long, and who it is shared with. [to be supplied by the operator]
Your rights. Deleting your account and data: you can do it yourself in the game at any time (see below). How to see, correct or export them: [to be supplied by the operator]
Protection of minors, use of cookies and local storage, and how you will be told when this policy changes. [to be supplied by the operator]

What can be said today

Playing as a guest asks for no personal details; the browser stores an account token and your display and sound settings locally.
An email and password are asked for only when you choose to bind an account.
For diagnosing crashes, the game records device and performance data (frame rate, memory, temperature, battery, rendering load, your position in the game) and sends it with your account on the next start or when you press "Send logs"; no contacts, and no location outside the game.
The first time the game starts it makes a random ID for this installation and keeps it in local storage (in the browser, or in the app). The server never stores the ID itself, only a one-way hash of it combined with your browser's name. Up to 8 are kept per account. They are used to notice a sign-in from a device the account has not been used on before, and to tell an invited friend from a second account on the same device.
So that nobody can invite themselves for the reward, the server keeps the network (IP) addresses an account has been opened from as salted one-way hashes, never the addresses themselves: the 8 most recent per account, and one on each invite. They are only compared with one another, to recognise several accounts played from the same network.
These device hashes, address hashes and invite records are erased together with your account.
You can delete your account and its data at any time in the game (Settings → Account → Delete account). It takes effect at once. What is deleted and what is kept is set out on the Delete your account page.

Operator: [operator to be named]. Contact: support@reelfire.gg.