Privacy Policy
info.example.com · Last updated: 2026-11-12
This page explains which personal data we process when you visit info.example.com and play the game, why we need it, how long we keep it and what your rights are.
1. Controller
info.example.com is a private, non-commercial project. The controller is its operator, reachable at contact@example.org. Please send every privacy request to this address.
2. In short
- You can play as a guest without an account, or create an account.
- We use no advertising or analytics services and no tracking cookies.
- Fonts and images come from our own servers, not from third parties.
- To fight abuse (cheating, ban evasion) we keep IP addresses for a limited time, see section 8.
- Only the sign-up form loads a bot check by Cloudflare (Turnstile), and we keep the IP address an account was created from, see section 5.
- While you play, the game checks its own page for modified browser functions and foreign scripts, and reports findings for a person to review, see section 8.
- Some account data is public in the game, see section 6.
3. Hosting and infrastructure
When you open the site and play, your IP address, the date and time, the requested address and information about your browser are processed because this is technically necessary to deliver the site, connect you to a game server and fend off attacks (Art. 6(1)(f) GDPR: legitimate interest in a secure and stable service).
| Service | Provider | Purpose |
|---|---|---|
| DNS, CDN, website (Cloudflare Pages), DDoS protection | Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Delivering the site and the game files, passing connections on to the game servers, protection against attacks |
| Game servers | netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany | Servers in Nuremberg (Germany) and in Manassas, Virginia (USA). You play on the server with the best ping unless you choose a region. |
| Database, sign-in, file storage | Supabase, Inc., 970 Toa Payoh North #07-04, Singapore (data centre: Frankfurt am Main, Germany) | Accounts, progress, shop, leaderboards, bans |
| Bot check of the registration (Cloudflare Turnstile) | Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Telling people apart from automated sign-ups; only in the sign-up form |
| Sending confirmation e-mails | Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA | E-mails to confirm an account and to reset a password |
We have data processing agreements with these providers (Art. 28 GDPR). Where data goes to the USA (Cloudflare, Resend, the game server in Virginia), this is based on the European Commission's standard contractual clauses or on an adequacy decision (EU-US Data Privacy Framework) where the provider is certified under it. If you play on the server in the USA, the connection data and the game data of that match are processed there.
4. Playing as a guest
Without an account you need no e-mail address. Your progress (settings, statistics, guest inventory) is stored in your browser. So that guest progress can be carried over when you sign up later, your browser creates a random guest key that the game server checks in matches. During a match the game server processes your player name, your inputs and positions and your IP address. Legal basis: Art. 6(1)(b) GDPR (providing the game) and Art. 6(1)(f) (security).
5. Account
For an account we store your e-mail address, your username and your password (only as a hash, we cannot read it). We send you an e-mail to confirm the address. Your e-mail address is never shown to other players and is never used as your name. On top of that we store what comes from playing: level, statistics, rank and Elo, match results, best times, unlocked items and settings, friends and clans, messages in your inbox and your profile look (picture, banner, name style, clan tag). Legal basis: Art. 6(1)(b) GDPR. We keep this data until your account is deleted; write to us to have it deleted.
Registration
To prevent abuse (mass registrations, accounts from networks we had to block, ban evasion) we store with every new account the IP address it was created from, the time and whether the bot check was passed. The IP address is kept for 180 days; it is also the first entry of the list of IP addresses of your account (section 8). Each mailbox may have only one account: for this we keep a normalised form of your e-mail address (lower case, without a “+tag” and, for Gmail, without dots). Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a registration without abuse).
The sign-up form contains Cloudflare Turnstile, a check that tells people apart from bots. It is loaded from Cloudflare (challenges.cloudflare.com) only when you open the sign-up tab – never for signing in, resetting a password or playing. Turnstile processes your IP address, information about your browser and device and how the page is used, only to decide whether a person is signing up; it shows no advertising and sets no tracking cookies. Our server sends the result of the check together with your IP address to Cloudflare to verify it and then keeps a one-time confirmation (bound to the normalised e-mail address and your IP address) for at most one day. Legal basis: Art. 6(1)(f) GDPR. Cloudflare's own privacy policy applies to Turnstile.
6. What other players can see
A game with leaderboards and friends shows some of your data to others:
- Everyone (also visitors without an account): your username, clan tag, badges and name style, profile picture and profile cosmetics, the date your account was created, your level, rank and Elo, your statistics (for example kills, deaths, accuracy, wins, matches and playtime), your kills per class, whether you are online or in a match, your place on leaderboards and your best times on courses, including the recorded path of top-100 runs.
- Signed-in players in addition: your KP balance, your Elo history and the members of your clan.
- In a match or party: your name, look, position and actions, and your chat messages.
Your e-mail address, your IP addresses, ban details and security data are never public. Legal basis: Art. 6(1)(b) GDPR (the public profile is part of the game).
7. Chat and reports
Chat messages go to the other players in the match, the party or the global chat. A word filter replaces disallowed words with asterisks. Messages the filter changed are stored for 30 days together with the account or name, to improve the filter and to check reports. When you report a player, we store your report and its evidence (for example the last chat lines). Legal basis: Art. 6(1)(f) GDPR (protecting players, enforcing the rules).
8. Security, cheat detection and bans
To keep the game fair we run technical checks and keep security data for them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fair game without abuse and in enforcing bans).
| Data | Purpose | Kept for |
|---|---|---|
| Sign-in log with IP address and browser identifier | Detecting abuse, enforcing bans, detecting second accounts | 90 days |
| List of the IP addresses of an account | Enforcing bans, detecting ban evasion | until the account is deleted |
| Device identifier (a random ID your browser keeps, and hashes of browser and device features such as graphics card, screen and fonts; never the features themselves) | Enforcing bans, detecting ban evasion | 180 days after the device was last seen, longer only while a ban needs it |
| Network details of IP addresses (provider, country, data centre or VPN) | Detecting ban evasion | 180 days after the address was last seen |
| Cheat indicators (account, match, measurements) | Detecting cheating, justifying bans | 180 days |
| Integrity findings (account or guest id, match, names of changed browser functions, a fingerprint and a short excerpt of a foreign script, its address, browser type; for a detected userscript the code of it that was visible on the game page; the IP address, the browser identifier and the device identifier of the session that reported it, for guests too) | Detecting client modifications, reviewed by a person (no automatic decision) | 180 days |
| Match recordings (account IDs and names of the players, no addresses) | Reviewing suspected cheating and reports | 90 days, longer only for a ban or a report |
| Sign-up record (IP address of the registration, time, bot check passed) | Preventing abusive registrations, detecting second accounts | IP address 180 days, the rest until the account is deleted |
| Blocks of IP addresses or networks for new accounts, with the reason | Stopping registrations from networks used for abuse | for the duration of the block, then as a record of the decision |
| Bans (account, IP address) with the reason | Enforcing the rules | for the duration of the ban, then as evidence until claims expire |
Most checks run automatically. A ban is imposed automatically only for clear violations; you can object by e-mail, and then a human reviews the case.
Integrity checks in your browser
While you play, the game checks on the game page whether browser functions it relies on have been changed (for example the functions that draw the game or read your input) and whether a foreign script was added to the page. This helps us keep the game fair against cheats that modify the running game. The check runs only on our own game page; it does not read other sites, your keystrokes or the page content, and it cannot block or remove browser extensions.
If the check finds something, it sends a small report to the game server, which stores it with your account (or, as a guest, the random key your browser uses for your progress), the match you were in, the names of the changed functions, a fingerprint and a short excerpt (at most about 2 KB) of the foreign script with its address, your browser type (for example “Chrome”) and, so that a report can be matched to a player who plays without an account as well, your IP address, your full browser identifier (User-Agent) and the device identifier of section 8 – for accounts and guests alike. The check collects nothing else about your device or your browsing. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a fair game). We keep these findings for 180 days. They never lead to an automatic ban or kick on their own – a person reviews them before any action is taken.
If the check detects a userscript (a script run by an extension such as Tampermonkey or Violentmonkey), the report also contains the code of that script that was visible on the game page – the functions it handed to the page, at most about 1.3 million characters per script – and the game stores it for abuse detection, once per identical text and for the same 180 days. A file inside an extension is read only when it appears in the call stack of a changed game function and only where the extension itself makes that file readable for web pages; the check does not collect the code of other extensions.
9. Storage in your browser
The game stores settings, key bindings, guest progress, your sign-in session and your own images (for example for the crosshair) in your browser's local storage (localStorage, IndexedDB). A service worker keeps game files in the browser cache so the game loads quickly. This is necessary for the service (§ 25(2) no. 2 TDDDG); we set no cookies for advertising or analytics. For bans, the game keeps the random device identifier of section 8 there and in the browser cache. You can delete this data in your browser settings at any time.
10. Links to other sites
The About page links to other sites (for example Kour.io, Poxel.io and our Discord server). Nothing is loaded from them until you click a link; after that, their own privacy policies apply.
11. Recipients
Apart from the processors named above, we only pass data on when the law requires it or when it is necessary to pursue violations of the law.
12. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to contact@example.org. You can also complain to a data protection supervisory authority, for example the one where you live.
13. Minimum age
The game is meant for people aged 16 and over. Younger people do not create an account.
14. Changes
We update this policy when the game or the law changes. The version published here applies, last updated: 2026-11-12.