Privacy policy

In short

• The game has no ads, no analytics and no trackers. This website uses Google Analytics only if you accept it in the cookie banner.
• Without an account, the game keeps your progress on your device and sends us nothing.
• We only collect what a feature you choose cannot work without: an e-mail for release news, an account for ranked play, a nickname for online rooms.
• We don't sell data and don't use it for advertising.

Who is responsible

The controller of your personal data is [privacy.controller] TODO, [privacy.address] TODO.

For anything about your data, write to hello@scrapnado.com.

This website

The website is a set of static pages. Without your consent it sets no analytics cookies and loads no scripts or fonts from other companies.

The only cookie it sets on its own is lang (1 year), and only when you switch the language by hand, so that the website remembers your choice. It is needed for a function you asked for, so it does not need consent.

Like any web server, our hosting provider (Vercel) processes technical data needed to deliver the pages and protect them from abuse: your IP address, the time, the requested page and your browser's identifier (user agent). Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Website statistics (Google Analytics)

If you click "Accept" in the cookie banner, the website loads Google Analytics 4 from Google Ireland Ltd. It sets the cookies _ga and _ga_<id> (13 months) and sends Google the pages you open, where you came from (for example a TikTok or Ko-fi link), your device and browser type, approximate location (country, city) and whether you signed up for the beta. Google Analytics 4 does not store your IP address. Google signals and ad personalisation are off.

We use this only to see how many people visit and which links bring them. Legal basis: your consent (Art. 6(1)(a) GDPR, and Art. 399 of the Polish Electronic Communications Law for the cookies). You can withdraw it at any time under "Cookie settings" at the bottom of every page; we then delete the cookies. If you click "No thanks" or have JavaScript off, nothing is sent to Google.

Our Ko-fi page (ko-fi.com/scrapnado) uses the same Google Analytics account; there Ko-fi's own cookie banner and privacy policy apply.

Release and beta news (e-mail sign-up)

If you sign up, we store your e-mail address, the time you signed up and your consent. We use them only to tell you when the beta opens, when the game is released, and about occasional important news about the game.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every e-mail or by writing to us; this does not affect what we did before.

The list is kept by Neon (Postgres database hosted in Frankfurt, EU, through Vercel), which processes the data on our behalf. We keep your address until you unsubscribe; after that it is deleted, except for a record of the unsubscription if we need it to prove we respected it.

The game without an account

Your progress, settings, nickname, achievements and card collection are saved on your device. Free play, the campaign and couch co-op work offline and send nothing to us.

Online co-op (relay server)

In online co-op, the host's device runs the match and a relay server passes messages between the players in a room. Through the relay go: your nickname, the room name and code, the optional room password, and the game messages themselves (robot positions, inputs, the state of the match).

Rooms and messages exist only in the server's memory and disappear when the room closes. The relay's log notes when a room opens (code, name, the host's nickname) and closes, to keep the service running and fix errors.

To connect, the relay and the network proxy in front of it (Cloudflare) see your IP address. Other players don't: they see only your nickname.

Legal basis: providing the online play you ask for (Art. 6(1)(b) GDPR) and our legitimate interest in keeping it secure and working (Art. 6(1)(f)).

Game account (optional)

An account is only needed for ranked play, the online league and syncing your card collection. The league is currently invite-only and in testing. For an account we keep:

• your e-mail address: login, confirming the address (link valid 24 hours), password reset (link valid 1 hour) and account notices;
• your password only as a hash (argon2id), never the password itself;
• your nickname, which other players see in matches, rankings and on decks you publish;
• the invite code you registered with;
• login sessions: when they started and the app's identifier; the login token is stored only as a hash and is valid for 30 days;
• game data: match results (placement, survival time, robots destroyed), rating, league points and season, your card collection, decks and card packs, enemy decks you create and challenge results;
• moderation and security records: reports, sanctions and a log of important account actions.

Account e-mails are sent by Brevo (EU), which processes the address on our behalf. To slow down password guessing, the server counts failed logins per IP address in memory only; the counters are forgotten when the server restarts.

Legal basis: providing the account and ranked play (Art. 6(1)(b) GDPR) and our legitimate interest in security and fair play (Art. 6(1)(f)). Test-season results are wiped before the first real season.

Donations through Ko-fi

Donations go through Ko-fi, an external service with its own privacy policy. Payments are handled by Ko-fi's payment partners; we never see your card or bank details.

From Ko-fi we receive what it shares with creators: the name you give, the amount, your message and, depending on your Ko-fi settings, your e-mail address. We use it to thank you and to keep the accounts. The public cost report shows only totals, never names, unless you ask to be named.

Legal basis: our legal obligations for accounting (Art. 6(1)(c) GDPR) and our legitimate interest in thanking supporters (Art. 6(1)(f)). We keep donation records as long as accounting law requires.

The "Keep the servers on" section can show Ko-fi's tip panel (an iframe from ko-fi.com). It loads only after you accept cookies or click "Show the Ko-fi panel"; from then on Ko-fi receives your IP address and browser data and may set its own cookies, under Ko-fi's privacy policy.

Who else processes the data

Some of them may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

• Cloudflare: network proxy in front of the game servers (encryption, protection from attacks);
• Brevo: account e-mails;
• Neon (Postgres database hosted in Frankfurt, EU, through Vercel): release and beta e-mails;
• Vercel: website hosting;
• Google Ireland Ltd: website statistics (Google Analytics), only with your consent;
• Ko-fi and its payment partners: donations.

How long we keep it

• e-mail sign-up: until you unsubscribe;
• account: as long as it exists. When you delete it in the game, your e-mail, password hash, invite code, sessions and e-mail links are erased at once. Match results and other game records stay only under an anonymous "Deleted player". Nobody else can take your old nickname for 30 days;
• backups: deleted after 30 days;
• online rooms: only while the room is open;
• server and relay logs: [privacy.logRetentionDays] TODO;
• website statistics (Google Analytics): 14 months, cookies 13 months;
• donation records: as long as accounting law requires.

Your rights

Under the GDPR you have the right to access your data and get a copy, to correct it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where we rely on consent, you can withdraw it at any time.

You can change your nickname (once every 30 days) and delete your account directly in the game. For anything else, write to hello@scrapnado.com. We answer within one month.

You can also complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl), or the authority where you live.

Children

[privacy.minAge] TODO

Changes

If this policy changes, we'll update it here with a new date. If you are signed up for news or have an account, we'll tell you about important changes by e-mail.