What we keep, and for how long

No analytics, no tracking

The site loads no analytics or tracking scripts, and no ads. Every font, image and script comes from this site’s own domain. You can check: open your browser’s developer tools, watch the Network tab while you play, and look under Storage.

It sets no cookies unless you sign in. Then there are two, both only for signing in: one that lasts 15 minutes while you wait for the email link, and the session cookie, which lasts 30 days or until you sign out. Both are HttpOnly (page scripts can’t read them) and only ever sent to this site.

In your browser

When you join a match, the game saves three things in your browser’s localStorage:

• a random guest id,
• a random secret, which proves to the match server that you’re the same guest when you reconnect, and
• the display name you type.

The id and secret are generated in your browser with crypto.getRandomValues. They’re sent only to this site’s own server, never to anyone else. The game also keeps your sound settings and practice speed in the same place.

Practice games

Practice vs bots runs the whole game in your browser, in a background worker. Nothing about a practice game is sent to the server, unless you send feedback from it.

On the match server

For an online match, the server keeps these in a Cloudflare Durable Object for that match (an SQLite database):

• the match itself: settings, the full game state and the last 200 or so events, chat included,
• for everyone who joined: their guest id, display name and a salted SHA-256 hash of their secret (never the secret itself),
• if your guest is linked to an account: your plan (free or Commander) and the badge and camo you’ve equipped, so other players see them.

A separate lobby index lists each match’s id, name, status, speed, the display names in its seats, how many people are playing, the current cycle, the winner and timestamps. That’s what the public match list shows. To apply the hosting limits it also notes who created each match, as a one-way hash of their account or guest id.

How long it lasts:

• a finished match is deleted 24 hours after it ends,
• a match still in its lobby with nobody around is deleted after 30 minutes,
• a running match with no people in it for 7 days is ended as abandoned and deleted 24 hours later.

Other players in the match see your display name, your badge if you’ve equipped one, and the chat messages meant for them.

If you sign in

Accounts are optional. Signing in is by a link emailed to you; there are no passwords. The account store (another Cloudflare Durable Object) keeps:

• your email address and when the account was made,
• the guest ids linked to it, each with a salted hash of its secret, so the match server can tell your guest is yours,
• sign-in links as hashes only: each works once, expires after 15 minutes and is deleted within the hour,
• sessions as hashes only, for 30 days,
• what you own and have equipped, with the payment processor’s references for it (customer, subscription and payment ids, status and renewal date),
• the ids of payment events already handled, for 90 days, so none is applied twice,
• any redeem codes you’ve used (which code and when), until the account is deleted. Codes themselves are stored as hashes.

To stop someone flooding an inbox, sign-in emails are counted per IP address and per address for up to a day. Code redeem attempts are counted the same way, per account and per IP address for up to an hour, so codes can’t be guessed. Those counts are kept in memory only and are never written down.

Sign-in emails are the only email we send: no newsletters, no marketing. They’re sent through Cloudflare’s email sending service.

Payments

Payments go through Stripe, a payment processor, on its own hosted checkout page. Your card details go to Stripe and never touch our servers, and this site loads no payment scripts. Stripe gets your email address, payment details and billing country, and handles them under its own privacy policy. We get back what you bought, the state of a subscription and the ids above, and nothing about your card.

A tip without signing in is anonymous to us: Stripe has the payment, and we only learn that one happened.

Records for running the service

To keep the game running, spot problems and know what it costs, the server keeps a few records of its own, in another Cloudflare Durable Object. Only the people who run the site can see them, on a private admin page.

• Match records, for 180 days: each online match’s id, name and settings, when it was created, started and finished, the result, how long it ran, speed changes, 3D battle counts and timings, and for each seat the guest ids and display names that held it (and when a bot took over). Alongside them, a list of guest ids with the latest display name, when each was first and last seen, and how many matches it played. If a guest is linked to an account, the record notes the account id, not the email address.
• An error log, for 30 days: the error message, a shortened stack trace, where it happened and the match id. Never request bodies, chat, passwords or keys.
• Daily totals, kept: counts only, like matches played, players seen, sign-ins and payments per day. Nothing in them identifies anyone.
• A payments ledger: for each payment, the account id, what was bought, the amount, any discount and the promotion code it came from, the payment processor’s payment, invoice and subscription ids, and any refund. It’s a business record, kept for seven years (Australian tax law asks for five), and it stays when an account is deleted, with no email address in it.
• An audit log, for a year: what the site’s operator does from the admin page, such as ending a match or granting an item, with the reason given, and each use of a redeem code (by account id, not email address).

None of these hold IP addresses, and there are no third-party analytics: the counting is done by the game’s own server and stays there.

Feedback reports

The feedback form, on its own page and in the game, stores what you send, in the same Durable Object as the records above, for two years:

• what it’s about, and for balance reports what it names (a unit, power, research project, call-in, territory or resource), which way it’s off and how much it matters,
• your message, with any email address in it removed,
• the details listed under “What’s sent with this” before you send it: where you were (an online match, practice, the skirmish, the tutorial or the website), the match id for an online match, your seat, the game time and speed, the site build and rules version, the page’s path, whether the screen is phone, tablet or desktop size, and for a 3D battle the forces and the result,
• when it arrived, and what we did with it: a status, tags, a note and the version that changed it.

If you’re signed in, the report is linked to your account id (not your email address), and notes whether you ticked the box saying we can email you about it. Only then do we use the address on your account, and only about that report. Not signed in, a report isn’t linked to anything. If you delete your account, the link and the permission are removed and the report stays, anonymous.

Reports never hold your IP address or browser details. Only the people who run the site see them, on the admin page. The exports we use for balance work leave out account ids, and show a signed-in reporter as a one-way hash instead.

IP addresses and logs

To stop one network creating hundreds of matches, the server counts new matches per IP address for 10 minutes. That count is held in memory only and never written down. Failed admin sign-ins and feedback reports are counted the same way, by a one-way hash of the address. The server’s own logs record match ids and errors, never IP addresses, email addresses or chat.

Cloudflare serves the site and runs the server. Like any host it processes your IP address to deliver the pages, and its request logs for this site are switched on.

Deleting your data

• Your account: the Delete account button on the account page deletes your email, guest links, sessions, purchases and equipped items at once. If you have a Stripe customer record, it’s deleted too, which cancels any subscription straight away. Stripe keeps the payment records themselves, because tax law requires it.
• In your browser: clear this site’s data in your browser settings. That removes your guest id, secret, name and any sign-in cookie. You won’t be able to reclaim a seat in a match you’re already in.
• Feedback: deleting your account unlinks your reports from it. To have a report deleted, send another one asking for that, saying roughly when you sent it and what it said.
• In a match: when the match ends, the match itself, including your seat binding and chat, is deleted 24 hours after it ends. Its record (your guest id and display name, no chat) is kept for 180 days.

Changes

If what we store changes, this page changes with it. Adding analytics, or anything else that collects more, would be written here first.