Privacy

Draft for review by counsel before launch. It describes exactly what the software does.

Ozymandosis collects as little about you as the service can run on. Playing offline, or with other people on your own network, sends nothing to us. The full list of what is collected, generated from the software itself, is the data inventory.

What we keep when you make an account

• Email address (email accounts, or when a sign-in provider shares a verified one): to sign you in, confirm it is yours, and let you reset your password.
• Password: stored only as an Argon2id hash. Two-factor secrets are stored encrypted.
• Sign-in providers (Google, Apple, Steam): the account identifier each provider gives us, and nothing else from your profile beyond a suggested display name.
• Display name, rating and match results: to run matchmaking and show your record. Results are reported by every player in a match; when they disagree, a moderator may look at what each player reported.
• Age range: we ask the month and year you were born, work out whether you are 13–15, 16–17 or an adult, and keep only that range. We do not make accounts for children under 13; if we learn an account belongs to one, we delete it.
• Game progress (when signed in): your lineage, your Spawnforge designs and your save slots are backed up to your account so they follow you between devices.
• Signed-in devices: a coarse label such as “Chrome on Android” and when each was last used, so you can sign them out.
• Membership: its status, plan and renewal date. Memberships are bought in the store of the platform you play on (Google Play, the App Store or Steam), which handles the payment; we never see or store card details. We keep the store’s purchase reference, encrypted, so we can confirm it with the store; it is erased when you delete your account. A membership is cancelled in that store.
• Proof of purchase: which stores have confirmed your account bought the game, and when. To check, the app asks the store (on Android, Google Play Integrity checks that the app came from Play and your Google account holds a licence); we keep only a fingerprint of the answer.
• Reports: player reports you send (with the recent chat lines attached from your own game) and moderation decisions.

What we do not keep

• Our logs record the request, the result and a pseudonymous tag, never your email, IP address, or sign-in tokens.
• No advertising or tracking cookies, no third-party analytics.

How long we keep things

• Sign-in sessions: until they expire or you sign them out. Email links and sign-in hand-offs: one day after use or expiry.
• Email sign-ups that are never confirmed or used: deleted after 30 days.
• Crash and bug reports: 180 days; screenshots attached to them: 30 days. Performance measurements: 180 days.
• Chat lines attached to a player report: 90 days after the report is resolved; the report itself: two years.
• Staff action log: two years. Payment webhook records: 90 days.
• Server logs: a few days of rotating files, pseudonymous as described above. Database backups: 14 days, encrypted.
• Your account, rating and match history: until you delete your account.

Crash and bug reports

If the game crashes it can send a report: the error, the game version, your device type, the renderer and a short summary of the match. Emails, IP addresses and file paths are removed before storage. You can turn automatic reports off in the game’s Settings or in your account. Bug reports you send yourself may include a screenshot of the game if you choose.

Performance. At the end of a single-player or online match the game measures how smoothly it ran: frame-time percentiles, how often it lowered or raised its graphics quality, the renderer, and a device class (desktop, mobile or low-end), plus the processor core count, memory size and screen size the browser reports. It keeps the last runs on your device (Settings → Performance) and, unless reports are turned off, sends them to us without your account or anything that identifies you. Matches on your local network are never reported.

Online matches

Chat. In online lobbies and matches, chat passes through our server so it can be filtered, so mutes work, and so players under 16 only send and see preset quick-chat phrases. We keep the last lines of a match’s chat in memory while it runs and for 30 minutes after; they are stored only if someone reports a player from that match, attached to the report. You can turn chat off or limit it to quick chat in Settings or your account.

Every online match travels through our relay server (WebRTC, encrypted with DTLS end to end), so other players never learn your IP address and the relay forwards traffic it cannot read. The relay keeps no logs.

Local network play connects the devices in your home directly. It needs no account and never contacts our servers; on Android and iOS the system asks your permission to use the local network.

Your controls

From your account you can download all of your data, sign out devices, turn off crash reports, and delete your account. Deletion erases your email, sign-ins, name and two-factor data and cancels your membership; anonymised match records remain.

Processors

Google Play, the Apple App Store and Steam (purchases and purchase checks), our email delivery provider (account emails), Cloudflare Turnstile (a check against automated sign-ups, when enabled), and our hosting provider. Sign-in providers only when you choose them.

Contact

privacy@ozymandosis.com