🔒 Privacy

Plain-language summary of what data this site uses — no legalese.

1. What We Store Locally (localStorage)

Your browser's localStorage keeps a few small values so the games remember your preferences between visits:

• playerName — your chosen display name (persists across sessions)
• gdprConsent — your privacy preference (accepted or rejected)
• accountChoice — whether you chose to log in or play as a guest (so the welcome dialog does not reappear)
• snakeName, snakeSession, mpPlayerName — game session / name data
• snakeSfxVolume, snakeMusicVolume, snakeSfxMuted, snakeMusicMuted — Snake audio preferences
• snakeTheme — dark/light mode preference
• snakeMobileZoom — mobile zoom preference
• tanksSfxMuted, tanksMusicMuted, tanksSfxVolume, tanksMusicVolume — Tanks audio preferences (other games store equivalent audio keys)

2. Cookies

Guests get no cookies at all. If you log in or create an account, one strictly necessary cookie is set:

• mg_session — a random login session token. HttpOnly (not readable by scripts), valid for 30 days, removed on logout.

This cookie exists only to keep you logged in. It is not used for tracking, analytics or advertising, and it is never shared with anyone. Because it is strictly necessary for the login feature you explicitly requested, it does not require separate consent — but we tell you about it here anyway.

3. Accounts (optional)

Playing is fully possible as a guest without an account. If you register, we store in a server-side database:

• Your username (this is public — it appears in games and leaderboards)
• A salted hash of your password (scrypt) — we never store or see the password itself
• Optionally, an email address — only if you choose to add one. It is used exclusively to send you verification and password-reset links from our own mail server (never a third-party email service), is never shown to other players, never used for marketing, and can be removed at any time via the ✉️ Email button in the header. It is deleted together with your account.
• Your points balance, a log of points earned per game, and your purchased/equipped cosmetic items
• Login session records (token hash, creation and last-use timestamps); password-reset and email-verification links are stored only as short-lived, single-use token hashes

Name reservation: registering a username reserves it — guests can no longer play under it. Any leaderboard results recorded under that name before registration are hidden from all leaderboards from that point on (the raw historical game records are retained server-side for a while but no longer displayed).

Deleting your account: the Store page has a "Delete my account" button. Deletion is immediate and removes your login, password hash, points, purchases and sessions. Only the name-reservation marker is kept so previously hidden results cannot reappear under your name.

4. Rankings

Player names and results are stored in server-side files (e.g. rankings.json per game).

• Names are sanitized — special characters are stripped
• If you decline consent, your scores are not submitted to rankings
• Registered players' results are shown with their reserved name and any equipped cosmetic badge/title

5. Server Logs

• IP addresses are logged to the server console during WebSocket connections and are used in-memory for rate limiting (connection, login and registration attempt limits)
• Logs are not persisted to disk — they are lost on server restart
• No access logs, no analytics

6. What We Do NOT Collect

• No tracking or advertising cookies (only the essential login cookie described above, and only for logged-in players)
• No email address is required — an optional address, if you add one, is used solely for account verification and password reset (never for marketing, never shared)
• No third-party analytics (no Google Analytics, no tracking pixels)
• No advertising
• No data shared with third parties

7. Managing Your Data

• Clear your browser's localStorage via developer tools to remove all local data
• To change your consent: delete the gdprConsent key from localStorage — the consent banner will reappear on your next visit
• Log out (header button) to end your session and remove the login cookie
• Remove your email address at any time via the ✉️ Email button in the header
• Delete your account on the Store page to erase all account data immediately