Privacy

This page describes what this game actually stores, not what a template says a game might store. If anything below turns out to be wrong, that is a bug, and we would like you to report it.

The short version

• You sign in with Discord or Google. We never see or store a password.
• We keep your nickname, your match history, and the e-mail address the provider gives us.
• We count visits to the site without storing anybody's IP address, and we set no tracking cookies at all.
• What you write in the hub's global and team chat is kept for 30 days, so reports can be checked. Whispers and chat during a match are never written to a database.
• You can download everything we hold about you, and you can have yourself erased, from Settings. Both are buttons; you do not have to send anybody a request.

Who is responsible

The controller of this data is the business named on this page under Contact, established in Poland. Everything here is processed on servers in Europe.

What we hold, and why

Your account

Your nickname, the country flag you chose, your preferred position, the line you wrote about yourself, your level and experience, your rating, your saved loadouts (the body and the look you play in), and the dates all of those last changed.

We need this to run the game at all. The lawful basis is the contract between us: you asked to play.

How you sign in

For each sign-in provider you connect, we store the identifier that provider gives us and the e-mail address on that account, plus whether the provider says it is verified.

We ask Discord and Google for the minimum they allow: an id, an e-mail, and a display name used only to suggest a nickname during sign-up. That suggested name is never stored. We do not receive or want your avatar, your friend list, your date of birth, or anything else.

The e-mail is not how we identify you. Your account is keyed on the provider's id. The address is kept for one purpose: if you later sign in with a different provider using the same verified address, we can offer to link the two accounts instead of silently creating a second one. We never send marketing to it. We do not send e-mail at all.

Your matches

Every ranked and solo match you play leaves a record: the score, who was on the pitch, your statistics from it, and how your rating moved. Public trainings leave a receipt with the experience they gave and nothing else. Team changes leave a transfer row.

A match is not only yours. Other people played it and it appears on their pages too, so erasing your account does not erase the matches: it takes your name off them. See Erasure below.

Moderation

If you report another player, or somebody reports you, we store the report: who, about whom, the reason from a fixed list, and anything either of you typed. Bans and mutes are recorded with the reason they were given for.

Every action that changes the database leaves a row in an audit log: who did it, what, when, and, for a limited time, from which address and with which browser. The log lets a moderator tell one person with two accounts apart from two different people, and lets any of our decisions be reviewed afterwards. The lawful basis is our legitimate interest in the game being playable and not being ruined by a small number of people.

The address and browser are removed after 90 days. The record of what happened is kept, but the part that describes a person is not.

Chat

When you write in the hub's global or team chat, we store the line: the nickname you had at the time, the text, the channel (and the team, for team chat) and when you sent it. Other players see the last 100 lines of the past 7 days in each channel; team chat is visible to that team only. The lines are kept for 30 days and then deleted automatically. They are kept so that a moderator can check what was actually said when somebody is reported. The lawful basis is our legitimate interest in keeping the chat usable.

Whispers (private messages) and chat during a match are not stored. They are held in the server's memory and are lost when the server restarts.

Your chat lines are included when you download your data, and they are deleted when you erase your account.

Crashes and bug reports

When your browser hits a JavaScript error, it sends us the error message, a stack trace, the build you were on and the page you were on. These are grouped, not logged one by one: each row is identified by a fingerprint of the message, so the thousandth occurrence increases a counter instead of adding a thousandth row. If you are signed in, we record that you were the most recent person to hit the error, so we can ask you what you were doing.

When you file a bug report, we store what you wrote, which part of the game you named, your build and the room you were last in.

Visits to the site

We count page views ourselves. This is where many sites collect the most, so here are the exact details:

• No cookie is set, and no identifier is stored in your browser.
• Your IP address is never written down. To tell one visitor from another within a day, the server computes hash(a secret + today's date + your address + your browser) and stores that. It cannot be turned back into an address, and because the date is part of it, the value changes at midnight, so nothing here can follow you from one day to the next.
• If you are signed in, the visit is linked to your account. The purpose of counting visits is to find out how many people who arrive actually stay.
• We store the page path, never the full address of the page, since a query string could contain a token or a code.
• The site you arrived from is reduced to its host (reddit.com), never the exact page.
• These rows are deleted after 90 days, automatically.

The lawful basis is our legitimate interest in knowing whether anybody is finding the game. We use no third-party analytics service, so none of this is shared with anybody.

What we deliberately do NOT store

• Passwords. There are none.
• Whispers and match chat. Neither is written to a database. They are held in the server's memory and are lost when the process restarts. The only way such a line lands in storage is if a player pastes it into a report. (Hub chat is different, see Chat above.)
• Payment details. If paid Supporter time ever exists, it will be handled by a payment provider and we will hold a transaction reference, never a card.
• Your IP address, outside the audit log's 90 days.

Cookies

Three, all of them strictly necessary, all httpOnly so no script can read them:

Cookie	What it does	How long
fz_session	Keeps you signed in. Holds an opaque token; the database keeps only its hash.	30 days, extended while you use it
fz_flow	Holds the state of a sign-in while you are away at Discord or Google.	10 minutes
fz_signup	Carries a pending sign-up between the provider and choosing your nickname.	20 minutes

There are no analytics, advertising or tracking cookies, which is why this site has no cookie banner. Under the ePrivacy rules a banner is required for cookies that are not strictly necessary, and we use none. Your browser also stores your own settings (sound, key bindings, hub layout) locally; that never leaves your machine.

How long we keep things

Your account and your matches	As long as the account exists
Visit rows	90 days, then deleted
Address and browser on audit rows	90 days, then removed (the act itself is kept)
Audit acts, matches, transfers, moderation records	Kept as the permanent record
Expired sessions	Deleted
Hub chat (global and team)	30 days, then deleted
Whispers and match chat	Never stored

Your rights

Under the GDPR you may ask for access to your data, correction, erasure, restriction, objection, and portability. Two of those are buttons rather than requests:

Download everything: Settings, under Your data. You get a JSON file with your account, your sign-in identities, your matches, your transfers, your reports, your bug reports, any sanctions against you and every recorded act of yours. It never contains a session token.

Erase yourself: Settings, under Your data. It is immediate and cannot be undone.

For anything else, or if you would rather ask a human, write to the contact address below. We answer within a month. If you think we have got it wrong, you may complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl).

Erasure: what exactly happens

We would rather be precise here than reassuring. "We delete everything" is easy to say and rarely true.

Destroyed, immediately and for good: your sign-in identities and the e-mail on them, all your sessions, your nickname, your description, your country, your position, your saved loadouts, your hub chat lines, your friendships, your blocks, your team membership, the copy of your nickname stored on every match you played, your account's link to any visit or crash we recorded, and the address and browser on every one of your audit rows.

Kept, with nothing left that names you: the matches themselves and their scores, your statistics inside them, transfers, and the record of moderation decisions. Your account row survives as an empty placeholder called "Deleted player", so that other people's match pages, histories and ratings do not develop holes. Nothing in it identifies you any more, which is what anonymisation means, and at that point it stops being personal data.

One thing we cannot do: if you own a team, you must hand it over or disband it first. A team belongs to everybody in it, and disbanding it because its owner left would harm people who did not ask for that.

One consequence to be aware of: if you were banned and you erase yourself, you can sign up again with the same Discord account, because the identity that would recognise you is exactly the thing you asked us to destroy.

Who else sees any of this

• Discord and Google, when you choose to sign in with them, receive that you did.
• Our hosting provider, which runs the servers.
• A payment provider, if and when paid Supporter time exists.
• Nobody else. There is no analytics service, no advertising network, and nothing is sold.

Children

The game is not aimed at children under 16, and we do not knowingly keep accounts for them. If you believe a child's account exists here, tell us and it will be erased.

Changes

Changes are made by editing this page, and its full history is public in the project's git repository. The date at the top of the page is when it last changed.