Privacy Policy

Effective August 20, 2026

What we collect

When you create an account, we store your username, display name, selected country, athlete ID, and account timestamps. We never store your plain-text password or recovery code; one-way cryptographic hashes are stored instead.

When you play, we store submitted scores, event type, rankings, attempt counts, and timestamps. Public leaderboards display your chosen display name, country, score, and ranking.

A secure session cookie keeps you signed in. The cookie is HTTP-only, encrypted in transit, and expires after 30 days. The server may also keep standard security logs such as IP address, browser information, requested URL, and time of request.

Local device data

Your browser stores an athlete identifier, profile preferences, and limited local game state so the service works smoothly. Clearing site data in your browser removes this local information.

How we use data

We use data only to operate accounts, publish rankings and records, prevent abuse, recover accounts, diagnose failures, and protect the service. We do not sell personal data and do not use advertising or third-party tracking cookies.

Retention and deletion

Account and ranking data remain while your account is active. Expired login sessions are removed automatically, and the public activity feed keeps only a limited recent history. You can permanently delete your account and official records from the Me → Account section after confirming your password.

Security

Passwords are protected with salted PBKDF2 hashing. Login tokens are random, stored only as hashes, sent with secure cookies, and protected by rate limits. HTTPS is required throughout the service. No internet service can promise absolute security, so use a unique password.

Children

If local law requires parental consent for a child to use an online account, a parent or guardian must provide that consent.

Changes

Material changes will be reflected on this page with an updated effective date.