Privacy Policy
Crowdwar.io — Last updated: July 2026
Crowdwar is a free browser game. This policy explains what data we collect, why, and how you can control it. We keep it short because we actually collect very little.
What we collect
- Display name — pulled from your Discord or Google account when you sign in. We store only this; we do not store your email, profile picture, or any other information from your OAuth provider.
- Game statistics — kills, score, XP, wins, and similar in-game progress tied to your account.
- Session token — a random token stored as a secure cookie so you stay signed in. We store only a SHA-256 hash of the token; the raw value never touches our database.
- Anonymous telemetry — server performance metrics (tick times, player counts, bandwidth). Not linked to any account.
- Feedback submissions — if you send in-game feedback, we store the text you wrote together with your IP address (abuse prevention only). Both are kept with the message until it is reviewed and deleted.
- Gameplay session recordings — to find bugs and improve the game we automatically keep short recordings of in-game world state (player positions, shots, scores — the same data every connected player's screen already receives) around notable moments: killstreaks, a new visitor's first minutes, and sessions that end quickly. They contain display names but no account, contact, or device information, and the archive is small and continuously pruned.
- Visitor counting — to count unique and returning players we store a salted hash derived from your IP address and browser. The IP itself is not stored, nothing is placed on your device, and the salt is rotated (and destroyed) roughly every 30 days — after which the stored hashes are permanently unlinkable. Only aggregate daily numbers are kept long-term.
What we do not collect
- Email addresses, phone numbers, or any contact information
- Passwords (the game has none — OAuth only)
- Payment information
- IP addresses, except transiently for rate-limiting and alongside feedback you choose to submit (see above)
- Browsing history or behaviour outside the game
Cookies and local storage
We set one cookie: a session cookie (HttpOnly, SameSite=Lax, Secure in production) that keeps you signed in. It is strictly necessary for the game to function. No tracking or advertising cookies are used.
We use localStorage and sessionStorage to remember your audio volume, small UI preferences, and your reconnect token for the current tab. This data stays on your device and is never sent to our server except to rejoin an interrupted game.
How we use your data
Your data is used solely to run the game: to display your name on the leaderboard, track your XP and rank across sessions, and keep your session alive. We do not sell, rent, or share your data with third parties for any purpose.
Data retention
- Anonymous session records: aggregated into daily statistics (no identity attached) and deleted within 48 hours
- Session records linked to an account: kept as long as your account exists — they power your personal stats
- Telemetry snapshots: aggregated daily and deleted within 48 hours
- Player statistics and XP: kept as long as your account exists
Third-party sign-in
Sign-in is handled by Discord or Google. Their privacy policies govern what they collect during the OAuth flow:
We request only the minimum scope (your public display name). We do not request access to your messages, contacts, or any other account data.
Your rights
You can request deletion of your account and all associated data at any time by contacting us. We will process the request within 30 days.
If you are in the EU, you also have the right to access, correct, or export your data. Send us an email and we will help.
Children
Crowdwar is not directed at children under 13. If you are under 13, please do not use the service. If we become aware that we have collected data from a child under 13, we will delete it promptly.
Contact
Questions or data requests: legal@crowdwar.io
← Back to game