Orbitbreaker: free browser arena shooter

This website runs on Cloudflare Workers (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). To deliver and secure the website, Cloudflare processes technical data such as your IP address, access time, requested page and browser type, and blocks attacks. These logs are deleted after a short period (our Workers logs after at most 7 days). The legal basis is our legitimate interest in a secure, working website under Article 6(1)(f) GDPR.

We use Cloudflare Web Analytics (Cloudflare, Inc.) to see how many people visit the game, where they come from and how fast it loads. A small script from static.cloudflareinsights.com reports the visited page, the referring website, browser and device type, country and page load times. It sets no cookies, stores nothing on your device, does not track you across websites and does not create a profile of you; we only see aggregated figures and cannot identify individual visitors. The legal basis is our legitimate interest in understanding the reach and performance of the game under Article 6(1)(f) GDPR. You can object at any time (see Your rights) or block the script with a content blocker; the game works the same without it.

The game itself also counts a few events as totals per day: page opened, run started, second run started, run finished or won, score shared, and technical error messages. These counts carry no identifier of you or your device, nothing is stored on your device for them, and they cannot be linked to a person; they are kept for up to 400 days (error messages 30 days). Browsers that send Do Not Track or Global Privacy Control are not counted. The legal basis is the same legitimate interest.

The game uses no advertising or tracking cookies. Progress, coins and preferences are stored in your browser using localStorage, and replays in IndexedDB. This storage is strictly necessary for the game you request (Section 25(2) No. 2 TDDDG). There are no accounts and no passwords: your progress stays on this device.

The leaderboard is optional. If you pick a nickname, we store it with your best scores, their run times and dates on our leaderboard server, and show your nickname and scores publicly. Your browser creates a random key that proves the nickname is yours; the key stays in your browser (localStorage) and the server only keeps a hash of it. No email address or password is involved.

The leaderboard runs on Cloudflare Workers with Durable Objects (Cloudflare, Inc.); its data is stored in the EU. To prevent abuse, requests are limited per IP address. The legal basis is your consent under Article 6(1)(a) GDPR, which you give by picking a nickname. You can withdraw it at any time: Settings → Nickname → Remove my nickname and scores deletes everything stored for it. Nicknames that are not used for 400 days are deleted automatically, daily boards after 60 days.

When you play co-op, your player name, equipped power and game inputs are sent to our multiplayer server, which runs the match. A random device ID is sent too; it is only used, hashed with the day, to count daily players. The hashes are kept only for the current day; the daily totals (no personal data) are kept for 60 days. The server runs on Cloudflare Workers (Cloudflare, Inc.); like the website, it processes technical data such as your IP address to deliver the connection. Rooms are not saved: a room and its settings are deleted shortly after the last player leaves. Co-op runs earn coins but don't count toward records or the leaderboard. The legal basis is the performance of the service you request under Article 6(1)(b) GDPR.

Replay videos and build images are created locally on your device. Finished replays are stored in this browser until you clear its data or storage runs out. They are not uploaded. You choose whether to download or share them.

If you write to service@orbitbreaker.io, your message is received through Cloudflare Email Routing and forwarded to the operator's mailbox. We use your email address and message only to answer you and delete them when your request is settled, unless we must keep them by law. The legal basis is Article 6(1)(b) or (f) GDPR.

Cloudflare is a US company, so data may be processed in the USA. These transfers are safeguarded by the EU-US Data Privacy Framework or by the EU standard contractual clauses under Article 46 GDPR.

You have the right to access your personal data (Article 15 GDPR), to have it corrected (Article 16) or deleted (Article 17), to restrict its processing (Article 18) and to receive it in a portable format (Article 20). You can withdraw any consent at any time with effect for the future (Article 7(3)). Contact service@orbitbreaker.io; this is free of charge.

Right to object: Where we process data based on legitimate interest (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Article 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.