BalenaScapePrivacy notice
BalenaScape is a hobby project run by one person, the owner. We collect as little as we can. This notice explains what we store, why, where and for how long, as required by the GDPR.
What we store
- Your account: your username and your password as a salted scrypt hash. We never store the password itself.
- Your game progress: your levels, items, bank, quests, appearance, position, Exchange offers and similar game data, plus when your account was created, when you last logged in and how long you have played.
- Login protection: a short, salted hash of the addresses of your last 5 successful logins, so that password guessing from other places can be slowed down. The addresses themselves are not saved with your account.
- Server log: when you create your account and when you log in, the server log records your username and IP address. Failed login attempts are logged too, never with the password, and so are connections that break the limits (for example by sending far too much), with their IP address. The login protection, the account sign-up and the connection limits also count attempts per IP address in memory for a short time.
- Staff audit log: every use of a staff command, such as a mute or a ban, is written to a separate log with the time, the username, the rank and the IP address. Players who are not staff but type a staff command are logged the same way. The log also records rank changes, bans and password changes: only that a password was changed, never the password itself.
We don't collect your email address, real name or payment details. Public chat is shown to players nearby and is not saved. Your username is visible to other players, for example in chat and on scoreboards.
This website and your browser
This website sets no cookies, uses no analytics or tracking, and loads nothing from other companies: fonts, images and scripts all come from our own server. When you create an account, the page sends your username and password straight to the game server over an encrypted connection. To keep bots out, your browser first solves a small puzzle; that needs no cookies and no other companies either. The game remembers your last username and your settings in your browser's local storage. That data stays on your device and is not used for tracking.
Why we store it
- To run the game: your account and progress are needed to provide the game you signed up for.
- To keep the game secure and fair: logs, IP addresses and login protection help us stop password guessing, abuse and cheating, and the staff audit log lets us check how staff use their powers. This is our legitimate interest.
We never sell your data or share it with anyone for advertising.
Where we store it
On a rented server (VPS) in the European Union, in France. Backup copies of the game data, including the staff audit log, are kept on that server and on the owner's own computer, also in the EU. Your data does not leave the EU.
How long we keep it
- Account and game progress: until you ask us to delete your account.
- Server log: the log has a fixed maximum size (three files of 10 MB). The oldest lines are deleted automatically as new ones come in, and the whole log starts afresh whenever the game is updated. How long a line stays therefore depends on how busy the game is and how often it is updated: usually days to weeks, but on a quiet server that is not updated for a long time it can be months. When an update fails, the last 30 lines of the server log are copied into the record of that update, which is deleted at a later update once it is more than 30 days old.
- Staff audit log: 90 days. Older lines are deleted automatically, when the game starts and once a day after that.
- Backups: the server keeps the 14 newest nightly backups, which is two weeks, and the 14 newest of each other kind, such as the backup made before every update. The owner's computer keeps the 30 newest copies. Older backups are deleted automatically, so data that was deleted from the game disappears from the backups over time. The backups contain the staff audit log as well: a line can stay in a backup for that long after it was deleted from the log itself. The server log is not in the backups.
Your rights
You may ask to see the data we hold about you, to correct it, to get a copy, or to have your account and data deleted. You may also object to how we use it. Write to balenascape@outlook.com. If you are not happy with our answer, you can complain to the data protection authority in your country.
Who is responsible
The owner of BalenaScape, balena, decides what happens to your data: under the GDPR, the owner is the controller. Questions about privacy, your account or the rules: balenascape@outlook.com.