Privacy

The short version

• You can play without an account. A guest is a random id in a cookie.
• An account keeps your email address, your handle, your name and your password's hash, or the sign-in service you chose.
• We count how the page is used (how long loading takes, where connecting fails) without storing your IP address. We also use Google Analytics to see how people find the game; in the EU, the UK and Switzerland only if you agree. No advertising.
• We email you about your account, and news only if you ask for it.
• We don't sell your data or share it for advertising.
• To have your data deleted, write to support@retrocycles.io.

Who we are

Retrocycles.io is run by Velvet Innovations LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA ("we"). This policy covers the page at retrocycles.io, the platform behind it (sign-in, Quick Play, progress) and the official game rooms. Community servers you join from the server browser are run by others: when you play there, their admins see what any game server sees, and their own rules apply.

What we keep, why, and for how long

Guest

When you first play, the platform makes you a guest: a random id (like g-7f3a9c01), the name you play under, and when it was made. It lets the official rooms recognise you, so your progress is saved.

Kept until the guest becomes an account, is merged into one, or is deleted. Unused guests are not yet deleted automatically; once they are, the period will be 12 months after the guest's last game.

Account

If you create an account: your email address and whether you confirmed it, your handle, your display name, and a hash of your password (Argon2id; we never store the password itself). If you sign in with Google or Discord: that service's id for you, its name for you, and the email address it confirmed. Whether you asked for news emails, when and where.

When you choose a password we check it against known leaked passwords with Have I Been Pwned: only the first 5 characters of a hash of the password leave our server.

Kept as long as the account exists. Failed sign-ins are counted so that the account can be locked temporarily after too many attempts.

Sessions

Signing in, or playing as a guest, starts a session: a cookie in your browser holding a random key, and on our side the session's start, its last use, when it ends, whether it is on a shared computer, and your browser's user agent (shown as "Chrome on Windows" in your list of sessions).

A session ends 30 days after its last use. On a shared computer it ends when the browser closes, after 2 hours without use, or after 12 hours at most. Signing out deletes it.

Progress

The official rooms report to the platform what happens in your games while you are logged in: the rounds and matches you play, with the name you used, your team, score, place, kills, deaths and how long you played. From these we work out your XP, level and stats.

The official rooms also record each match: the players' names, teams, positions, pings, kills and scores, round by round. Never chat or IP addresses. We use the recordings to check results, study how matches play and improve the game.

Your profile is public: your handle, name, level, XP and stats are visible to anyone.

Kept as long as your guest or account exists. Match recordings are deleted after 180 days.

Playing inside Discord

When you start Retrocycles as an Activity in Discord, Discord asks whether to share your account with us. If you agree, it gives us your Discord user id, your username and your Discord account's email address. The id signs you in to the account linked to that Discord login (or makes one), as signing in with Discord on the site does. We keep the email address with your account when Discord has confirmed it and no other account uses it, and use it for account emails; for news emails only if you turn them on. We don't receive your servers or your messages. Discord also lets us show what you are playing on your Discord profile.

Everyone who joined the same launch plays in the same room. For that we keep Discord's id for the launch, which room it went to and when it was last used; not who was in it. The page, its requests and your game traffic go through Discord's proxy, so Discord sees your connection to us, and we usually see Discord's address rather than yours.

Your Discord login is kept as long as your account exists, like any sign-in service. Discord's own privacy policy covers what it does with your data.

Usage statistics

The page sends us a few usage events: that it was opened (with the campaign link you came from, the website that linked to us reduced to its domain, whether you are on a phone, tablet or computer, and your browser's family, like Chrome or Firefox), that you pressed Play, how long loading and connecting took and whether it worked (and whether your connection went through our relay), when you first steered, when you started creating an account, how long you played, how long a round trip to each of our regions took, your ping and frame rate in the game, that you copied a room's invite link, and the kind of error when the game breaks (for example "graphics context lost", never the error's text). They are tied to your guest or account id when you have one.

When the page is opened, we look up the country and a rough area (about 55 km across) of the IP address it came from, and keep only those with the usage event; the address itself is not stored.

We use them only to find out where the game is slow or fails to connect, and whether players return, so we can improve it. We don't store your IP address or your browser's full user agent with them. They never include anything you type (names, chat, emails or passwords).

In the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland (or when we cannot tell where you are), the page sends them only after you press Accept on the question it asks, the same one as for Google Analytics. If you decline, or don't answer, nothing is sent. Inside Discord and in posts on X the page doesn't ask, so for visitors from those countries it sends nothing there.

Deleted after 13 months. Not sent at all when your browser sends Global Privacy Control. An opt-out setting is planned; until then, write to us and we will exclude you.

Google Analytics

The page also uses Google Analytics, which tells us how people find the game: the site or search that sent you, the campaign link, your country, device and browser, which pages you open, and a few moments of your visit: that you pressed Play, played a game, created an account or signed in (and how, for example with a password or Google), or copied an invite link. Google sets its cookies (_ga, _ga_*) to tell a returning browser from a new one. Advertising features are off: Google is told not to use this data for ads.

In the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland (or when we cannot tell where you are), Google's cookies are only set if you press Accept on the question the page asks. If you decline, Google still receives a page visit without cookies, which it cannot connect to you. You can change your answer at any time at retrocycles.io/?cookies.

Not loaded at all when your browser sends Global Privacy Control. Google keeps Google Analytics data for 14 months. See how Google uses information from sites that use its services.

Security log

Account events: account created, signed in, failed sign-in (and why), locked out, password changed or reset, email confirmed, sign-in service linked or unlinked, session ended, signed out, guest saved or merged, handle changed, news emails turned on or off. Each with the time, your user id and the IP address the request came from. Never passwords, tokens or email addresses.

Used to protect accounts and spot abuse. Kept for 12 months.

Email

We email you about your account: to confirm your address and to reset your password. Sent through Resend.

News emails, only if you ask for them: tick "email me news" when you sign up, or turn them on in your account. Now and then, about new modes, events and updates to the game. Every one has a link to unsubscribe, and you can turn them off in your account at any time. We keep when and where you asked for them, and the words you agreed to, as proof of your consent; they go only to a confirmed email address.

We stop sending them as soon as you unsubscribe or turn them off. Signing in with Google or Discord never turns them on.

Reports and appeals

If you write to us to report a player or appeal a decision, we keep your message and what we decided, to handle it and to be consistent.

Kept for 2 years after the decision.

Your IP address

Your IP address is sent to our servers whenever you load the page or play. Here is how it is handled:

• The web server keeps no access logs.
• The platform holds it in memory for a minute to limit how fast requests come, and writes it into the security log above.
• Game rooms, like every Armagetron Advanced server, see it while you play, and their logs may record it.
• Our relay: when a direct connection doesn't work, your game traffic goes through our relay server, which sees your address for that game and records it in its log.
• Our official rooms and the relay keep their logs for up to five weeks.
• Finding the closest servers: to put you in a nearby game, the page measures the response time of a small request to each region we host in or are thinking of hosting in. For a region where we have no server yet, that request goes to our hosting provider Vultr's own test server in that data centre (for example syd-au-ping.vultr.com for Sydney), which sees your address as any website would. We keep only the times (milliseconds per region) with your guest or account, to place you in a game and to decide where to open servers.
• Maps the game downloads come through our server from the community's map repository; we don't log them.

On your device

• Cookies. The platform's session cookie (rc_session) and, for the few minutes a Google or Discord sign-in takes, rc_external; both are needed for the service to work. And Google Analytics' cookies (_ga, _ga_*), where you have not declined them, or, in the EU, the UK and Switzerland, only once you accept them. No advertising cookies.
• Browser storage. The game keeps its settings, key bindings, your player name and downloaded maps in your browser. Only your player name leaves your device. The page also remembers that you have seen the one-line code of conduct, and your answer about Google Analytics' cookies.

Who else sees it

• Vultr hosts our servers, the database and its backups, in New Jersey, USA.
• Resend sends our account emails.
• Google and Discord, if you sign in with them: they learn that you signed in to us. Inside Discord, Discord also carries your connection to us (see Playing inside Discord).
• Google, through Google Analytics: your visits to the page, with or without its cookies as described there.
• Other players and room admins see your name, your chat and your game in the room, as in any game.
• Authorities, only when the law requires it.

We don't sell or rent personal data, and we don't share it for advertising.

Where it is stored

In the United States, at Vultr in New Jersey. If you are outside the US, your data goes there. From the EU and the UK, we transfer it because that is needed to provide the service you ask for, and Vultr handles it under the European Commission's standard contractual clauses and the UK's addendum to them, which are part of its data processing agreement with us.

Backups. The database is backed up every night. Backups are kept 7 days on the server and 30 days on a second server in the same data centre. Deleted data remains in backups until they expire, after 30 days at most.

Children

Accounts are for players 13 and older. See age requirements. If you think a child under 13 created an account or gave us personal information, write to support@retrocycles.io and we will delete it.

Your choices and rights

• See and change. Your profile shows your account, your email address and your sessions. You can change your password, unlink a sign-in service, sign out one session or all of them.
• Delete, export, correct. Not in the game yet: write to support@retrocycles.io from your account's email address (or give your guest id) and we will do it within one month.
• News emails. Off unless you turn them on. Unsubscribe from any of them, or turn them off in your account.
• Usage statistics. Turn on Global Privacy Control in your browser, or write to us. Where the page asks, change your answer at retrocycles.io/?cookies.
• Google Analytics' cookies. Accept or decline them at retrocycles.io/?cookies, at any time. Global Privacy Control turns Google Analytics off.
• Complain. You can complain to the data protection authority where you live.

Where the GDPR or UK GDPR applies, we use your data to provide the service you asked for (guest, account, sessions, progress), for our legitimate interests (the security log, backups, moderation), with your consent (usage statistics, Google Analytics' cookies and news emails), and where the law requires it.

Changes

When this policy changes we will update it here, with a new effective date. If a change matters, we will say so on the site before it applies.

Contact

Velvet Innovations LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. support@retrocycles.io