Privacy Policy

BlocksBattle.com is designed to be private by default: it is self-hosted, collects as little as possible, and sends your data nowhere else. Everything below lives in a single SQLite file on the server you are connected to.

1. What is stored

• Account: your username and a salted scrypt hash of your password. The password itself is never stored or logged.
• Session: a random session token kept in a single first-party cookie (bd_session, HttpOnly, 30 days). There are no tracking cookies, no analytics, no advertising, no third-party requests.
• Game stats: rating, wins/losses, streaks, matches played, lines sent, match history (opponent, duration, result) and fair-play flags.
• Profile (optional): the “from” (country) line and bio you choose to enter. Both are public and can be cleared at any time from the profile editor (the ✎ PROFILE button in the lobby).
• Chat: the last ~60 public lobby messages are kept in memory to show context to new joiners. They disappear on server restart. Private (“only to X”) messages are relayed live and are not stored, but — like everything else — they pass through the server and are visible to its operator.
• Technical logs: the server may briefly keep standard process logs (connection errors, abuse throttles). No request-logging middleware is used.

2. What is NOT collected

• No email address, real name, or any identity document.
• No IP-based tracking or fingerprinting beyond short-lived anti-abuse throttles kept in memory.
• No data is sold, shared, or sent to third parties — there are no third parties.

3. Guests

Playing as a guest stores nothing on the server beyond the live connection itself: no account, no stats, no history. The guest nickname you type is kept only in your own browser's local storage so it is pre-filled next time.

4. Replays & video export

Match replays and exported videos are generated and stored locally in your own browser (IndexedDB / download). They never leave your machine unless you share them yourself.

5. Security

Passwords are hashed with scrypt (salted, memory-hard) — even the operator cannot read them. Sessions use a single HttpOnly cookie and the app sends strict security headers (CSP, no-sniff, frame deny) on every response. As with any self-hosted service, use a unique password you don't reuse elsewhere.

6. Retention

• Account rows and stats persist until you ask for deletion or the operator resets the server.
• Session tokens expire after 30 days of disuse.
• Lobby chat history is in-memory only and vanishes on restart.

7. Your controls

• Edit or clear your country/bio at any time in the lobby profile editor.
• Sign out to destroy your session token.
• To delete your account and its stats entirely, ask the server operator — deletion is a single database operation and removes the account row, sessions and match history references.

8. Self-hosted note

Anyone can run a BlocksBattle.com server. This policy covers the standard, unmodified software; the operator of this particular instance is responsible for anything they have changed. If in doubt, ask them — or play as a guest, which stores nothing at all.

9. Changes

The current version of this policy is always at /privacy.html. Material changes will be announced in the lobby chat.