Privacy Policy

You can play BlocksBattle without accepting optional measurement. Game accounts and results are stored on our server. With your permission, we also measure which ads bring players using Google Ads. You can change this choice at any time using “Privacy choices” in the arena.

1. What is stored

• Account: your username and a salted scrypt hash of your password. The password itself is never stored or logged.
• Session: a random session token kept in a first-party cookie (bd_session, HttpOnly, 30 days). This is needed to keep you signed in.
• Optional measurement: if you allow it, we count visits, play attempts, game starts/completions and registration steps in a daily campaign report. This report stores counts, not IP addresses, usernames, full URLs or browser identifiers. A 30-minute session record in your browser avoids counting repeated steps. Confirmed account creations are counted on the server even without optional measurement, under “unattributed”.
• Google Ads: only after you allow measurement, Google receives advertising interaction and device/network information, including your IP address and ad click identifiers, to attribute successful registrations. Google may set first-party _gcl_* advertising cookies. We send a random conversion reference to prevent duplicates, never your username, password or recovery code. Enhanced conversions and personalized-ad signals are disabled. See how Google uses information from partner sites.
• Game stats: rating, wins/losses, streaks, matches played, lines sent, match history (opponent, duration, result) and fair-play flags.
• Profile (optional): the “from” (country) line and bio you choose to enter. Both are public and can be cleared at any time from the profile editor (the ✎ PROFILE button in the lobby).
• Chat: the last ~60 public lobby messages are kept in memory to show context to new joiners. They disappear on server restart. Private (“only to X”) messages are relayed live and are not stored, but — like everything else — they pass through the server and are visible to its operator.
• Technical logs: the server may briefly keep standard process logs (connection errors, abuse throttles). No request-logging middleware is used.

2. What is NOT collected

• No email address, real name, or any identity document.
• No IP-based tracking or fingerprinting beyond short-lived anti-abuse throttles kept in memory.
• No account credentials are shared with advertising services. Optional Google Ads measurement is described above; links and integrations you choose to use, such as Discord, have their own privacy policies.

3. Guests

Guests do not need an account. The guest nickname you type is kept in your browser so it is pre-filled next time. The optional aggregate measurement described above also covers guest games. Shared replays may be stored on the server when you use sharing features.

4. Replays & video export

Match replays and exported videos are generated and stored locally in your own browser (IndexedDB / download). They never leave your machine unless you share them yourself.

5. Security

Passwords are hashed with scrypt (salted, memory-hard) — even the operator cannot read them. Sessions use a single HttpOnly cookie and the app sends strict security headers (CSP, no-sniff, frame deny) on every response. As with any self-hosted service, use a unique password you don't reuse elsewhere.

6. Retention

• Account rows and stats persist until you ask for deletion or the operator resets the server.
• Session tokens expire after 30 days of disuse.
• Lobby chat history is in-memory only and vanishes on restart.
• Acquisition report rows are kept for up to 90 days and cleared as new measurements arrive. Your measurement choice is remembered for 180 days. Google advertising cookie lifetimes are controlled by Google, typically up to 90 days.

7. Your controls

• Edit or clear your country/bio at any time in the lobby profile editor.
• Sign out to destroy your session token.
• Use Privacy choices to allow or decline optional measurement. Declining stops future measurement and removes accessible Google Ads first-party cookies; it cannot undo data already sent to Google. Clearing browser storage also clears your saved choice.
• To delete your account and its stats entirely, ask the server operator — deletion is a single database operation and removes the account row, sessions and match history references.

8. Self-hosted note

Anyone can run a BlocksBattle.com server. This policy covers the standard, unmodified software; the operator of this particular instance is responsible for anything they have changed. If in doubt, ask the operator. Optional Google Ads measurement in this software is enabled only on blocksbattle.com and only with consent.

9. Changes

The current version of this policy is always at /privacy.html. New measurement choices are presented in the arena before optional measurement begins.