Privacy policy
What the breakball online leaderboard keeps about you, why, where and for how long.
In short
The game works without an account. Your records stay on your device. Only when you create a @name for the global leaderboard does the game send data to the server, and only the minimum: the @name, a code derived from your e-mail (never the address), your country if you want, and your runs. No ads, no tracking, nothing is sold.
What we keep
| Data | Why | Until |
|---|---|---|
| @name | Showing you on the leaderboard | You delete the account |
| E-mail, stored only as a hash (a code derived from it that cannot be turned back into the address) | Recovering the @name on another device, deleting the account, one @name per e-mail | You delete the account |
| Country (optional, a code such as BR or US) | Leaderboard filter by country | You change it or delete the account |
| Submitted runs: score, level, duration, level seed, game version and platform | Leaderboard and checks against impossible runs | Weekly board: 8 weeks. All-time board: until you delete the account. Per-submission record: 30 days |
| Device token, stored only as a hash | Keeping you signed in without a password | You sign out, delete the account, or 180 days without use |
| 6-digit code, stored only as a hash | Proving the e-mail is yours | 10 minutes or until used |
| Reports you make or receive | Moderating offensive names and cheating | Until the reported account is deleted; if the reporter deletes their account, the report stays without an author |
| Request counters, with the IP only as a hash | Limiting abuse (too many requests) | 1 hour (reports: 1 day) |
The plain e-mail address and the IP only exist in the server's memory while a request is handled. They never go to the database or to the logs. Your country is suggested from your connection and you can leave it empty.
Banned e-mail
Players banned for an offensive name or for cheating have the hash of their e-mail kept in a block list. That list stays after the account is deleted, so the same person cannot come back with the same e-mail. It holds only the hash and the date of the ban.
Where the data lives
- Cloudflare (Workers and D1): the leaderboard server and database. Cloudflare processes the connection (including the IP) to deliver the service, under its own privacy policy.
- Resend: sends the e-mail with the code. It receives the address only for that delivery.
These services may store data outside your country, as needed to provide the service you asked for.
Browser version (itch.io)
In the browser, the token and your records live in the site's storage. Clearing browser data, using a private window, or switching browser or device wipes that storage: the token is gone (the @name comes back through your e-mail, under "recover") and local records are lost. Games on itch.io share the same browser storage; that is why deleting the account always asks for the code sent to your e-mail.
How to delete your account
- In the game: leaderboard profile, "delete account", with the code sent to your e-mail.
- On the web: account deletion page, with the same code.
Deletion immediately removes the @name, the e-mail hash, the tokens, the runs, the leaderboard entries and the reports against you. Only what is described under "Banned e-mail" remains, when it applies. Records on your device stay on your device.
Your rights
You can ask for access to your data, correction (for example a new @name or e-mail, which today goes through the contact) and deletion. Write to the contact.
Age
The online leaderboard is not meant for children under 13. The game stays available without an account.
Who is responsible
Tiago Holanda, developer of breakball. Contact: contato@breakball.tiagoholanda.tech.
Changes to this policy show up on this page with the new date.