Privacy

Account information

The account service stores your nickname, account identifier, role, creation date and, where supplied, email address and verification status. A local password is stored as a salted hash. Optional Google sign-in uses your Google identifier and email; it does not request access to Gmail or Drive.

Why the information is used

Account information supports sign-in, access permissions and account recovery. Email, when enabled, is used for address verification and password reset only. A score submission links your public nickname with the score and game category. We do not publish your email or password in the leaderboard.

Cookies and visit counts

A sign-in cookie keeps your session for up to 30 days, with renewal during use. The game statistics feature uses a separate random visitor cookie for up to one year. It counts browser visits, not uniquely identified people. Deleting cookies can create a new visitor identity. These information pages set no cookies themselves.

Storage periods

Unverified local registrations expire after seven days. Verification links expire after 24 hours and password-reset links after 30 minutes. Expired temporary records are removed during subsequent service housekeeping. New platform technical logs and rolling platform backups are limited to 30 days; dedicated retention has been active since 23 October 2026. Older shared logs are subject to the exception below. Cookie expiry does not mean all related records are deleted.

Recipients and your choices

Public leaderboard entries show the nickname, score and game category. Account records are restricted to the operator and authorized service access. Google and the configured email transport participate only when their corresponding features are used. Contact the privacy contact for access, correction, erasure, restriction, portability or objection requests where applicable. You may complain to the competent supervisory authority.

Operator and privacy contact

Operator

Florian Chanson

Support

contact@blackoutburst.dev

Privacy contact

contact@blackoutburst.dev

Hosting country

France

Account deletion and security

Account information is kept while the requested account service is provided. Ordinary users can delete their account and linked TH06 scores from Profile after confirming their identity. This revokes the central sessions, verification/reset links and Google link; it does not delete the Google account or accounts in separate services. Administrator and legacy-linked accounts require an operator review. A minimal technical deletion receipt, containing a hash of the random account identifier and timestamps, is kept to prevent deleted records from becoming active again during restoration. This receipt has no scheduled deletion date. Deletion removes records from active tables; older backups and logs are handled separately. Account functions rely on providing the requested service; security processing relies on the operator’s legitimate interest. Contact the privacy contact for assistance or a rights request.

Older shared logs

The 30-day maximum for technical logs applies to records generated from 23 October 2026 at 09:02:47 UTC (11:02:47 Paris time). Older platform records may remain in server logs shared with other services. Those legacy shared logs are excluded from this maximum, and no maximum deletion date is currently guaranteed for them. This exception applies only to those pre-activation shared logs. Rotating platform backups remain subject to the 30-day maximum.