COREWARD is a game you open and play. It asks for nothing, and for most people it stores nothing. This page says what the exceptions are, exactly, and what you can do about each of them.
SANSOFT — Bancsó Péter e.v., Győr, Hungary. Contact: info@sansoft.hu. One person, one mailbox; there is nobody else to go through.
Nothing about you is stored. Where you fly, what you look at, how long you stay — none of it is recorded, and there is nothing to record it into. Your language choice and a few settings live in your own browser (localStorage) and never leave it.
An account is optional and unlocks exactly one thing: having a description and a surface view generated for an object. This is what it holds:
| e-mail address | identifies the account, and is how you can be reached about it |
| password | only a one-way bcrypt fingerprint. The password itself is never stored, never logged, and cannot be recovered from the fingerprint — not by anyone, including the owner |
| nickname | the name shown if a name is ever shown |
| dates | when the account was made, and when it was last used, so an abandoned account can be spotted |
What is not stored: no IP address, no browser fingerprint, no behaviour log. The account files sit outside the web root, so there is no address at which one could be fetched from the outside.
Your password stays with Google and never reaches this server. What Google hands over is your e-mail address, the fact that Google has verified it, and your first name — used as a nickname, and only if it comes through. Nothing else is requested: no mail, no calendar, no contacts, no files. Those would be indecent even to ask for.
The access token Google issues is used once, on the server, to check two things — that the token was issued for COREWARD and not for some other site, and that the address is verified — and then it is discarded. It is never written to disk. Google's own sign-in code is fetched only if you actually open the sign-in window; if you never do, nothing is loaded from Google on your behalf on that page.
An account made this way holds the same four things as any other, plus your Google account's numeric identifier, so the same person is recognised next time even if the address is later renamed. If an account already existed here under that address, signing in with Google opens the same account rather than a second one.
Google's own handling of the sign-in is theirs, not ours: policies.google.com/privacy. You can withdraw this site's access at any time at myaccount.google.com/permissions.
Google Analytics runs on the game page. It is there for exactly one reason, and it is worth saying plainly rather than in the abstract: so that the owner can see how many active players there are, and which countries they are in. Nothing else is done with it. It is not used to build a profile of you, it is not linked to any account, and nothing is sold or passed on to anyone.
To do that much it records that a visit happened, which pages were opened, roughly where in the world the request came from, and what browser and device were used; it sets a cookie and passes your IP address to Google LLC, which may process it outside the European Union. There is no consent bar and no switch inside the game — a browser extension that blocks analytics stops it, and the game works exactly the same without it.
Payment is handled entirely by PayPal, on the support page and nowhere else. This site never sees a card number, and stores nothing about you beyond what PayPal reports back about the transaction itself. PayPal's code is loaded only if you actually choose an amount.
A description or a surface view is written for an object, not for a person. Once written it is kept and shown to everyone who visits that object; it carries no author, no account, no trace of who asked for it.
An account is kept until you ask for it to be deleted. Write to info@sansoft.hu and it goes, with everything in it, and no questions asked in return. Sign-in tickets expire by themselves after thirty days.
Under the GDPR you may ask what is held about you, have it corrected, have it deleted, have it handed to you in a portable form, or object to its processing. One address does all of it: info@sansoft.hu. If you are not satisfied with the answer, you may complain to the Hungarian supervisory authority (NAIH, Budapest, naih.hu).
If this ever changes, the date at the top changes with it. Nothing here is applied retroactively to data already deleted, because deleted is deleted.
Related: the terms of use, and the licence notice on the start screen.
← BACK TO COREWARD