What we keep
and why.

Your account

Email and password. Email accounts are run by Firebase Authentication (Google). Firebase stores your email and a hash of your password, and sends the verification and password reset emails. The game server never sees your password: it gets a signed token from Firebase that says who you are and whether your email is verified.

Pilot name. The name you choose when you sign up (or the first time you log in) is public: other players see it in game, on leaderboards and on the killboard. It is never made from your email.

Bot check. The sign-up, log-in and password pages may use Google reCAPTCHA through Firebase App Check to keep out automated sign-ups. It looks at how the page is used in your browser.

Playtest accounts made with a username and password in the game keep that login. Their password is stored as a salted hash on our server.

Referral code. If you arrived through a friend's link (/r/CODE), the code is kept in your browser for 30 days (local storage and a first-party cookie) and written once to your Firebase user record when you sign up, so the game can credit your friend. No other cookies are set by these pages.

Why: to give you an account and keep it yours (needed to provide the game).

Playing

• Your pilot and everything in the game: ships, items, credits, skills, chat and trades, on our server in the EU.
• Active play time: how long you actively play. It unlocks rewards (share and referral) and helps us see whether the game keeps people.
• Game events such as account created, tutorial finished or a referral that counted, to see whether sign-ups and rewards work. These are counted on our own server; there is no third-party tracker in the game or on this site.

Why: to run the game and improve it (needed to provide the game, and our legitimate interest in a working game).

Abuse review

Share and referral rewards are worth farming with fake accounts, so we keep two signals for review:

• the /24 network you registered from (the first three parts of your IP address, never the full address), and
• an install id: a random number the game makes on your computer. It says nothing about you or your machine.

A person looks at flagged pairs before any reward is paid. These signals are kept for 90 days, used only for this review, and deleted with your account.

Why: our legitimate interest in keeping rewards fair and stopping fraud.

Share posts

When you submit a post for the daily share reward, we keep its link and check it through the platform's public embed service (we never load your post's page ourselves). Some platforms can't be checked that way, so a person looks at the post.

Who else sees it

These companies process data for us, and only to run the parts named:

• Google (Firebase Authentication, Firestore, App Check and reCAPTCHA): logins, the sign-up record and the bot check.
• Google Fonts: this site's fonts load from Google's servers, which see your IP address when they do.
• Cloudflare (Pages and Workers): hosts this website and the live player count, and sees your IP address when you visit.
• Our server host in Germany: runs the game server and its database.

Nobody else, and we don't sell anything.

Deleting your data

Email [email protected] from the address you signed up with, or ask on Discord, and we delete your account: your pilot, your game data, the abuse signals and your Firebase login. You can also ask for a copy of what we hold about you, or for a correction.

Who is responsible

The controller for this data is Vermillion Online Inc. Privacy questions and requests: [email protected].

Contact

For anything else, the fastest way to reach us is the Discord. We'll update this page when anything here changes.