PRIVACY POLICY

Elements ("the game", "we") is a free online multiplayer bending arena at elements.lumpkin.xyz, run by an individual hobbyist developer. This page explains what information the game handles and what we do with it. You can play as a guest without giving us any personal information.

What we collect

If you create an account, we store:

• your username and email address;
• a password hash (never your password itself), if you sign up with a password;
• your Google account ID and verified email address, if you sign in with Google. We receive only your Google user ID, email address, and first name (used to suggest a username). We do not receive your Google password, contacts, or any other Google data;
• your saved settings: graphics, sensitivity, volume, hotbar layout, keybinds and preferred element;
• your gameplay statistics: kills, deaths, matches, wins, damage, time played, element and ability usage, and which accounts you have played matches with;
• your friends list and pending friend requests;
• a session cookie that keeps you signed in for up to 30 days.

Whether or not you have an account, the game server handles:

• the display name you choose, visible to other players in your room;
• chat messages you send in a room. They are held in memory for the life of the room and are not saved to a database;
• your IP address, used to limit abuse (for example, the number of connections per address). Our web server and hosting provider may also keep standard access logs containing IP addresses for a limited time.

Your online status (online, in a lobby, in a match, and the room code of a joinable room) is shown to the people on your friends list while you are signed in.

What we do with it

• run the game: sign you in, sync your settings across devices, show statistics, power friends and online status;
• keep the service safe and fair: prevent abuse, spam and cheating;
• contact you about your account if needed.

We do not sell your information, show advertising, or use analytics or tracking cookies.

Who can see your information

• Other players see your display name, and anyone can view the gameplay statistics of an account by its username. Your email address is never shown to other players.
• Your friends see your online status.
• Resend (privacy policy) delivers the emails we send you: a one-time code to confirm a new password sign-up, and a one-time code if you ask to reset your password. We send these only to the address you give us for that purpose, and nothing else (no marketing). Resend receives that address and the message.
• Google, if you choose "Continue with Google", processes your sign-in under Google's Privacy Policy. The game's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• Service providers that host the game (a virtual server provider) and the content delivery networks that supply the game's 3D graphics code (cdnjs.cloudflare.com and cdn.jsdelivr.net) can see your IP address when your browser loads the game.
• We may disclose information if required by law.

Cookies and local storage

The game uses one essential, HttpOnly cookie (sid) to keep you signed in, and a short-lived cookie during Google sign-in to protect against forged requests. Your browser's local storage keeps your settings on your device. We do not use advertising or tracking cookies.

Retention and deletion

Account data is kept until you ask us to delete it. To delete your account and its statistics and friend connections, email jlump001@gmail.com from the address on the account and we will remove it. Signing out ends your session on that browser. You can also revoke the game's access to your Google account at myaccount.google.com/permissions.

Security

Passwords are stored only as salted scrypt hashes. Connections use HTTPS. No online service is perfectly secure, so please use a unique password or sign in with Google.

Children

The game is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

Changes

We may update this policy as the game changes. The date at the top shows when it was last revised. Continuing to use the game after a change means you accept the updated policy.

Contact

Questions or requests: jlump001@gmail.com.