PRIVACY POLICY

1. INFORMATION WE COLLECT

We believe in strict data minimization. Depending on how you interact with GRIDMANIAC, we collect only the minimal data points necessary to run the game:

A. Gameplay & Multiplayer Sessions

When you participate in matches (Solo vs WARDEN, 1v1 matchmaking, or private rooms), our Cloudflare Workers edge coordinates game rooms in ephemeral memory (Durable Objects). We do not record or retain your physical location, device serial numbers, or browsing history.

B. Player Review & Contact Submissions

When you submit feedback or reviews via our Community Review form (/contact.html), we securely store:

• Player Callsign / Name: The handle you provide (maximum 50 characters).
• Rating: Your numerical evaluation (1 to 5 stars).
• Review Message: The textual commentary you provide (maximum 1,000 characters).
• Optional Email Address: If provided voluntarily for follow-up inquiries. This is never displayed publicly or shared.
• Cryptographic IP Hash: We do not store raw IP addresses in the database. Instead, an irreversible cryptographic hash (SHA-256) of your IP address is generated solely to enforce our abuse rate limit (maximum 2 submissions per 24-hour cycle) to prevent denial-of-service spam.

2. LOCAL STORAGE USAGE

GRIDMANIAC uses browser localStorage purely to remember your preferences locally on your client machine. This data never leaves your device:

• gm_callsign: Stores your selected pilot handle across browser reloads so you do not need to retype it.
• gm_audio_prefs: Remembers sound effect volume and mute preferences.
• gm_scorecard_cache: Caches your personal win/loss statistics and local high scores.

You may clear this data at any time through your browser's "Clear Site Data" or "Clear Cookies and Storage" settings.

3. COOKIES & SESSION TOKENS

GRIDMANIAC operates on a strict cookie-less player architecture for all general visitors:

• General Players: We set ZERO tracking, marketing, or profiling cookies on your browser.
• Developer & Administrative Authentication: Only authorized administrative operators accessing the restricted review console receive an authenticated session token. This token is stored inside an HttpOnly, Secure, SameSite=Strict cookie (grid_admin_token) to mitigate cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.

4. BOT MITIGATION & CLOUDFLARE TURNSTILE

To protect our review API from automated spam attacks without degrading user privacy, we utilize Cloudflare Turnstile.

Unlike legacy CAPTCHAs, Turnstile protects forms without forcing users through image-recognition challenges or tracking users across unrelated sites. It validates browser authenticity through non-intrusive cryptographic challenges executed entirely on the Cloudflare network.

5. DATA RETENTION & DATABASE SECURITY

Review submissions are stored in Cloudflare D1, an encrypted serverless SQLite database. All database interactions utilize strictly parameterized SQL prepared statements to prevent injection attacks.

Data is retained only as long as necessary to review gameplay feedback and improve balance. Player reviews may be audited or cleared periodically by game administrators.

6. YOUR RIGHTS (GDPR & CCPA COMPLIANCE)

Under applicable data protection legislation (including GDPR, CCPA, and UK GDPR), you hold the right to:

• Request confirmation of any personal data held concerning you.
• Request rectification of inaccurate commentary or callsigns.
• Request permanent erasure of your submitted reviews and associated IP hash records.

7. CONTACT & DATA CONTROLLER

If you have questions regarding this Privacy Policy or wish to request data deletion, you may transmit a request directly through our Community Review Console with your pilot callsign, or contact the core engineering team at: