Privacy Policy

Last updated: 11 November 2026

Space Time Challenge is a free browser game. We collect as little data as we can: you can play without an account, we use no advertising, no analytics and no tracking cookies. This page explains what we do process and why. It applies under the Swiss Federal Act on Data Protection (FADP) and, for players in the EU/EEA, the GDPR.

Who is responsible

For any question about your data, write to the address above.

When you play without an account

• Device ID. On your first visit the server gives your browser a random ID, signed so it cannot be forged. It is kept in your browser's local storage. Our database only ever stores a one-way hash of it, and only once you submit a record.
• Records. When a round is a personal best, we store the result: score, start time, game version, the random seed, your inputs during the round (so the server can replay and verify it) and a small heatmap of where your rocket flew.
• Three letters. The initials you enter for the leaderboard.
• Country. Our hosting provider tells us the country of your connection (for example "CH"). We store the two-letter country code with your record. We do not store your IP address.

When you create a free account

• E-mail address, to send you sign-in links or codes. We do not send newsletters.
• With "Continue with Google": Google shares your e-mail address, name, profile picture link and Google account ID with our sign-in provider. We only request these basic profile details.
• Username you choose, and the records linked to your account. When you first sign in on a device, that device's anonymous records move into your account.

What others can see

Leaderboards are public. They show your username (or your three letters), your country, your score and when you set it. Your e-mail address is never shown.

Stored on your device

The game uses your browser's local storage, not cookies, for: the signed device ID, your local best times and initials, the sound setting and, if you sign in, your sign-in session. You can clear it at any time in your browser settings; you will then play as a new device.

Server logs

Like every website, our hosting and database providers briefly process your IP address and technical request data (time, page, browser) to deliver the game and protect it against abuse. These logs are kept by the providers for a short period and are not used to identify you.

Why we process this data

To run the game, the leaderboards and your account as you requested (GDPR Art. 6(1)(b)), and to keep the game fair and secure, for example by verifying records and stopping cheating and abuse (our legitimate interest, GDPR Art. 6(1)(f)).

Service providers

• Vercel Inc. (USA) hosts the website and the game server.
• Supabase Inc. (USA) provides the database and sign-in. The database is located in Zurich, Switzerland.
• Google LLC (USA), only if you choose "Continue with Google".

Some of these companies are based in the USA, so data may be accessed from there. Where needed, these transfers are covered by the EU Standard Contractual Clauses or the Swiss-US Data Privacy Framework.

How long we keep data

• Records stay on the leaderboards as long as the game runs. Detailed input logs may be deleted earlier for records that are not among the top scores.
• Your account and its data are kept until you ask us to delete it.

Your rights

You can ask us for a copy of your data, to correct it, to delete your account and records, or object to processing. Write to zkydragon.entertainment@gmail.com from the e-mail address of your account; we reply within 30 days. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU/EEA, to your local data protection authority.

Children

The game is open to everyone. If you are under 16, please ask a parent before creating an account.

Changes

If we change how we use data, we update this page and the date at the top.