Privacy notice draft
Draft only — pending owner and qualified legal review under external gate EG8. This text is not an approved or published privacy notice.
Provisional data inventory
The service is designed to store account identifiers supplied by a chosen login provider, a public recruit name, hashed session and one-time challenge values, game scores tied to a release version, and security audit records. Abuse controls use keyed or hashed network and email-derived identifiers instead of raw values where practical.
Purpose and sharing
These fields are intended to provide login, saved identity, official scoring, fraud and abuse prevention, support, and service reliability. Hosting, database, mail, object-storage, and identity providers will need a reviewed processor/subprocessor inventory before activation.
Retention and deletion
Sessions and transient authentication challenges have configurable expiry. Account deletion anonymizes historical score ownership while preserving release integrity. Final retention periods, legal bases, regional rights, contacts, and appeal procedures remain explicit EG8 decisions.
Cookies and local storage
An HTTP-only session cookie supports signed-in play. Browser-local storage keeps game progress and preferences. The final notice must identify durations and any consent obligations for each launch region.