Version privacy-draft-2026-11-04

Privacy Policy

Draft for an attorney's review. Not in force. This text describes what the game collects today and why, and must be reviewed by a qualified attorney (GDPR, UK GDPR, CCPA/CPRA, CASL, COPPA) before anyone relies on it. Highlighted blanks are details still to be filled in.

Who is responsible

Palm Leaf Partners, [legal name and entity type], [business mailing address], runs Tanks & Titans: Blackout and decides how your information is used (the "controller"). Contact: [privacy email address]. [Attorney: an EU and a UK representative, if required.]

What we collect, and why

What	Why	Legal basis (EU/UK)
Your email address and password (stored only as a one-way hash)	Your account: signing in, verifying your address, resetting your password	Contract
Whether you want the newsletter, when you said so, the exact words you were shown and their version	Sending the newsletter only to those who asked, and proving that they did	Consent (the newsletter); legal obligation (the record)
A guess at your region (US, Canada, UK, EU or other), worked out in your browser from its time zone and language	Choosing whether the newsletter box starts ticked, so the law where you are is respected. We do not look up your IP address for this.	Legal obligation; legitimate interests
Your agreement to the Terms and this Policy, with the version and time	Knowing which terms apply to you	Contract; legal obligation
Items on your account (for example the First Signal camo)	Giving you what you earned	Contract
Match data: the orders given in a match, results, replays	Running multiplayer matches, replays and fair play	Contract; legitimate interests
Chat messages and reports in multiplayer	Carrying chat to other players; dealing with abuse	Contract; legitimate interests
Technical data our hosts log (IP address, browser, times of requests)	Security and keeping the service running	Legitimate interests

Voice orders stay on your computer. When you hold the talk key, your speech is turned into text by a model running in your browser. The sound is not sent to us or anyone else.

[Attorney: if match data is later used to train the computer opponent, that needs its own notice and, where required, consent. Not collected for that today.]

Emails

Account emails (verification, sign-in codes, password resets) are sent to everyone with an account, when needed. They are not marketing.
The newsletter (news about the launch, updates and events) is sent only if you ticked its box. It is never required to play. Every newsletter has a one-click unsubscribe link, and you can turn it off on your account page. Subscribers get the First Signal camo and keep it if they unsubscribe.

Who we share it with

We do not sell your personal information or share it for advertising. We use these service providers, who process it for us under contract:

Supabase (accounts and the database)
Cloudflare or Vercel (hosting the website)
Cloudflare (multiplayer servers and large game files)
Resend (sending email)

Some of them are in the United States. [Attorney: transfer mechanism for EU/UK data (Data Privacy Framework or standard contractual clauses), and the providers' data processing agreements.]

Cookies and storage

We set one cookie, tt_session, on tanksandtitans.com and its subdomains, to keep you signed in across the website and the game. It is strictly necessary. The game also keeps your settings in your browser's storage. We use no advertising or tracking cookies.

How long we keep it

Your account, until you close it. [Attorney: deletion within N days of closing; backups.]
Consent records, for as long as we might need to show that consent was given ([N years after the newsletter ends or you unsubscribe]).
Unverified sign-ups, [30 days].

Your rights

Depending on where you live, you can ask to see, correct, download or delete your information, object to or restrict how we use it, and withdraw consent at any time (withdrawing does not affect what was done before). California residents have the rights the CCPA/CPRA gives them; we do not sell or share personal information as those laws define it. To use any of these rights, write to [privacy email address]. You can also complain to your data protection authority.

Children

The game is not for children under 13, and we do not knowingly collect their information. If you think a child under 13 has an account, tell us and we will delete it. [Attorney: age of digital consent in the EU and parental consent.]

Security

Passwords are stored only as salted one-way hashes, connections are encrypted, and access to the database is limited to what each part of the service needs.

Changes

If we change this Policy in a way that matters, we will tell you before it takes effect. Each version is numbered at the top of this page.