Privacy policy

Your account and game

We use your email, a one-way password hash if present, authentication/session metadata and internal account ID to operate and secure your account. Google sign-in stores the verified Google identity and email; a supplied name and profile-picture URL may be stored and used for account presentation. We never receive your Google password or store your password in readable form.

We store your virtual balance, level, XP, machines, stock, features, sale history, achievements and transaction ledger to preserve progress. There are no in-app purchases or billing in this version; no payment-card or real-money purchase data is collected.

Testing and feedback

Joining testing is voluntary. Your linked Google email is used for testing-group membership. We store participation, membership observations, optional Play setup reports and server-observed game actions. These do not automatically prove continuous Play opt-in or Google's eligibility decision.

Private reports and team replies are visible only to you and authorized operators. A website review requires a separately chosen display name, content-rules acceptance, publication consent and moderation. Only the approved name and text become public. Reports never become public reviews automatically.

Technical services and on-device data

Necessary host-only cookies keep you signed in separately on the website and game. Unsent feedback and review drafts, including selected consent, are saved only in your browser tab's session storage, bound to your account. They are not submitted automatically. Signing out here or switching accounts clears them. Browser storage restrictions may prevent draft restoration.

The Android WebView keeps authentication cookies and ordinary page/map cache; Android app-data backup is disabled. Uninstalling or clearing app data removes local WebView data under Android's controls.

Cloudflare delivers and protects network traffic. The game requests map styles and tiles directly from OpenFreeMap, using fixed game locations, not your physical location. Requests can expose IP address, browser/operating-system information and timing to those providers. Their own privacy and retention policies apply.

Google processes authentication when you choose Google sign-in. When your Google profile picture is shown, your browser or Android WebView requests it directly from Google's googleusercontent.com image service. These requests can expose IP address, browser/operating-system information and timing to Google under its privacy policy. This does not give us access to your device's photo library.

Ordinary operational logs can contain IP addresses, request paths, times, statuses and errors. Credential parameters are filtered. There are no advertising, analytics or billing SDKs. We do not access your contacts, device photo library, microphone, physical location, advertising IDs or installed-app lists.

If you email support, your email and mailbox providers process the address and message so we can reply. Never send passwords, identity documents or payment information.

Retention and deletion

Live account and game data remain while the account exists. Reset-token metadata expires after six hours; remembered login lasts up to two weeks. Account deletion removes the live account, identities, game data, participation, reports, replies and public review. Minimal external-group removal work remains until absence is confirmed. Leaving testing removes group access and the public review, not your game account or private support history.

Restricted backups can retain former rows until the fourteenth daily backup rotation. They are for controlled recovery and must not be restored to service unless later deletions can be re-applied before startup. This is an operator rule, not an automated replay guarantee.

Application/supporting-service logs use one rolling file per container capped at 100 MB; the local request proxy uses one 10 MB log. Older entries disappear as the cap is reached or the container is removed, not on a promised fixed-day schedule. Provider records follow their own policies. We cannot recall public reviews already copied by other people.

Children, security and changes

The game is intended for people aged 13 and older, not children under 13. We do not collect a date of birth or operate an age-verification system. Contact play@sk8.digital about a child's account so we can review and delete it as appropriate.

We use HTTPS, password hashing, restricted operator access and the deletion controls described here. No system guarantees absolute security. We update this policy when our data practices change.