Privacy Policy
Last updated: 2026-08-22
Play Sabotage is a small, independently-run multiplayer game. This page explains, plainly, what data the game collects and why — there's not much of it.
What we collect
- Nothing, if you just play as a guest. You can create or join a room, play a full game, and use chat without ever giving us an email address, a phone number, or any identity information. A display name and an optional pawn icon are stored only for the lifetime of your room.
- Username + password, only if you register an account. Registration exists so you can keep a name across sessions — it does not currently unlock any feature guest play doesn't have. We store your chosen username and a one-way bcrypt hash of your password — never the password itself. We do not collect an email address, which also means there is currently no way to reset a forgotten password; see Terms of Service.
- IP address, transiently, for abuse prevention. Your IP is used to rate-limit room creation, joins, logins, and in-game actions, so one connection can't spam the server. This is held in server memory only, resets automatically every 60 seconds, and is never written to a database or logged permanently.
- Anonymous gameplay milestones. The server logs when a room is created, a second player joins, a game starts, and a game finishes — tied to a room code and a timestamp, not to any player identity — so we can tell whether the game is actually being played, not just visited. These rows contain no player names, IPs, or account data.
- Basic, cookieless site analytics. We use Vercel Web Analytics to see visit counts, referring sites, country, and device type. It identifies visitors with a hash that resets every day — no cookie, no persistent identifier, no cross-site tracking. See Vercel's Web Analytics privacy notice for how that data is handled on their end.
What we don't do
- We don't run ads or ad-tracking pixels.
- We don't sell or share your data with third parties for marketing.
- We don't set tracking cookies.
- We don't knowingly collect data from children under 13.
Where data lives
The game client is hosted on Vercel; the game server and database run on Railway. Both are infrastructure providers, not parties we share your data with for any purpose beyond running the game.
An active game room (players, moves, chat) lives in server memory and is automatically deleted after 3 hours of inactivity. Registered account records (username + password hash) persist until you ask us to delete them.
Your choices
To request deletion of a registered account, or to ask any question about this policy, please open an issue on the GitHub repository. There's no self-service deletion button yet — we'll process the request by hand.
Changes to this policy
If this policy changes in a material way, the "Last updated" date above will change. Given the size of this project, we don't expect frequent changes.