Privacy Policy
Last updated: 1 October 2026
Distortion39 is a browser game at distortion39.com. This policy explains what personal data the game processes, why, on what legal basis, how long it is kept, and the rights you have under the EU General Data Protection Regulation (GDPR). We collect as little as the game needs, we never sell your data, and we never share it with anyone for their own purposes.
1. Who is responsible
The data controller is Volodya Sveredyuk, the developer of Distortion39. You can reach us at any time through the Feedback form in the game's main menu; it attaches your player ID, so we can find your data.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Player ID: a random identifier created in your browser. It does not contain your name, email or anything about you. | To recognise your browser, keep your progress and link your runs together. | Performance of our service to you (Art. 6(1)(b)) |
| Game progress: your heroes' books, Academy points, protected book and stash, and your saved game. | So your progress carries over from run to run. | Art. 6(1)(b) |
| Gameplay statistics: how each run goes (waves, heroes, items bought, books learnt, damage, deaths) and a replay of the moves made. | To balance, improve and fix the game, and to let you watch and share your runs. | Our legitimate interest in improving the game (Art. 6(1)(f)) |
| Technical data: browser and operating system, screen size, language, time zone, graphics card, memory and CPU cores, frame rate, load time and errors. | To find and fix performance problems and bugs. | Art. 6(1)(f) |
Google account ID, only if you choose to sign in with Google. We ask Google for this identifier only (the openid scope): never your email, name or photo. |
So your progress follows you to any browser or device. | Art. 6(1)(b), at your request |
| Nickname: the name you type for multiplayer or the rankings (optional). | Shown to the other players in your lobby, and publicly in the rankings next to your best runs (wave, hero, time). Without one you appear as "Wanderer #" and a short tag. | Art. 6(1)(b) |
| Feedback: your message, rating, any contact you choose to leave, the game version and your player ID. For rate limiting we keep a one-way hash of your IP address, never the address itself. | To read and answer your feedback, and to stop spam. | Art. 6(1)(f) |
We do not collect your name, email address, IP address, precise location or payment data, and we do not build advertising profiles.
3. Cookies and browser storage
- Browser storage (localStorage) holds your player ID, saved game, settings, a copy of your progress, and statistics waiting to be sent. It stays in your browser.
- Session cookie
d39_session, only if you sign in: keeps you signed in for up to 180 days. It is strictly necessary for signing in; signing out deletes it. - A short-lived cookie (10 minutes) protects the sign-in with Google against forgery.
There are no advertising, tracking or third-party analytics cookies, and no third-party scripts on the game's pages.
4. Who else processes the data
We never sell, rent or share your data with third parties for their own purposes. To run the game we rely on these service providers, who process data only on our behalf and under their data processing terms:
- Cloudflare, Inc. hosts the game and its database. Like any web host, it handles your IP address to deliver the site; we do not store it.
- Google, only when you choose to sign in with Google, to confirm your sign-in.
- Telegram, to deliver feedback messages to the developer.
Where data is processed outside the European Economic Area, it is protected by the providers' Standard Contractual Clauses or the EU–US Data Privacy Framework.
A replay you share can be watched by anyone with its link. It shows the game only: players appear as "player 1", "player 2", with no ID or device details.
5. How long we keep it
- Game progress and your account link: until you ask us to delete them.
- Gameplay statistics and replays: kept pseudonymous (linked only to the random player ID) for as long as they help us improve the game, or until you ask us to delete them.
- Sign-in sessions: up to 180 days, or until you sign out.
- Co-op lobbies: ended 15 minutes after the last player leaves.
- Feedback: until it has been handled, then deleted on request.
6. Your rights
Under the GDPR you have the right to:
- access the data we hold about you, and get a copy (portability);
- have it corrected, or deleted ("right to be forgotten");
- restrict or object to its processing, including the statistics based on our legitimate interest;
- withdraw anything you agreed to at any time (for example, sign out and ask us to remove your account link);
- complain to your local data protection authority.
To use any of these rights, send a request through the in-game Feedback form (it includes your player ID). We answer within one month, free of charge. Clearing your browser's site data also removes everything stored in your browser.
7. Security
All traffic is encrypted (HTTPS). Session tokens are stored only as hashes, IP addresses in feedback only as one-way hashes, and access to the statistics is limited to the developer, behind a separate sign-in.
8. Children
The game is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has sent us data, contact us and we will delete it.
9. Changes
We will update this page if what we collect changes, and change the date at the top.