Privacy Policy

This policy describes what we collect when you play Broski Battle IO or use broskibattle.io, why we collect it, and the choices you have. In this policy, "we" means Conscious Innovations Inc., the data controller for the Service. We choose why and how your information is used.

We do not sell your data, and we do not use device fingerprinting. We do not show ads yet; the Advertising section below explains what will apply when advertising is live. If you do not agree with this policy, please do not use the Service. If you change your mind later, you may stop using the Service and exercise the rights described below.

Questions about our data practices, your rights, or complaints: email team@broskibattle.io.

Account data you provide

When you register or sign in, you give us an email address (used as your username), a password (we store only a one-way hash), and a display name. We also generate a friend code so other players can find you. We process this to create and maintain your account. Basis: performance of our contract with you.

Signing in with Google or Facebook

If you choose to sign in with Google or Facebook, that provider sends us its identifier for your account, the email address on it (Facebook only if your Facebook account shares one), and your name, which we use only to suggest a display name. We store the identifier and the email address so you can sign in again; we do not store a password for these accounts, and we never read anything else from, or post anything to, your Google or Facebook account. What Google or Facebook themselves record about the sign-in is covered by their own privacy policies. Basis: performance of our contract with you.

Emails we send

We send account emails only: a link to confirm your address when you register with an email, and a link to choose a new password when you ask for one. We do not send marketing or newsletters. If an address is never confirmed and the account never plays a round, we delete the account automatically (see Retention). Basis: performance of our contract with you.

Data generated when you play

Match outcomes (wins, losses, rank), per-character stats (kills, damage dealt/taken), unlocks you've earned, rounds played. We use this to run leaderboards, progression, and matchmaking. Basis: performance of our contract with you.

Data you create in social features

Friend requests and the contents of private messages you send to other players. Basis: performance of our contract with you.

Device data needed to keep you signed in

A signed session token and, for guest play, a resume token, stored locally on your device (in your browser's storage for broskibattle.io, where the website and the game share it). These are strictly necessary to operate the service you requested.

Operational data we generate server-side

Aggregate usage counters (daily rounds played, peak concurrent players, character popularity), per-day activity indicators linked to your account, server logs (account events, errors), and the country derived from your connection (we do not store your raw IP). We use this to keep the service running, secure it, prevent abuse, and report aggregate traffic to ad networks. Basis: our legitimate interests.

Website visit counts

When you open a page on broskibattle.io, we count the visit. When a visit arrives from somewhere else, we also count where it came from (the website that linked to us, or the campaign tag in the link) and your approximate location (city, region and country), which our content delivery network works out from your connection. These are totals only: we do not store your IP address with them, we do not set cookies or store anything on your device for them, and they cannot identify you. We use them to see which places bring visitors to the game. Basis: our legitimate interests.

Sources. We collect Service Data from you (information you submit at registration and during play, and the contents of messages you send), from your device (the strictly-necessary session and resume tokens described above, and the site that linked you to us when you open a page), and from our own servers (operational and aggregate records generated by your use).

Recipients. We share Service Data only with the processors we need to operate the Service:

• hosting and infrastructure providers that run our servers and the website, the content delivery network that serves the website, and the email delivery service that sends our account emails (Amazon Web Services, including Amazon CloudFront and Amazon SES);
• Google and Meta, only when you choose to sign in with Google or Facebook, and only to verify that sign-in;
• if we add a third-party ad network, that network, which collects its own data under its own privacy policy and consent tool. We will name it here before it runs.

These providers process data on our behalf under contract and may not use it for their own purposes. We do not sell Service Data. We do not share Service Data for cross-context behavioral advertising. We may disclose Service Data where required by law, to protect the safety of users or the Service, or in connection with a merger, acquisition, or sale of assets.

Advertising is not live yet. When it is, the Service will show ads to keep it free to play:

• Our own ads. Promotions for Broski Battle and for products from partners we choose, in the game and on the website. Partner ads are labelled "Sponsored", and we may earn a commission if you buy through one. To show ads that are relevant where you are, we may use your approximate location (city, region and country), worked out from your connection when the ad is chosen; we do not store it with your account. Our own ads use no cookies and store nothing on your device. If you click a partner ad, the partner's website and its privacy policy apply from there.
• Rewarded ads. Watching an ad to earn an in-game reward is always your choice. We count the ads you watch and credit them to your account.
• Ad networks (such as Google AdSense). If we add a third-party ad network, we will update this policy before it runs. Those networks use cookies to serve and measure ads, and where consent is required (for example, for players in the EEA, UK, or Switzerland), a consent tool will ask for your choices before any advertising data is collected. You can opt out of personalized advertising from Google at Google Ads Settings, and out of many third-party vendors' cookies at www.aboutads.info.
• We do not build advertising profiles of you, and we do not give advertisers your account details.

We use a small number of cookies and local-storage entries:

• Strictly necessary: session and guest-resume tokens that keep you signed in and your progress saved. These cannot be disabled without breaking the Service.
• Advertising: none. Our own ads and our website visit counts set no cookies. If we add a third-party ad network, its cookies will be listed here and, where the law requires it, used only with your consent.

You can disable cookies in your browser at any time; disabling strictly-necessary cookies will stop the Service from working.

Your Service Data may be processed by us and our service providers in countries other than your own, including the United States, Canada, and Australia. Where this involves a transfer out of the EEA, UK, or Switzerland, we rely on adequacy decisions or standard contractual clauses.

• Account data and gameplay history: kept until you delete your account.
• Guest accounts that never play a round: deleted automatically after 10 minutes. Email registrations that are never confirmed and never play a round: deleted automatically after 48 hours.
• Email confirmation and password reset links: single-use, expire after 24 hours and 1 hour respectively.
• Private messages: rolling 90 days.
• Server logs: rolling 30 days.
• Per-day activity records: aggregated after 24 months, originals deleted.
• Banned accounts and abuse evidence: kept as long as needed to prevent re-abuse.
• Aggregate statistics: kept indefinitely.

We protect Service Data with TLS in transit, one-way hashing for passwords and resume tokens, signed session tokens, and access controls on administrative functions. No method is fully secure; we aim for industry-standard practice.

If you are in the EEA, UK, or a jurisdiction with similar laws, you can request access to, correction of, deletion of, or a copy of your data, and you can object to certain processing based on our legitimate interests.

You can delete your account yourself at any time from the account window in the game; broskibattle.io/delete-account explains how, and what is removed. To exercise any other right, or to have us delete the account for you, email team@broskibattle.io. We will respond within one month. If you are not satisfied, you may lodge a complaint with your local data protection authority. We do not make automated decisions about you.

California residents have the right to: know what personal information we collect and how it is used; delete their personal information; correct incorrect personal information; and limit the use of sensitive personal information.

Over the past 12 months we may have collected: identifiers (email address, display name, friend code); and account and gameplay records. This information comes from you, your device, and our own servers. We do not collect sensitive personal information as defined by California law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. If we add a third-party ad network whose cookies would count as "sharing" under California law, we will say so here and offer a way to opt out; you can also email team@broskibattle.io.

To exercise these rights, email team@broskibattle.io — we will respond within 45 days. We will verify requests by matching identifying information you provide (such as your email, display name, or friend code) against our records. You may authorize an agent to make a request on your behalf; we will verify the authorization. We do not discriminate against users who exercise these rights.

We do not respond to Do Not Track browser signals, as there is no accepted standard for doing so; use the opt-outs in the Advertising section instead.

The Service is not directed to anyone under 16, or the age of digital consent in their jurisdiction, whichever is higher. We do not knowingly collect personal information from children. If you believe a person under that age has registered, contact us and we will delete the account. Parents or guardians who believe we have collected information from a child under 13 without verifiable parental consent may contact us to request deletion.

We may update this policy. Material changes will be posted here with a new date, and we will notify you through the website or in-game where significant.

Questions? Email team@broskibattle.io