This policy explains what data LOOT SLAYER ("the Game", "we"), operated by the owner of lootslayer.com, collects and how we use it. We keep it minimal on purpose. The Game is passwordless — we never create or store passwords.
What we collect
Email address — used only to sign you in. You log in by entering your email and a one-time code we send to it, or by choosing "Sign in with Google." Your email is private — it is never shown to other players. It is the one piece of personal data the Game relies on.
Username — a display name you choose on first login (changeable once every 7 days). This is public: it appears in chat and on the highscores board. It is not derived from your email.
Login codes & session tokens — the one-time codes we email you and the session tokens that keep you logged in are stored only as irreversible hashes; we cannot read them. The usable session token itself lives in your browser, not in a form we can see.
Game save data — your progress: skills, levels, inventory, equipment, and similar in-game state.
Multiplayer data — while you play, your approximate in-game position and any chat messages you send are shared with other online players and briefly stored, then automatically deleted.
Basic technical data — standard information your browser sends to our host (e.g., IP address, request logs) used to operate, secure, and protect the service against abuse.
No passwords
We do not create, request, or store passwords — there are none to leak. If our database were ever exposed, it would contain emails, usernames, and game saves only: no passwords, and no usable login codes or session tokens (those are stored hashed).
What we do NOT collect
We do not require your real name or phone number. We do not collect or store any payment-card information — donations are handled entirely by third parties (Ko-fi, PayPal). We do not run third-party advertising or sell your data.
Login & service providers
We don't sell your data. We rely on a few service providers to run the Game, who process data on our behalf under their own privacy policies:
Cloudflare — hosting, database, content delivery, and a bot-protection check (Cloudflare Turnstile) shown at login to confirm you're human.
Email delivery provider — processes your email address solely to deliver your one-time login code.
Google — only if you choose "Sign in with Google." Google authenticates you and provides us your verified email address and basic profile, under Google's own policies. We do not post anything or access your Google account beyond your identity.
Ko-fi / PayPal — voluntary donations, under their own privacy policies. We never receive your card details.
Your username and skill levels are public on the highscores board. Don't choose a username you want kept private. Your email is never public.
Cookies & local storage
The Game uses your browser's local storage to save your progress on your device and to keep you signed in (your session token). We do not use advertising or cross-site tracking cookies. The "Remember me" option keeps your session for up to 30 days; logging out clears it.
How we use your data
To sign you in (email code or Google), keep you logged in, and save/load your progress;
To power multiplayer (showing nearby players and chat) and the public highscores board (username + skill levels);
To maintain, secure, debug, prevent abuse, and improve the service.
Data retention
Your email, username, and save data are kept while your account is active so you can keep playing. One-time login codes expire within about 10 minutes; session tokens expire (up to 30 days) and when you log out. Temporary multiplayer data (position, chat) is purged automatically within minutes. Because the Game is pre-alpha, data may also be reset or deleted during development.
Your choices
You can log out at any time to end your session, clear your browser's local storage to remove the local copy of your save and token, and request deletion of your account (email, username, and save data) by contacting us.
Children
The Game is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided data, contact us and we will remove it.
Changes
We may update this policy as the Game develops; updates will be posted here with a new effective date.