Privacy policy

Who we are

IMPACT FRAME is made and run by Arun Prakash, an independent developer in India (“we”, “us”). We decide what happens to the personal data described here, which makes us its data fiduciary under India’s Digital Personal Data Protection Act, 2023, and its controller under the GDPR for players in the EU and the UK.

For anything on this page, including a complaint, write to [email protected]. That address is also our grievance officer: a person reads it, not a bot.

Playing without an account

The game runs in your browser. If you never sign in, your progress, your settings and the secrets you have found are saved in your browser’s local storage, on your device only. The website remembers your ink colour and whether you turned motion off the same way. Clearing your browser’s site data wipes all of it, and we cannot bring it back, because we never had it.

Like any website, our servers note each visit for security: the time, your IP address and the kind of browser and device. That is how we spot attacks and abuse. It is kept for one year, then deleted.

What we keep when you sign in

Signing in is with Google. Google asks you first, then tells us:

• A number for your Google account. It is how we know it is you next time. It means nothing outside our game.
• Your name as Google has it, first and last. We keep it for our records and never show it to anyone.
• Your email address, and only if Google has checked that it is yours.

We never see your Google password, your contacts or anything else in your Google account. Then, as you play, we keep:

• Your in-game name, and every one you have had. We make one for you when you sign up, from your first name and the first letter of your last name, and you can change it once on the Account page. It is the only name anyone sees, on the leaderboard, in rooms and in our emails to you.
• Your game: your Marks and Foil and every change to them, the gear you own and wear, your versus rating and record.
• Your fights: for each Gauntlet run and ranked match, the buttons pressed and when, the starting seed, the score and the result, so we can check it before it counts.
• A play log: when you sign in and play, which mode and for how long, the kind of browser and device, and your IP address.
• A sign-in cookie called if_session, which keeps you signed in for 30 days. We store only a scrambled fingerprint of it, never the cookie itself.
• The emails we send you: which one, when, and whether it was delivered.
• Reports: names you report, and reports other players make about yours.
• What you write to us at [email protected], so we can answer it.
• Purchases, once Foil is on sale: what you bought, for how much and when. The payment itself is taken by Dodo Payments. We never see your card or UPI details.

What we don’t do

• We never sell, rent or trade your data. Not now, not in a sale of the game.
• No tracking pixels, no third-party analytics, no device fingerprinting.
• No location, contacts, camera, microphone or files.
• Ads in the game, when they come, are billboards and posters in the arenas, part of the art. They do not track you, and advertisers get none of your data. If that ever changes, this page changes first, and we ask for your consent where the law needs it.

What we use it for

Only for running the game you signed up for. For players in the EU and the UK, the legal basis for each use is in brackets.

• Your account: saving your progress and showing it on any device you sign in on (to provide the game you asked for).
• Fair play and safety: checking runs and matches before they reach the leaderboard or pay out, stopping cheats and attacks, and keeping names clean (our legitimate interest, and every honest player’s, in a fair and safe game).
• Making the game better: counting how many people play, which modes and for how long (our legitimate interest).
• The leaderboard and rooms: showing your in-game name, scores and rating to other players (to provide the game).
• Email: one welcome when you make an account, and notices about your account or these terms when they matter (to provide the game). News of events only if you switch it on, and you can switch it off at any time (your consent).
• Support and the law: answering you, and keeping what the law tells us to keep (a legal obligation).

What other players see

Your in-game name, your best scores and your versus rating are public on the world leaderboard, and players in a room with you (a Back Room, Home Turf or a ranked match) see your in-game name and the fight. Your real name and your email address are never shown to anyone.

Names are checked when they are set, against a list of slurs, sexual words and names that pose as us. A name you pick yourself, and a name a guest types into a room, is also checked by Jev, a service from TypeSafe AI that judges whether a name is acceptable. Jev is sent the name and nothing else: not who you are, not your account. Players can report a name. If we reset yours, you get a free change.

Nearby lobbies

In a Home Turf room your phones and computers talk to each other directly. To find each other they swap network addresses, which can include the address of your home network, through our server. We pass them along and keep none of them. A Cloudflare server helps the devices find a route and sees your public IP address to do it. The devices in the room can see each other’s addresses, so host Home Turf with people you are actually near.

Copies of the game on other websites

The game plays only at impactframe.app. If a copy of it runs on another website, the copy tells us that website’s name, which version of the game it is and which check noticed it. We keep that, with when it was first and last seen and how often, to find copies and have them taken down. Nothing about the person playing the copy is kept: not their IP address, not a cookie, not their device. The game at impactframe.app never sends this.

Who helps us run the game

These companies handle data for us, only to do their job, under their own privacy terms:

• OVHcloud runs our servers and the database, in France.
• Cloudflare carries the website’s traffic and protects it from attacks. It sees IP addresses and requests as they pass.
• Google runs the sign-in. Loading the sign-in button on the play page lets Google know you visited it.
• Purelymail sends our email and holds the mail you send us.
• TypeSafe AI runs Jev, which checks names players pick. It is sent the name alone.
• Dodo Payments will take payments for Foil, as the seller of record.

Where it is stored

Your account lives on our servers in France, in the European Union. Cloudflare, Google, Purelymail and TypeSafe AI may handle data in other countries as they carry it. Wherever it goes, the protections on this page go with it.

How long we keep it

• Your account and game: for as long as you have an account.
• The play log and the security log: one year.
• The sign-in cookie: 30 days, or until you sign out.
• A welcome email that could not go out: dropped after two days.
• When you delete your account: it is closed at once. Your name leaves the leaderboard and lobbies, and nothing in it is used again. We keep a sealed copy for one year, only to deal with legal claims, fraud, cheating disputes and audits, then it is erased for good. Purchase records stay as long as tax law requires.

Your rights

Write to [email protected] from the email address on your account and we will, within 30 days:

• send you a copy of what we hold about you;
• correct anything that is wrong;
• close your account and delete what is in it, as “How long we keep it” explains;
• stop event news, or any other use you agreed to;
• note who should act for you if you die or cannot act yourself, as India’s law allows.

In the EU and the UK you can also object to a use, ask us to pause it, or take your data elsewhere. If we do not put a problem right, you can go to the Data Protection Board of India, or to the data protection authority where you live.

Children

Anyone can play without an account. To make one you must be 18 or over, or have a parent or guardian’s permission and play under their eye. Nobody under 13 may make an account. We do not track or profile children, and no ad is ever aimed at them. If we learn that a child made an account without that permission, we close it. Parents can write to us any time.

Keeping it safe

Every connection is encrypted. Sign-in cookies are stored only as fingerprints, the database cannot be reached from the internet, and only we can get into the servers. No system is perfect: if something goes wrong that puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this page, the date at the top changes with it. If a change matters to you, we will tell you by email or in the game before it takes effect.