PRIVACY POLICY

01 — OVERVIEW

BreachOS is a cyberpunk memory card game operated by laddtnov and hosted at breachos.app. This policy explains what data we collect, why we collect it, and how it is used.

We collect only what is necessary to run the game. We do not sell your data, run advertising networks, or share your information with third parties except the services listed below.

02 — DATA WE COLLECT

We do not collect: device identifiers, location data, advertising IDs, browsing history, or any biometric data.

03 — HOW WE USE YOUR DATA

• Authenticate your account and keep your session active
• Sync your game progress across devices
• Display your score and username on the public leaderboard
• Send a one-time welcome email on registration
• Send a re-engagement email if you have not played in 14 days (max once per 30 days)
• Rate-limit authentication requests to protect your account from brute-force attacks

04 — THIRD-PARTY SERVICES

We use the following services to operate BreachOS:

No advertising networks, analytics platforms, or data brokers are used.

05 — DATA RETENTION & ACCOUNT DELETION

• Account data and game progress are retained as long as your account is active
• Vercel server logs are retained per Vercel's own policy (typically 30 days)
• Re-engagement email timestamps are cleared when you return to the game

How to delete your BreachOS account

1. Open BreachOS and log in
2. Go to Profile
3. Select Delete Account, then confirm

What is deleted immediately: your email address, password, username, and all game progress — XP, rank, achievements, unlocked skins, game history, and leaderboard entries. This is a hard delete from our database, not a deactivation.

What is retained: nothing tied to your account. Generic Vercel server logs (IP address, request path, timestamp) exist for every visitor regardless of account and are not linked to your identity once your account is deleted; these age out per Vercel's own retention policy (typically 30 days).

06 — YOUR RIGHTS

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to processing or request restriction
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at novytskiyvladislav@proton.me. We will respond within 30 days.

07 — LEADERBOARD & PUBLIC DATA

Your username and XP score are displayed publicly on the in-game leaderboard. If you do not want your data visible on the leaderboard, you may play without creating an account — guest play is fully supported and no data is sent to our servers.

08 — CHILDREN

BreachOS is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

09 — SECURITY

We apply industry-standard security measures: HTTPS for all connections, bcrypt-hashed passwords via Supabase Auth, JWT-based session tokens, rate limiting on authentication endpoints, and HTTP security headers (HSTS, CSP, X-Frame-Options) on all responses.

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please disclose it responsibly via email before public disclosure.

10 — CHANGES TO THIS POLICY

We may update this policy as the game evolves. Material changes will be noted by updating the date at the top of this page. Continued use of BreachOS after changes constitutes acceptance of the updated policy.

11 — CONTACT

Questions about this policy or requests regarding your data: