Privacy Policy

Draft for the early alpha — still to be reviewed before public launch.

Version 2026-10-03. This page explains what Toybox Takedown keeps about you, why, and how to get it removed. Short version: an account is a username, an email and a password; we keep your match results; there are no ads, no trackers and nothing is sold.

Who is responsible

Toybox Takedown is run by Miguel19877 (the "controller" under data-protection law). Contact for anything on this page: miguel@19877.tech.

What we keep

• Account — username, email address, whether you've confirmed it, when you signed up, and which version of the Terms you accepted. Your password is stored only as a salted scrypt hash; nobody can read it back.
• Profile and progress — your character and colours, skill rating, matches played, wins, XP and level.
• Match history — for each online match: the server, mode, map, time, and the scoreboard (player names, teams, kills, deaths, score).
• Sign-in sessions — a random token per signed-in device. We store only a hash of it; it expires after 30 days or when you sign out.
• Email links — confirmation and password-reset links, which expire after 48 hours and 1 hour.
• IP addresses — needed to connect you to the website and game servers. They are used briefly to stop password guessing (kept in memory for one minute) and appear in the web server's access logs, which are deleted after 14 days. Game servers don't store them.

The game keeps your sign-in token and settings on your own computer. The launcher downloads game files and checks them against our list; it doesn't send anything about you.

We don't use analytics, advertising, tracking cookies or third-party fonts or scripts on this site. The account page keeps your sign-in in the browser tab's session storage, which goes away when you close the tab.

Why (legal basis)

• To run your account and let you play online — needed to provide the service you signed up for (contract).
• To keep the game fair and safe — rate limiting, ban enforcement, investigating cheating (legitimate interest).
• To email you — only about your account: confirming your address, password resets, and notices that your password changed. No newsletters unless you separately ask for them.

Who else handles it

Only providers we need to run the service, acting on our instructions:

• Hosting: [hosting provider and the country of its data centre — to be filled in].
• Email delivery: [email provider — to be filled in].

Other players see your username, character, colours, level and in-match scores. We don't sell or share your data with anyone else unless the law requires it.

How long we keep it

Your account stays until you delete it. If you delete it, your account, email, password hash, sessions and links are erased at once; past match scoreboards keep the numbers but your name is replaced with "(deleted)". Web server logs go after 14 days. Backups, if any, roll over within 30 days.

Your rights

You can see your data and delete your account yourself on My account. You can also ask us to give you a copy of your data, correct it, restrict or object to how we use it — write to miguel@19877.tech and we'll answer within a month. If you think we've got it wrong, you can complain to your local data-protection authority.

Age

You need to be at least 13 to make an account. In some countries you need a parent's consent until 16. If you think a child under 13 has made an account, tell us and we'll delete it.

Changes

If this policy changes in a way that matters, we'll say so on this site and in the game before it applies.