Brawlock

Privacy Policy

Last updated:

This policy explains how Promp' Industries operates Brawlock at brawlock.osc.link and handles information about its players. For privacy questions or to request access, correction or deletion, use our private contact form.

Information we process

  • Account and sign-in information: when you choose Google sign-in, we receive your Google account identifier, email address and basic profile information, which may include a name and profile image. We store the account records, provider credentials and sessions needed for sign-in. Player sign-in requests only openid, email and profile; it does not request access to your Gmail, Drive, Calendar or contacts. We do not receive your Google password.
  • Passkeys: if you add one, we store its public credential and associated authentication metadata. Your authenticator handles your PIN or biometrics; Brawlock does not receive them.
  • Your player and game records: your chosen name and colour, account/player identifiers, room participation, match results and statistics, ranked rating, earned Embers, cosmetic ownership and equipped cosmetics.
  • Device and connection information: browser, device and tab identifiers, sign-in cookies, IP addresses and request/session information used to connect players, secure sessions, enforce limits and prevent conflicting game connections.
  • First-party activity statistics: visits, first/last seen, approximate app time, guest or signed-in state, selected game region, app/server version, screens visited, online counts and match outcomes. Analytics uses pseudonymous identifiers and can link guest activity on a browser to later signed-in activity. Game region means the selected server region, not location inferred from your IP address.
  • Chat and support: room messages are sent to other participants and kept in the room's live chat history. Messages you post in the main menu's global chat are shown to everyone using Brawlock with your player name, colour and selected region; the service holds only the latest 100 messages, in memory. When a global chat message is reported, we store it with its sender, the reports and any moderation action. Information you submit through the feedback form is used to handle your request.

What we use it for

We use this information to provide the game and account features you request, connect and reconnect players, maintain ratings and progression, answer support requests, and protect the service against abuse. We also use activity statistics to understand use, diagnose problems and improve Brawlock.

Where data-protection law requires a legal basis, account and game-service processing supports providing the service you request. Security, abuse prevention and service analysis support our legitimate interests in operating a reliable game, subject to your rights. We also process information where necessary to meet legal obligations or handle legal claims.

What other people can see

Your player name, colour, cosmetics, room participation and gameplay may be visible to other players. Leaderboards and player profiles can show your rating, results and gameplay statistics. Room chat is visible to the participants in that room. Global chat in the main menu is visible to everyone using Brawlock, including people who are not signed in. Players can save or share recordings of games they take part in.

Your account email, provider credentials, authentication tokens and private analytics reports are not published in player profiles or leaderboards. Do not post sensitive information in chat or your player name.

Cookies and browser storage

Brawlock uses cookies for sign-in, provider verification and consistent browser/game-session identity. Local and session storage keep preferences, browser and connection identifiers, and reconnect information. Match history and replays can also be stored in your browser, including IndexedDB. Clearing site data removes local records and preferences and may sign you out; it does not delete server-side records.

Brawlock uses its own operational analytics. If you opt in, Google Analytics also measures visits, referral domains and campaign tags, screen activity, tutorial progress and match participation. It uses analytics cookies and processes browser/device and connection information. We do not send player names, account email addresses, chat messages, invite codes or account/device identifiers to Google Analytics. Advertising personalization and Google signals are disabled. You can decline without affecting gameplay, or change your choice in Settings → Interface → Google Analytics. Turning this off stops further measurement and removes this site's Google Analytics cookies; it does not erase data already collected.

Hosting, sign-in and international processing

The service uses DigitalOcean infrastructure for game/account hosting, GitHub Pages for public game assets, Google for Google sign-in and game fonts, and Resend for private feedback email notifications. These providers process requests under their own terms and privacy policies: DigitalOcean, GitHub, Google and Resend.

Online games may use signaling and relay services to establish player connections. In player-hosted games, WebRTC connections may disclose network addresses to the host or other peers. Dedicated games connect through our game servers.

The shared account service is hosted in the United States; game servers operate in the United States and Europe. Providers may process requests in other countries. Contact us for information about the processing and transfer arrangements that apply to your data. We do not sell your personal information. Information may also be disclosed where required by law or necessary to protect players and the service.

Feedback and bug reports

When you choose to send a report, we receive your message, optional reply email, and the technical context shown in the reporting form: game and build version, browser and device information, game settings, connection and region, current match state, your own spell build, recent game events and bounded error details. If signed in, the service associates the report with your account. We use the connection address temporarily to limit spam. We do not copy cookies, authentication credentials or chat history into technical diagnostics.

The form captures a screenshot before it opens. You can preview it and exclude it before sending. A screenshot may contain visible player names, chat messages or account information. Authorized operators may also receive email digests of report messages through Resend. Screenshots, diagnostic context and reply addresses remain in the private inbox. Reports and attached images are stored privately on our United States account service to investigate bugs and improve Brawlock; they are not published. Reports currently have no automatic expiry. To request deletion, use our private contact form, ideally including your report reference.

Retention and deletion

Account, progression and match records are retained to operate your account, preserve gameplay history and address security or abuse issues. Persistent game and analytics history currently has no automatic expiry. Live online-presence leases expire after approximately 90 seconds without an update, and account sessions have a limited lifetime; neither expiry deletes the underlying account or history.

To request account or personal-data deletion, use our private contact form. We may need to verify that the request concerns your account. Signing out or removing Brawlock from your Google account does not itself delete records already held by Brawlock. Backups, hosting logs and records needed for legal or security purposes may not be removed immediately alongside live records.

Your choices and rights

You can play casual and custom games as a guest, edit your account's player name and colour, sign out, manage your Google connection and remove local browser data. Guest play still uses device, connection and activity information.

Depending on applicable law, you may request access, correction, deletion, portability or restriction of your personal data, and may object to processing based on legitimate interests. Use our private contact form to make a request or raise a concern. You can also complain to your local data-protection authority. If you believe a child has supplied personal information that should not be held, please contact us.

Changes

We will update this page and its date when our practices change. We will provide additional notice where required by applicable law.