Privacy Policy

1. Who we are

Broadside Battle Arena (the "Game") is developed and operated by Siphaawal, an independent developer based in the United States ("we", "us", "our"). There is no company behind the Game yet. If one is formed, this policy will be updated to name it.

We are the controller (in some jurisdictions, the "business" or "personal information controller") responsible for the personal information described in this policy. Where a platform such as Epic Games processes your information under its own terms, for example when you create or manage your Epic Games account, that platform is responsible for its own processing under its own privacy policy.

Privacy questions and requests go to our privacy contact at clawdistani@hotmail.com. That contact is the person responsible for protecting personal information for the purposes of Quebec's Law 25, the data protection officer contact (encarregado) for Brazil's LGPD, and the grievance contact for India's Digital Personal Data Protection Act.

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or UK GDPR. You can reach us directly at the address above, and you keep every right this policy describes.

2. Scope

This policy covers:

• the Game client, including test and pre-release builds;
• our online services: accounts, lobbies, matchmaking, parties, chat relay, rankings, statistics, feedback and any optional wallet or paid features ("Online Services");
• this website; and
• communications between you and us, such as support or press email.

It does not cover third-party services you reach through the Game, such as the Epic Games Store, the Epic Games Launcher, your wallet software or a blockchain network. Their own privacy policies apply to them.

3. Information we collect

3.1 Account and sign-in

• Epic Games sign-in. When you sign in with Epic, Epic Online Services gives us a verified token containing your Epic Online Services product user ID, a pseudonymous identifier specific to our game. We also receive your Epic display name, which we suggest as your player name. We do not receive your Epic account password or your email address from Epic.
• Google sign-in (where offered). If you choose to sign in with Google, we receive your Google account identifier, your email address and whether Google has verified it. We store the email address encrypted.
• Account record. An internal account ID, the date your account was created, its status (for example active or suspended), a trust level used for abuse prevention, and short-lived session records that keep you signed in.

3.2 Player profile and gameplay

• Profile. Your player name (which other players can see), your avatar choice, wins, losses, ships lost and skill rating.
• Matches. Who took part, the format, start and end times, the result, which player hosted, and whether a result was disputed.
• Statistics. Per-ship performance in each match, such as damage, destruction and ore mined. We summarise these into monthly season totals and then delete the per-match detail.
• Presence and social. Your online status (for example online, ready or in a match), challenges and party invitations you send or receive, and your party membership.

3.3 Communications between players

• Text chat. Lobby and friend chat messages are relayed through our servers in real time and are not stored. To prevent spam and abuse, we record that a message was sent, its recipient and its length, but not its content.
• Voice chat. Voice is carried by Epic Online Services in rooms limited to your side of a match. We do not record voice. The players in your voice room receive your product user ID and player name so the room works. We keep a record of which voice room belonged to which match.
• Friends. With the permission you give Epic, the Game reads your Epic friends list on your device and sends your friends' product user IDs to our servers so it can show which of them play. We use those IDs to answer that question and do not store them.

3.4 Feedback and support

If you send in-game feedback or a bug report, we collect your message (up to 500 characters), its category, the Game build version and the map, linked to your account. If you email us, we collect your email address and whatever you choose to include.

3.5 Technical, network and security information

• IP address. Our servers see your IP address when the Game connects. We use it briefly in memory to apply rate limits and protect our services, and we do not write it to our player database.
• Hosting a match. If you host a casual match on your own machine over a direct connection, your public IP address and port are shared with the players joining that match so they can connect, and are kept with the match record. When a match uses Epic's relay network, your product user ID is used instead of your IP address.
• Security logs. We keep an audit log of security-relevant events such as sign-ins, match lifecycle events, disputes and changes to linked wallets. Our hosting provider also keeps short-term operational logs.
• On your device. The Game writes diagnostic logs to your own computer. They stay there unless you choose to send them to us.

3.6 Optional wallet features

Some optional features in development let you create or link a self-custodial digital wallet. If you use them, we store your public wallet address, the blockchain it belongs to and when you linked it. Your private key is generated and kept on your device, encrypted with a password only you know. We never receive it. See Wallets and blockchains.

3.7 Payments

If we offer paid features, payments are handled by a third-party payment processor. We receive a customer reference, a subscription reference, what you bought and its status. We do not receive or store your full card number.

3.8 What we don't collect

We don't collect precise location, contacts, photos, microphone recordings, biometric data, or advertising identifiers. We don't use third-party analytics, advertising or crash-reporting services in the Game or on this website. We don't knowingly collect sensitive personal information as defined by law, and we ask you not to include any in feedback or email.

4. How we use information

• To provide the Game and Online Services: signing you in, creating your profile, matchmaking, hosting and joining matches, lobbies, parties, chat relay, voice rooms and friends.
• To keep play fair and secure: validating results, detecting abandoned or implausible matches, handling disputes, rate limiting, and investigating cheating, fraud and abuse.
• To run rankings and statistics: ratings, win records, season totals and leaderboards.
• To improve the Game: reading feedback and bug reports and fixing what they reveal.
• To provide optional features you request: wallet linking and paid features.
• To communicate with you: answering your messages and sending service notices, such as changes to these terms or security alerts. We don't send marketing messages without your consent.
• To meet legal obligations and to establish, exercise or defend legal claims.

We don't use your personal information to build advertising profiles, and we don't make decisions about you that produce legal or similarly significant effects based solely on automated processing.

5. Legal bases for processing

Where laws such as the GDPR, UK GDPR, Swiss FADP or Brazil's LGPD require a legal basis, we rely on these:

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details and object at any time (see Your rights).

6. Sharing and service providers

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows.

6.1 Other players

Your player name, avatar, online status, rating, match results and statistics are visible to other players. Players in your match or voice room receive the identifiers needed to connect, as described in section 3.

6.2 Service providers and platforms

Service providers may use your information only to provide services to us, under contracts that require confidentiality and appropriate security.

6.3 Other disclosures

• Legal and safety. When we believe in good faith that the law requires it, or that it's needed to protect the rights, safety or property of players, the public or us. We review each request and push back on requests that are overbroad.
• Business transfers. If we're involved in a merger, acquisition, financing or sale of assets, information may transfer to the successor. It stays subject to this policy, and we'll notify you of any change in who controls it.
• With your direction. When you ask us to share something, for example publishing a tournament result.

7. Wallets and blockchains

• Wallets in the Game are self-custodial. Your private key is encrypted on your device using a password you set. We cannot see, recover or reset it. If you lose it, we can't restore access.
• To link a wallet you sign a message with it. The signature proves you control the address. No private key is sent to us.
• We store your public address with your account so the Game can show your wallet and support the features you use. You can unlink it at any time. We keep a record of link and unlink events for security (see Retention).
• A public wallet address can sometimes be connected to a real-world identity through other information. Think about that before linking an address you use elsewhere.
• Deleting your account removes your wallet address from your account. Security records of link and unlink events are kept for up to 2 years and then deleted. Nothing we do can remove transactions already recorded on a blockchain.

8. Fair play and automated checks

To keep competition fair, our servers automatically check matches. For example, they flag results reported before a match could plausibly finish, matches an opponent never joined, disagreeing result claims and statistics outside plausible limits. A flagged result may be recorded with no winner, held for review, or excluded from ratings, and we may limit accounts involved in repeated abuse.

These checks affect game results and access to competitive features only. If you think a check has treated you unfairly, contact us and a person will review it.

9. International transfers

Our Online Services are hosted in the United States, and our service providers may process information in other countries. Those countries may have data protection laws that differ from yours.

When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we use a lawful transfer mechanism. That means an adequacy decision (including the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework where the recipient is certified) or the European Commission's Standard Contractual Clauses with the UK Addendum and Swiss amendments, together with additional safeguards where needed. For other countries with transfer rules, including Brazil, China, India, Japan, South Korea and South Africa, we rely on the mechanisms those laws provide, including contractual safeguards and, where required, your consent. You can request a copy of the relevant safeguards by contacting us.

10. Retention

We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymise it.

When you delete your account, other players' match histories keep the results of matches you played, but your identity in them is replaced with an anonymous placeholder. We may keep specific information longer where the law requires it, or where it's needed to resolve a dispute, enforce our terms or investigate abuse, and only for that purpose.

11. Security

We protect personal information with measures appropriate to the risk, including:

• encryption in transit (TLS) between the Game and our servers;
• encryption at rest for email addresses, and hashing of single-use match tickets;
• sign-in delegated to Epic or Google, so we never hold your password;
• short-lived session tokens and per-match credentials for match servers;
• server-side validation of everything that matters, so a player's machine is never trusted with results;
• secrets kept out of source code, least-privilege access, and regular security reviews.

No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant authorities as the law requires.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate information;
• Delete your information and your account;
• Port your information to another service in a structured, machine-readable format;
• Object to or restrict certain processing, including processing based on legitimate interests;
• Withdraw consent where we rely on it, without affecting earlier processing;
• Opt out of the sale or sharing of personal information and of targeted advertising (we do neither);
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects, and ask for human review;
• Appeal our decision on your request; and
• Complain to a data protection authority.

We offer these rights to every player, whether or not the law where you live requires it.

How to make a request

Email clawdistani@hotmail.com from the address you want us to reply to, and tell us your player name and what you'd like. To protect your account, we'll verify the request. Usually we'll ask you to confirm through the Game while signed in, or to prove control of the linked account. We'll respond within one month, or sooner where local law requires (45 days under U.S. state laws). If a request is complex we may extend that period as the law allows, and we'll tell you why.

An authorised agent may make a request for you with your signed permission. We may still need to verify your identity directly. Requests are free unless they're manifestly unfounded or excessive. We won't treat you differently for exercising your rights.

If we decline a request, we'll explain why. You can appeal by replying with "Appeal" in the subject line. We'll answer the appeal within the time the law allows, and if you're unhappy with the outcome we'll tell you how to contact your regulator.

13. European Economic Area, United Kingdom and Switzerland

If you're in the EEA, the UK or Switzerland, the GDPR, the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection apply to our processing of your personal information. You have the rights listed in section 12, under Articles 15 to 22 GDPR and their equivalents.

You can complain to the supervisory authority where you live or work, or where you believe an infringement happened. Examples include your national authority in the EU (listed by the European Data Protection Board), the UK Information Commissioner's Office, and the Swiss Federal Data Protection and Information Commissioner. We'd appreciate the chance to resolve your concern first.

Providing your sign-in identifier is necessary to use Online Services. Without it we can't create your account. Everything else in section 3 is either generated by your use of the Game or optional.

14. United States

This section supplements the policy for residents of U.S. states with comprehensive privacy laws. These include California (CCPA as amended by the CPRA), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.

Notice at collection: categories of personal information

Sources, purposes and retention are described in sections 3, 4 and 10. In the past 12 months we have not sold personal information, not shared it for cross-context behavioural advertising, and have no actual knowledge of selling or sharing information about consumers under 16. We don't use or disclose sensitive personal information for purposes that would give you a right to limit it.

Global Privacy Control. We treat a Global Privacy Control or similar browser opt-out signal as a valid request to opt out of sale, sharing and targeted advertising. There's nothing to opt out of today, and we'll keep honouring the signal.

California "Shine the Light". We don't disclose personal information to third parties for their own direct marketing.

Nevada. We don't sell covered information as defined by Nevada law.

15. Canada

We process personal information in line with PIPEDA and applicable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector (Law 25). You can access and correct your information, withdraw consent subject to legal or contractual limits, and ask about our practices, including our use of service providers outside Canada. Our person responsible for the protection of personal information can be reached at clawdistani@hotmail.com. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

16. Other regions

The rights in section 12 are available to everyone. The table below lists local laws and the authority you can contact.

17. Children

The Game and this website are not directed to children under 13, and we don't knowingly collect personal information from them. Where the law of your country sets a higher age for consenting to online services without a parent (up to 16 in parts of the EEA, for example), you need your parent or guardian's permission to use Online Services below that age.

Optional wallet features and paid features are only for people who have reached the age of majority where they live (18 in most places).

Epic Games applies its own age and parental controls to Epic accounts. If you believe a child has given us personal information without the consent the law requires, contact clawdistani@hotmail.com and we'll delete it.

18. This website and cookies

• No cookies. This website doesn't set cookies or use local storage, and it has no cookie banner because there's nothing to consent to.
• No trackers. There are no analytics, advertising pixels, social media plugins or embedded third-party content. Fonts, images and video are served from our own domain.
• Server logs. Like any website, our host receives your IP address, browser user agent, the page requested and the time, so it can deliver the site and protect it from abuse. These logs are kept briefly and not used to identify you.
• Links. Links to other websites, such as the privacy policies above, take you to sites governed by their own policies.

If we ever add analytics or cookies that aren't strictly necessary, we'll update this policy first and ask for your consent where the law requires it.

19. Changes to this policy

We'll update this policy as the Game changes. We'll change the "Last updated" date and keep previous versions available on request. If a change materially affects how we use your personal information, we'll tell you in the Game or on this website before it takes effect and, where the law requires, ask for your consent.

20. Contact us

Siphaawal, independent developer
United States
Privacy: clawdistani@hotmail.com
General: clawdistani@hotmail.com

This policy is written in English. If we provide a translation and it conflicts with the English version, the English version applies, except where local law requires otherwise.