Privacy policy
SweatyPanzer: ARENA is an online multiplayer tank game. This page says what the game records about a player, why it records it, where it is kept and how to ask about it. It is written to be read, not to be scrolled past.
Who is responsible
The game is made and run by Frederik Kragh Christensen, Denmark, who is the data controller for everything described here. Questions and requests go to privacy@sweatypanzer.com or to the SweatyPanzer Discord.
Playing without an account
No account is needed to play. A guest gets a random identifier stored in the browser (or in the Steam version's own storage) so that a nickname, settings and match history stay with that browser. Clearing the browser's site data clears it.
Signing in
Signing in is optional and attaches the career to an account instead of a browser. Only the door used is involved:
- Discord: the Discord user id, username and avatar, and whether the account is a member of the SweatyPanzer Discord server (which unlocks group creation and a cosmetic).
- Google: the Google account id and the name on it.
- Email: the email address, which receives a one-time sign-in code. There is no password. The address itself is not stored: the account is keyed on a keyed hash of it, and the address is used once to send the code and then let go.
- Steam (the Steam version only): the Steam id and persona name, verified with Valve when the game starts. To show which Steam friends also play, the game reads the friends list from Steam, only when the Steam profile is public, keeps it in memory for a few minutes and does not store it.
One career can be linked to more than one of these; the link stores which accounts belong together and when they were linked.
What the game records while playing
- The nickname, and earlier nicknames, so a report can name the player it was about.
- Match results and statistics: rounds, kills, damage, accuracy, the tanks and upgrades used, the rating that comes out of it, and career progress such as titles and medals.
- Friends, blocks, groups and referral codes, because those are things a player set up on purpose.
- Settings the game keeps for a player, such as controls and preferences.
Chat, reports and enforcement
Lobby, team and global chat, and direct messages, are stored so that a report can be reviewed and the rules enforced. Messages pass a word filter before they are shown. A report stores who reported whom, in which room, with the reason given. Bans record the reason, who issued them and when they end.
Connection data
The servers see the IP address of every connection, as any server does. It is not stored as such: the game keeps a salted hash of it, used to enforce bans and to stop referral abuse. The hosting provider keeps ordinary connection logs for a short time.
Analytics
None. No third-party analytics or tracking script runs on the website or in the game, and no advertising identifier is read. The only counts kept are the game's own (players online, matches played), which are numbers, not people.
When the game hits an error it sends a short technical report to our own servers so the fault can be fixed: the error line, a stack trace and the page address, each stripped of anything that could identify a session first. It describes the software, not the player.
Where it is kept
Everything above is stored on servers run by Amazon Web Services in the European Union, with regular backups. Sign-in codes are sent by email through Amazon's mail service. Nothing is sold, and nothing is shared with anyone for advertising.
The companies that necessarily see some data are the sign-in providers a player chooses (Discord, Google, Valve) and Amazon Web Services as the host. Each has its own privacy policy. In the Steam version, Steam itself also processes data under Valve's privacy policy.
How long
- Account and career data: for as long as the account exists.
- Email sign-in codes: ten minutes.
- Chat and direct messages: for as long as they may be needed to handle a report, after which they are removed.
- Player counts sampled for the admin panel: these are counts, not players, and are kept for about a year.
Your rights
Under the GDPR a player can ask what is stored about them, have it corrected, have it deleted, receive a copy, or object to a use of it. Ask through either contact above; deleting an account removes the career and the sign-in links with it. A complaint can also go to the Danish Data Protection Agency (Datatilsynet).
Children
The game is not directed at children under 13 and does not knowingly collect data from them. Store age ratings apply where the game is sold.
Changes
When this page changes, the date at the top changes with it.