SPACESTRIKE.IO Privacy Policy

1. Who we are

SPACESTRIKE.IO is an online beta game run by an individual developer in the Republic of Korea, who is the controller of your personal data. Contact: admin@spacestrike.io. The privacy officer is named at the end of this page. This policy is written to meet the Korean Personal Information Protection Act (PIPA) and, for players in the EEA, the UK and Switzerland, the GDPR.

2. Personal data we process

Account (Google sign-in)

Firebase account identifier (UID), display name, email address and profile image from Google; the pilot name you choose; and the date you confirmed you are 14 or older. We never ask for your age or birth date.

Game data

Username, stats, level, XP, platinum, inventory, default ship, cosmetics, session totals, rewards, tutorial completion and timestamps.

Gameplay telemetry

Account state, game mode, session duration, connection state, module, weapon, skill and upgrade choices, module destruction, death or match-end cause, score, damage and related game-state counters. Signed-in telemetry is linked to a protected representation of the Firebase UID. For guests we use a separate random pseudonymous installation identifier stored in local storage; it is not the reconnect token, it is only created when analytics is allowed, and it can be reset by clearing site data.

Multiplayer

To run a match the game server processes your IP address (kept in memory to limit connections per address, not stored), your account identifier or guest session, pilot name and live game state. Match chat messages are relayed to players in the same match and filtered for offensive words; they are not stored.

Reports, support and moderation

If you submit a player report, support request or appeal, we process the category, the reported player or UID, your details, page or session context, your account identifier and email, moderation status, the public reason, internal review notes and timestamps, to investigate abuse, cheating, payment issues, account actions, bugs and misuse.

Bug, feedback and lag reports

Your description; if you are signed in, your account identifier, email, name and sign-in provider; your browser's user-agent string; a snapshot of the game state; for lag reports, 15 seconds of frame and connection diagnostics (login tokens and raw network messages are excluded); and a hashed form of your IP address used to limit report spam. A hashed IP address can in principle be matched back to an address, so we treat it as personal data.

Payments (only if purchases are offered)

To open checkout we send Xsolla your account identifier, display name, email address, country and IP address. Xsolla then collects purchase, billing, contact, device, fraud-prevention, tax and transaction data under its own terms and privacy policy. We receive the payment status and transaction details needed to grant platinum, process refunds, prevent abuse and keep transaction records.

Optional analytics

With analytics allowed, Google Analytics processes device, browser, approximate location, page and interaction information; for signed-in players it also receives the pseudonymous Firebase UID as a user ID. We also measure pseudonymous browser-tab visits from the landing screen through gameplay. A random visit identifier survives reloads until 30 minutes of inactivity or a change of advertising campaign, and is renewed after at most 24 hours. Visit summaries record acquisition source, campaign/ad group/creative/keyword labels, foreground viewing time, visible main-game play and multiplayer time, main-game starts and ends, separate tutorial time and progress, qualification reason, and a bounded interaction timeline. Advertising click identifiers are used only to classify the source and are not retained; full page URLs, referrer paths, account identifiers, emails and authentication tokens are not included. Final page-exit updates are best effort, so missing updates do not prove a bounce.

Optional advertising measurement

For visits attributed to a Reddit advertising campaign, Reddit Pixel receives a page-visit event and may receive one qualified-player conversion, reported to Reddit as a Lead, when the visitor either completes the tutorial and actively plays a multiplayer server battle for at least 90 seconds, enters at least two distinct game modes, or creates a new account. The event does not include your email, phone number, username or Firebase account identifier, and Reddit automatic advanced matching is disabled.

Google Ads conversion measurement reports only the first qualifying event per browser-tab session on the same three conditions. The Google tag may use advertising click identifiers and cookies to attribute the conversion. Conversion events carry a pseudonymous run identifier and no email, phone number, username or Firebase account identifier. Ad personalization signals are disabled. Automated test sessions do not load either tag.

AdSense is currently disabled. If it is ever enabled it will only load with your advertising choice and, in the EEA, UK and Switzerland, through a Google-certified consent platform.

3. Why we use it, and on what legal basis

We do not sell personal data and we do not use it for personalized advertising.

4. How long we keep it, and how it is deleted

When a period ends, electronic records are deleted so they cannot be recovered. An automatic job runs daily for the periods above. We keep no paper records.

5. Service providers and transfers abroad

We do not give your data to third parties for their own purposes except the payment provider and the optional advertising measurement described here, or where the law requires it. The providers below process data for us. Several are abroad; PIPA art. 28-8 allows these transfers because they are needed to provide the game you asked for, and this table is the notice that law requires.

You can refuse a transfer by not using the part of the service that needs it: optional analytics and advertising measurement can be turned off in Settings > Privacy, purchases are optional, and you can play as a guest without a Google account. The game itself cannot run without its hosting providers. For transfers from the EEA, UK or Switzerland, Korea has an EU adequacy decision, and transfers to the United States rely on the recipients' EU-U.S. Data Privacy Framework certification or standard contractual clauses.

6. Your rights

You can ask to access, correct or delete your data, to stop processing, or to withdraw consent, by emailing admin@spacestrike.io. Players covered by the GDPR can also object to processing based on legitimate interests and ask for a portable copy. A legal representative or an authorised agent can make a request for you. We reply within 10 days (one month under the GDPR); if we cannot fully meet a request, for example because commerce law requires us to keep a transaction record, we tell you why and how to challenge the decision.

You can change optional analytics and advertising measurement at any time in Settings > Privacy, and clear guest identifiers by clearing SPACESTRIKE.IO site data.

7. Children

Accounts are for players aged 14 or older. Before Google sign-in we ask you to confirm that you are 14 or older and keep only the answer. If a player says they are under 14, no account is created on that device for a day; an existing account is suspended and deleted after 7 days. Guests can play without an account. A parent or guardian who believes we hold data about a child under 14 can ask us to delete it.

8. Cookies and similar storage

You can also block or delete cookies in your browser settings, and manage Google ads at Google Ads Settings. A Global Privacy Control signal from your browser turns advertising measurement off until you choose otherwise.

9. Behavioural data used for advertising

We do not show personalized ads. When advertising measurement is allowed, Google and Reddit collect, through their tags on this site, which ad brought you here and whether you reached one of the qualifying events above. They do this automatically when the page loads and keep the data under their own policies. You can stop it at any time in Settings > Privacy.

10. Automated decisions

We do not make fully automated decisions with legal or similarly significant effects. Anti-cheat checks and rate limits can block an action in the moment, and a chargeback can place an account on hold until a person reviews it. You can ask for an explanation or a human review at admin@spacestrike.io.

11. How we protect it

• All traffic uses encrypted connections (HTTPS and secure WebSocket).
• Database rules stop players from reading other players' records; only the operator can access production systems, and server keys are stored outside the source code.
• We collect the minimum we need: no age or birth date, no raw IP addresses in stored reports, and short retention periods enforced by an automatic deletion job.

12. Getting help

Contact us first at admin@spacestrike.io. In Korea you can also contact the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office (spo.go.kr, 1301) or the Korean National Police Agency cyber bureau (ecrm.police.go.kr, 182). In the EEA, UK or Switzerland you can complain to your local data protection authority.

13. Changes to this policy

We announce changes on this page and in the game at least 7 days before they take effect, or 30 days before for changes that reduce your rights. Previous versions stay available from the link at the top of this page.