Privacy Policy
1. Scope and who is responsible
This policy covers edgekin.app, the Edgekin game in the browser and as an installable app (PWA) in its realms (game worlds such as test.edgekin.app and beta.edgekin.app), the Edgekin Chrome extension, and the API they use. Edgekin is the controller of player, device and service-operations data.
2. Data we process
- Device and session data. When the game first starts, your browser creates a cryptographic key pair. The non-exportable private key remains on your device. We store the public key and its fingerprint to authenticate signed requests, the surface it came from (extension, browser or installed app), when the device was registered and last connected, and whether it was revoked; after a key rotation, also the fingerprints of the replaced keys. Each connection opens an encrypted session: we keep its session keys encrypted for about an hour, and short-lived data that stops replayed requests for a few minutes.
- Account data. Every device belongs to a game account: an internal identifier, its status (guest, linked, choosing an island, archived), when it was created and its history of account events: created, pairing code made, device joined, left or revoked, key rotated, islands merged, account archived or deleted. A guest account carries no name, e-mail address or other contact details.
- Pairing codes. To add another device to your account, the game shows an 8-character code. It works once and expires after 10 minutes. We store only a one-way hash of the code, with the account, the device that made it, the device that used it and the times.
- Google account, if you link one. When linking is available and you choose it, we ask Google only for the openid and email scopes. We receive your Google account identifier and e-mail address and keep them with your game account, so that you can sign in on other devices. We do not receive your Google password, contacts or other Google data.
- Game state. The state of your island and the game's settings are currently kept on your device (see local storage below). When the game starts keeping progress on our servers, it will be stored with your account, and this policy will say so before that happens.
- Error reports. When the game hits an error, it sends us a short report: the kind and place of the error, its message, a stack trace with web addresses and query strings removed, the build version and commit, the realm type, the surface, the interface language and the build mode. A report carries no account, device, page address or game state. Reports are limited in size (4 KB) and number (3 per page load) and are written to our operational log, not to the database.
- Technical logs and IP addresses. Privacy-minimised operational logs record the time, the request method and path without query parameters, the status, the response size and the duration. The client IP address, user-agent and referer are not written to access logs; a web server's error log can record the IP address of a request that failed. The IP address is used for rate limiting: to limit how many new devices one address registers per hour it is kept in the database for about an hour and then deleted, and the limit on error reports is kept in memory only.
- Local storage. The game keeps on your device: the device key pair and up to 16 replaced public keys (IndexedDB), the island's state and settings and the latest game configuration (local storage; in the extension, Chrome's extension storage), an offline copy of the game's files (service worker cache) and whether it was opened as an installed app (session storage). The edgekin.app page remembers the width of its game panel. Edgekin sets no cookies, runs no analytics or advertising and loads no third-party scripts or fonts.
3. Why we use data
We process data to run the game; authenticate your devices and link them to one account; secure and troubleshoot the service; prevent abuse; comply with law; and improve reliability. Depending on the context, the legal basis is performance of our agreement with you, our legitimate interests in operating and protecting the service, compliance with legal obligations, or consent where required for an optional capability.
We do not sell personal data, show advertising or use your data for profiling. Edgekin has no real-money purchases and processes no payment data; if paid items are ever offered, this policy will be updated before they are.
4. Sources
Data comes from you and your devices and, if you link a Google account, from Google.
5. Service providers and disclosures
We disclose only what is needed to operate a selected capability:
- our hosting provider, REG.RU, runs the servers that process service traffic and store the data; our internal tools for game balance hold no player data;
- Google processes the sign-in request when you choose to link a Google account;
- authorities or other parties may receive data when required by law or necessary to protect players and the service.
6. Retention
- device and account data, the account history and pairing-code hashes: kept while the account exists;
- guest accounts (no linked sign-in): kept while used. A guest account none of whose devices has connected for 180 days is deleted with its devices once this rule is switched on, leaving only a record without identifiers (the date of the last connection and the number of devices);
- archived accounts (the island not chosen when two were merged): kept so that support can restore them, until the account is deleted;
- encrypted sessions: about one hour; data that stops replayed requests: a few minutes;
- IP addresses for rate limiting: about one hour in the database, one hour in memory for error reports;
- test realms: a realm may be reset during the beta, which deletes its accounts and progress;
- database backups: made before every update of the server; the 20 newest are kept, so a deleted record can remain in a backup until it rotates out, and a backup is restored only for disaster recovery;
- error reports and privacy-minimised infrastructure logs: kept only for the operational lifecycle and used for security, abuse prevention and diagnostics, not product analytics;
- local storage: until you clear it, or until you remove the extension or the installed app.
7. Your choices and rights
You can revoke a device in the account sheet of the game, and clear the site's or the app's local storage in your browser. Clearing it on the only device of a guest account makes that island unrecoverable. You may request access, correction, export, restriction, objection or deletion where applicable. Self-service account deletion is planned; until it is available, send a request by e-mail to privacy@edgekin.app. We may need to verify the requester before acting. You may also complain to your local data-protection authority.
8. International transfers
Edgekin's servers and the data they store are located in Russia (REG.RU). If you use Edgekin from another country, your data is transferred there. Where required, we use an applicable transfer mechanism and contractual or technical safeguards. Google applies its own privacy terms to its independent processing.
9. Security
We use encrypted transport and, inside it, an encrypted channel between the game and the server with signed device requests and pinned server keys; one-way hashing of pairing codes; access controls; data minimisation; and bounded payloads and rate limits. No service can guarantee absolute security.
10. Chrome extension
The Edgekin extension asks only for the side panel and storage permissions. It does not read the pages you visit, your tabs or your browsing history. Information received from Chrome APIs is used only to run the game, in line with the Chrome Web Store User Data Policy, including its Limited Use requirements.
11. Children and changes
Edgekin is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe that a child under 13 has used Edgekin, write to privacy@edgekin.app: we delete the account on a verified request. We may update this policy as the game changes. We will update the date above and provide additional notice when a change materially affects your rights or our use of personal data.
12. Contact
Privacy questions and rights requests: privacy@edgekin.app. Help with the game: support@edgekin.app.