PRIVACY POLICY - VORTEX SHIFT
Last updated: 16/10/2026
1. Who is responsible (data controller)
M3A
Italy
Contact: [email protected]
This policy covers the game Vortex Shift and its website.
2. What data is processed, and why
| DATA | PURPOSE | LEGAL BASIS (GDPR) |
|---|---|---|
| Username and password (the password is stored only as a salted scrypt hash, never readable) | Your game account: saving progress, purchases and leaderboard scores | Contract - Art. 6(1)(b) |
| Email address (optional, only if you provide it) | Password recovery only. Never used for marketing, never shared beyond the email delivery provider | Contract - Art. 6(1)(b) |
| Gameplay data (scores, levels, ships used, run duration, achievements) | Leaderboards, achievements, and anti-cheat validation | Contract / legitimate interest - Art. 6(1)(b), (f) |
| Aggregate usage events (visits, runs played) with a random visitor id | First-party statistics about how the game is used | Consent - Art. 6(1)(a): the random visitor id is only created if you accept cookies; without consent events carry no identifier |
| IP address (transient, in memory only - never written to the database) | Rate-limiting to protect login and password reset against abuse | Legitimate interest - Art. 6(1)(f) |
| Advertising and analytics identifiers (Google) | Ads that keep the game free; audience statistics | Consent - Art. 6(1)(a): nothing is loaded from Google unless you accept the cookie banner |
3. Cookies and local storage
Before you make a choice in the cookie banner, no Google script is loaded at all (strict "basic" Consent Mode). Choosing "ONLY ESSENTIAL" keeps it that way. You can change your choice anytime via the COOKIES button (game menu on desktop, OPTIONS screen on phones).
| STORAGE | KIND | PURPOSE |
|---|---|---|
no2* keys in your browser's local storage | Essential | Your saves, settings, cookie choice and a note that you're logged in. Always on - the game cannot work without them. They never leave your browser. |
no2s cookie (only if you log in) | Essential | Keeps you logged in. It holds a random session code, nothing else, and is sent only to our own game server. Scripts on the page can't read it. It ends when you log out, or after 30 days. |
Google Analytics cookies (_ga…) | Consent-based | Audience measurement, only after you accept |
| Google advertising cookies | Consent-based | Ad serving and frequency capping (Google AdSense), only after you accept |
This policy covers the whole site: the landing page (/vortex-shift/) and the game (/vortex-shift/play/) share one cookie choice - accepting or declining on either applies to both, and either can reopen the dialog (COOKIES button in the game, "Cookie settings" in the landing footer).
Third-party advertising cookies. When you accept, Google, as a third-party vendor, uses cookies (including the DoubleClick cookie) to serve ads on this site based on your prior visits to this and other websites, and to measure and limit how often ads are shown. You can opt out of personalised advertising at any time in Google Ads Settings, and out of other vendors' personalised ads at aboutads.info (EU: youronlinechoices.eu). Choosing "ONLY ESSENTIAL" here means no Google script, and therefore no advertising cookie, is ever loaded on this site.
4. Who receives data (processors)
- Google Ireland Ltd / Google LLC - advertising (AdSense) and analytics (Google Analytics 4), only with your consent. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework, to which Google is certified. See Google's privacy policy and how Google uses data from partner sites.
- Brevo (Sendinblue SAS, France, EU) - delivers password-reset emails. Receives your email address only when you request a reset.
- Cloudflare, Inc. - network delivery and DDoS protection in front of our server (processes IP addresses in transit, as any network carrier does).
No data is ever sold. There is no marketing, profiling or newsletter.
5. How long data is kept (retention)
- Account data and scores: until you delete your account.
- Aggregate usage events: automatically deleted after 90 days.
- Password-reset tokens: valid 30 minutes, stored only as hashes.
- Backups: encrypted-at-rest copies are kept for up to 30 days, then deleted.
6. Your rights
Under the GDPR you can access, rectify, export, and erase your data, object to or restrict processing, and withdraw consent at any time (via the COOKIES button) without affecting past processing.
- Delete your account yourself: in the game, OPTIONS → DELETE ACCOUNT - it permanently erases your account, progress, purchases, scores and email, immediately.
- For anything else (e.g. a copy of your data), write to [email protected] - answered within 30 days.
- You may also lodge a complaint with your supervisory authority - in Italy, the Garante per la Protezione dei Dati Personali.
7. Children
The game is intended for a general audience and is not directed at children under 14 (the age of digital consent in Italy). No age-targeted profiling is performed; ads are served by Google under the consent state described above.
8. Changes
If this policy changes materially, the date at the top is updated and the cookie banner may be shown again to renew consent.