PRIVACY POLICY — VORTEX SHIFT
Last updated: 03/09/2026
1. Who is responsible (data controller)
M3A
Italy
Contact: [email protected]
This policy covers the game Vortex Shift and its website.
2. What data is processed, and why
| DATA | PURPOSE | LEGAL BASIS (GDPR) |
|---|---|---|
| Username and password (the password is stored only as a salted scrypt hash, never readable) | Your game account: saving progress, purchases and leaderboard scores | Contract — Art. 6(1)(b) |
| Email address (optional, only if you provide it) | Password recovery only. Never used for marketing, never shared beyond the email delivery provider | Contract — Art. 6(1)(b) |
| Gameplay data (scores, levels, ships used, run duration, achievements) | Leaderboards, achievements, and anti-cheat validation | Contract / legitimate interest — Art. 6(1)(b), (f) |
| Aggregate usage events (visits, runs played) with a random visitor id | First-party statistics about how the game is used | Consent — Art. 6(1)(a): the random visitor id is only created if you accept cookies; without consent events carry no identifier |
| IP address (transient, in memory only — never written to the database) | Rate-limiting to protect login and password reset against abuse | Legitimate interest — Art. 6(1)(f) |
| Advertising and analytics identifiers (Google) | Ads that keep the game free; audience statistics | Consent — Art. 6(1)(a): nothing is loaded from Google unless you accept the cookie banner |
3. Cookies and local storage
Before you make a choice in the cookie banner, no Google script is loaded at all (strict "basic" Consent Mode). Choosing "ONLY ESSENTIAL" keeps it that way. You can change your choice anytime via the COOKIES button (game menu on desktop, OPTIONS screen on phones).
| STORAGE | KIND | PURPOSE |
|---|---|---|
no2* keys in your browser's local storage | Essential | Your saves, settings, login token and cookie choice. Always on — the game cannot work without them. They never leave your browser except the login token, which authenticates you to our own server. |
Google Analytics cookies (_ga…) | Consent-based | Audience measurement, only after you accept |
| Google advertising cookies | Consent-based | Ad serving and frequency capping (Google AdSense), only after you accept |
4. Who receives data (processors)
- Google Ireland Ltd / Google LLC — advertising (AdSense) and analytics (Google Analytics 4), only with your consent. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework, to which Google is certified. See Google's privacy policy and how Google uses data from partner sites.
- Brevo (Sendinblue SAS, France, EU) — delivers password-reset emails. Receives your email address only when you request a reset.
- Cloudflare, Inc. — network delivery and DDoS protection in front of our server (processes IP addresses in transit, as any network carrier does).
No data is ever sold. There is no marketing, profiling or newsletter.
5. How long data is kept (retention)
- Account data and scores: until you delete your account.
- Aggregate usage events: automatically deleted after 90 days.
- Password-reset tokens: valid 30 minutes, stored only as hashes.
- Backups: encrypted-at-rest copies are kept for up to 30 days, then deleted.
6. Your rights
Under the GDPR you can access, rectify, export, and erase your data, object to or restrict processing, and withdraw consent at any time (via the COOKIES button) without affecting past processing.
- Delete your account yourself: in the game, OPTIONS → DELETE ACCOUNT — it permanently erases your account, progress, purchases, scores and email, immediately.
- For anything else (e.g. a copy of your data), write to [email protected] — answered within 30 days.
- You may also lodge a complaint with your supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali.
7. Children
The game is intended for a general audience and is not directed at children under 14 (the age of digital consent in Italy). No age-targeted profiling is performed; ads are served by Google under the consent state described above.
8. Changes
If this policy changes materially, the date at the top is updated and the cookie banner may be shown again to renew consent.