Information used by the service
A password account stores a chosen username, nickname, Argon2id password hash, hashed recovery code, account timestamps, and public player identifiers. A guest stores a generated nickname and the public half of a random installation signing key. A Steam-backed profile stores the verified SteamID64 and last observed persona name.
Gameplay records may include server ID, match event ID, timestamps, aggregate score, and per-stat counters. Operational records may include session expiry, a shortened user-agent string, and HMAC-pseudonymized network addresses used for abuse limits and security auditing.
Information deliberately not required
The account API does not ask for an email address, real name, date of birth, postal address, payment information, or social profile. Guest continuity does not use a motherboard serial, disk serial, MAC address, or other raw hardware identifier.
Raw passwords are not written to the database or application logs. Raw Steam session tickets are validated at the game-server boundary and are not sent to or stored by the web master service; only a SHA-256 digest is retained as a replay guard.
Sessions and cookies
The website uses one strictly necessary authentication cookie after sign-in. It is HttpOnly, SameSite=Lax, limited to the site path, and marked Secure in production. The cookie contains a random opaque token rather than account data.
The launcher receives the same class of opaque token as a bearer credential. Tokens are stored hashed on the server, expire, can be revoked, and are rotated after password recovery. The service does not require advertising or cross-site tracking cookies.
Retention and control
Expired challenges, rate-limit buckets, join tickets, and revoked sessions are operational data intended for periodic cleanup. Player records and aggregate statistics persist so profiles remain stable. Authentication events are retained only as long as they remain useful for security investigation and abuse prevention.
Before public launch, deployment policy must define concrete cleanup schedules, backup retention, account deletion handling, and a contact route for access or deletion requests in the jurisdictions where the service operates. The technical schema supports disabling and deleting accounts without reassigning another player’s identity.
Infrastructure and third parties
The planned deployment uses Vercel for the Next.js application and Railway PostgreSQL for durable storage. Hosting providers process network and service telemetry under their own terms. Steam authentication involves Valve only for players who choose the original Steam path.
Secrets such as database credentials, server-write credentials, and the Steam bridge token remain server-side environment variables. They must never be embedded in the browser, launcher, public repository, or distributable dedicated-server package.
Common questions
Does guest mode track my computer hardware?+
No. Guest continuity uses a random signing key generated by the launcher, not a hardware fingerprint.
Is my password recoverable by the operator?+
No. Only an Argon2id hash is stored. Recovery replaces the password using a separately hashed one-time recovery code.
Is a Steam session ticket stored?+
No. The web service stores only its SHA-256 digest for replay detection after the game server reports successful Valve validation.
Does the site use advertising trackers?+
The implemented application does not require advertising trackers; its account cookie is strictly necessary for sign-in.
