Privacy

This is the whole policy. It is short because the game collects little, and it is served from /privacy by the game server itself so that the version a reviewer reads and the version a player reads are the same bytes — see services/server/src/http/pages/.

Inktide is operated by the Stigmera games team. If something here is unclear or wrong, write to [email protected] and it will be answered by a person. Anything about another player's conduct — a report, a block, a moderation decision — goes to [email protected] instead. What you agree to by playing at all is the Terms of service.

The short version

You can play this game without giving us anything. Opening the page creates a guest account with a generated name and no email, no password and no profile. Everything below is about what that account accumulates, what a browser stores locally, and what an advertising network sees.

What the game holds about an account

• A generated identifier and a display name. The name is public: it appears on scoreboards and in the rooms you join.
• Career figures — matches played, placements, tiles taken, experience, level, the cosmetics you own and the ones you are wearing.
• What you have bought, if anything: the item, the price, the currency, the store it came through and the status of the payment. What a purchase entitles you to, and how a refund takes it back, is the Terms of sale.
• Product events — a match started, a screen opened, an offer shown, an advertisement requested. These carry the account identifier, a timestamp and the event's own fields. They do not carry a name, an address or a device fingerprint. They do say what kind of client caused them: a browser or the app, which page the game ran in (our own site or a games portal), and, for a browser, whether it was a desktop or a phone. That last word is worked out from the browser's own description of itself when it connects; the description is not kept, only the one word.

What the game does not hold: your email address unless you choose to save your account with one, your real name, your address, your phone number, your contacts, your location beyond the country described below, or any advertising identifier of your device.

And it does not hold your voice. There is no microphone permission, no voice chat, no push-to-talk and no audio capture of any kind anywhere in this game. Nothing is listened to, nothing is recorded, nothing is transmitted and nothing is stored. The same goes for anything you might type: there is no free-text chat, no direct messages and no comment field, so there is no message history to hold. If voice ever ships, this policy and the safety assessments in docs/compliance/ are rewritten and published before it does, not after.

Your date of birth is not held either. You are asked for a birth year once, at the first regulated action; the year is turned into an age bracket and the bracket is what is stored. The seam a future age-check provider would plug into is typed to return a bracket, so even a provider that knows the exact day cannot put one here.

What is stored in your browser

A session token, so that closing the tab and coming back does not lose your career, and a small number of preferences — sound, the last screen, whether you have dismissed a notice. These are stored locally by the site itself. They are not cookies shared with anyone and they are not used to follow you elsewhere.

An advertising network that we ask for an ad may set storage of its own. What it may set is governed by the treatment described below and by your consent choice where consent applies. The advertising section says what those cookies are for and names the two places you can switch the personalised ones off.

Where a country comes into it

The country your request arrives from is read from the request itself, at the moment it is needed, to decide which price list to show you, which taxes apply and whether we operate commercially in your market at all.

It is not stored against your account. There is no country column, no inferred region on your profile and no history of where you have played from. A new request answers the question again from that request. Where we do not operate commercially, no advertising is requested and nothing is offered for sale — the session simply plays.

It is counted, and the count has nobody in it. So that we can tell how many people play from where, a session adds one to a daily tally for the country it arrived from, as does a new account and a match played in it. The tally holds a day, a country and those numbers — no account identifier, no address, no time finer than the day — and it is the only place a country is written down. It counts each player once a day, and the game remembers which country to count a match under only in the server's memory, for as long as your session is recent, never on disk. A country with fewer than five players on a day is merged into "other", both in what is shared and, once the day is two days old, in the tally itself. Where we do not operate commercially the country is not counted at all: those sessions are counted as "unknown", beside the ones whose country could not be told.

Advertising

There is no advertising during a match. Where advertising appears — on menus and on the screen after a match — this is what governs it.

Where it stands today, before any of it runs. This site serves no advertising at all: no advertising account is configured on it, so no ad script is fetched, no ad space is drawn, no consent message appears and no advertising cookie is set by anybody. Inside a games portal — CrazyGames today — the portal's advertising runs in the portal's own page under the portal's own policy, and none of ours runs beside it. Everything below is what will govern advertising here on the day it is switched on. It is published before that day rather than after it, and the day itself is written into the changelog with a date.

Who may serve it

• Google — AdSense, H5 Games Ads and Google Ad Manager on the web, AdMob in a mobile build.
• The portals, when you are playing inside one: CrazyGames and Poki serve their own advertising inside their own page, under their own policies, and the game does not reach past their SDK for a network of its own.

No other network is used. No Russian advertising network is used; that is a standing decision and not an omission.

Cookies, and how to switch the personalised ones off

• Third-party vendors, including Google, use cookies to serve ads based on a visitor's earlier visits to this site or to other sites. Google's use of advertising cookies is what lets Google and its partners serve ads from those visits, here and across the rest of the internet.
• Google's own switch is My Ad Center. Turning personalised advertising off there works whether or not you are signed in to a Google account, and it holds everywhere Google serves advertising rather than only in this game.
• Every other vendor's switch is aboutads.info/choices, the advertising industry's own list, where cookies can be turned off one company at a time. The European version of the same list is youronlinechoices.eu.
• Unless we have opted out of third-party ad serving, the cookies of other third-party vendors or ad networks may also be used to serve ads here. An ad network resells the space to buyers who bring measurement of their own, and who those buyers are on a given day is not a list this game is handed.
• What Google does with a request once it has left us is set out in How Google uses information from sites or apps that use our services. From that moment it is that policy and not this one that governs it, which is why the marking described next is applied before the request goes.

Switching personalisation off does not switch advertising off. It makes what you are shown contextual — picked from the page and the moment instead of from a profile of you — which is already what this game asks for on behalf of everybody whose age it does not know.

How a request is marked

Every ad request this game makes carries a treatment decided by the server, and the client is never told your age bracket — only the treatment.

• If we do not know your age, or you have told us you are under 18, the request is contextual only: no profiling, no personalised advertising, no targeting data beyond the placement, the surface, the language and the game mode. For sessions under 13 the request additionally carries the child-directed flag, and for everyone under 18 the under-age-of-consent flag.
• If you have told us you are 18 or over, and consent applies and has been given, advertising may be personalised.
• Unknown and under-13 are treated identically, deliberately. Being cautious about an unknown age must not become a way of reading a child's age off the wire.
• A network that cannot be told any of this is not asked for an ad at all. Where a portal SDK exposes no way to mark a request as child-directed, a session that needs that marking is served nothing. The missing marking costs revenue; it never costs a violation.

What the child-directed marking does at the far end. Google's stated answer to a request tagged that way is to disable interest-based advertising and remarketing on it. So a request marked for a child cannot be answered with a personalised advertisement, whatever the consent state beside it says — and the marking is put on by the server, which is the only thing here that knows an age band at all.

Consent

In the EEA, the UK and Switzerland the asking is done by a Google-certified consent platform — TCF 2.2, AdSense's own Privacy & messaging — and not by a dialog of our own making. A message of our own would not be certified, would not write a consent record any advertising vendor could read, and would leave the platform believing one thing while you believed another. It asks for the two things the law requires consent for: storing and reading things on your device, and using personal data to personalise advertising. It is also where the advertising vendors that may receive data are listed, each with a link to what it does with it. Your answer is recorded and travels with every ad request.

Until you answer, no advertisement is requested at all — not a non-personalised one, none. A message nobody answers and a consent platform that fails to load end in the same place, and the game plays on without advertising. That is the correct trade and the opposite of the usual one.

Refusing costs you nothing. Advertising becomes contextual, and nothing else about the game changes.

You can change your answer whenever you like. The safety panel in the game carries a Privacy settings row that reopens the same message. Withdrawing has to be as easy as consenting was, so it is the same single tap, and the row is drawn only where a message is actually required.

What is kept, and for how long

An ad event records that an advertisement was requested, whether it filled, which placement it filled and the treatment that was applied. It carries the account identifier and a timestamp. It carries no device identifier and no advertising identifier, because the game never receives one.

These events are stored in monthly partitions so that an expired month can be dropped whole, and they are used to see whether the advertising is working and whether the pacing rules are being kept — nothing else reads them.

Match records are kept for 30 days, or for a year if you shared a link to one: a shared link that dies in a month is a link that was never worth sending. Deleting your account removes them sooner.

If a line of this section is wrong on the day you read it, write to [email protected]. Advertising is the part of this policy that will change first, and a sentence written ahead of the change is worth keeping only for as long as somebody can correct it.

Purchases, and the record money leaves

Everything sold is described in the Terms of sale, published beside this page; this is what a purchase leaves behind here.

The ledger. A purchase writes one row: which item, which store it came through, that store's own order identifier, what was paid, in which currency and price region, and the status of the payment. It is attached to your account and to nothing else.

The card is not ours to hold. The merchant of record named at the checkout takes the payment; the game never receives a card number, and no card is saved by default anywhere.

A subscription adds one more row: the plan, its status and the end of the current period, so that the game knows whether the advertising is off today.

One more thing is on the purchase row, and it is there because a law asks for it. If you ticked the box at the confirm step — "the content is provided now and I lose my 14-day right of withdrawal" — that tick is stored on the row. It is the only proof either of us has, years later, of what was agreed before delivery, and it is what decides whether a withdrawal is owed on that purchase. It is a boolean and it says nothing else about you.

The purchase history you can read is that ledger, shown back to you in account settings: date, item, where it was bought, amount and status, with the self-service refund control on the rows still inside the 14-day window and the reason plainly stated on the rows that are not.

How long a purchase record is kept. The ledger rows survive the deletion of an account, with the account identifier replaced by a pseudonym that cannot be linked back to you, and they are kept for ten years from the end of the year of the purchase — the outer edge of what tax and accounting law in the operator's and the buyer's countries can ask about. Nothing in a surviving row identifies a person: no name, no e-mail, no address, no card.

A refund or a chargeback updates the row and revokes the entitlement, and writes nothing new about you. A refund asked for in the account screen is not recorded with a reason, because none is asked for.

A guardian's e-mail address, where one is needed. Where the law where you are asks for a parent's or guardian's confirmation before a minor's first purchase, the address typed into that form is held only until the confirmation link is used or expires, and then dropped. What is kept afterwards is the account the consent belongs to, the moment it was given, and a one-way hash of the address — enough to answer "who confirmed this, and when" if a payment is ever disputed, and not enough to write to anybody. The message sent to that address contains one sentence and one link; nothing is sold in it and the address is not used again.

Nothing about a purchase is used for advertising. The ledger is read by the entitlement check, by the refund path and by revenue reporting, and by nothing else.

Reporting somebody, and blocking them

Every screen that shows another player offers Report, and Block beside it. A report can be filed from inside a match or from a leaderboard row after you have left, and it needs neither a live game nor a saved account. You get a reference back.

What a report holds about you. The account that filed it, the account or room it is about, the reason chosen from a fixed list, and the context — the match, the room, both display names and the time. That context is attached by the server and not sent by your browser, which is what stops the person being reported from having edited the evidence about themselves. It is kept for as long as it is needed to act on it and to answer an appeal about it, and it is read by a person.

A block is a list on your account of accounts you do not want to hear pings from. It is yours, it is not shown to the person blocked, and it is deleted with your account.

If you cannot use the in-game route — or you are not a player at all — write to [email protected]. Appeals against a moderation decision go to the same address and are read by somebody other than an automated check. The procedure in full is in the Terms of service.

Children

The game asks for your age band, not your date of birth, and the answer is used only to decide the treatment above and which features are open.

For an account in the under-13 band: advertising is contextual and child-directed, nothing is offered for sale, there is no public chat, and the daily amount of rewarded video is capped. A daily spending cap is also enforced by the server behind that — nothing is sold to the band at all today, and the cap is there so that no future change can open the door unbounded. Enforcing it needs no new data: it is a sum over purchase rows that already exist, over the last 24 hours, and nothing about it is stored. If you believe a child has given us information and you would like it removed, write to [email protected] and it will be removed.

The written retention policy, as the amended COPPA rule asks for one. Data about an account in the under-13 band is kept only for as long as it is needed for the purpose it was collected for, and no longer: career figures and the account for as long as the account exists, match records for 30 days (a year for a match whose link was shared), ad and product events in monthly partitions that are dropped whole after 12 months. Nothing about a child is retained indefinitely, and nothing about a child is disclosed to a third party for advertising — which is why the request is contextual and carries no identifier in the first place. Deleting the account removes all of it sooner.

What you can do

• See it. The game will hand you everything it holds about your account, as a file, on request from the account screen.
• Delete it. Deletion removes your account, your career, your name and your events.
• What survives a deletion is the accounting record of anything you paid for, with your identity replaced by a pseudonym that cannot be linked back to you. A purchase is a fact about money that a tax authority is entitled to ask about years later, and books that do not balance help nobody. Nothing in those rows identifies you after the deletion, and the Terms of sale say what deleting the account does to the entitlements it held.

Where the law gives you further rights — objection, restriction, portability, a complaint to a supervisory authority — they apply, and the address above is the one to use.

Kazakhstan

The operator is resident in Kazakhstan, so Kazakhstan's personal-data law binds it wherever the players are. Two things follow, and both are stated here because that law asks for them in the notice rather than in a second dialog.

Consent. By creating an account and playing you consent to the collection and processing of the data described above — the account identifier, the display name, the career figures, the purchase records and the product events — for the purposes described above, by the operator and by the processors named below. The consent may be withdrawn by deleting the account, which removes the data it covers; what survives is the pseudonymised accounting record described in the purchases section, which the law of the operator's country requires to be kept.

Cross-border. The data is held on infrastructure the operator runs, and the advertising partners named above operate globally. Where the accounts database may be hosted under Kazakhstan's personal-data law is a question with the operator's adviser, and until it is answered nothing about it is assumed here.

This paragraph is a notice and not a second pop-up. A dialog that asked for the same consent again would collect one more click and no more protection.

Who processes it

The game and its database are operated by the Stigmera games team on infrastructure we run. The advertising partners named above operate globally, and once a request reaches one of them their own policy governs what they do with it — which is why the marking described above is applied before the request leaves, rather than being asked for afterwards.

Our own analytics tool reads totals, and only totals. Games Radar, run by the same team, reads daily figures from the game: how many players, new accounts, sessions and matches there were, how long a session lasted, and how many came back — whole, and split by the page the game ran in, by country and by kind of device. Every group with fewer than five players in it is merged into "other" before the figures leave the game, and nothing in them identifies anybody: no account identifier, no name, no address.

When this changes

Changes are written into the changelog with a date, in plain language, rather than appearing silently in a longer document. A change that adds a way for players to reach each other — voice above all — is announced in the game before it takes effect, because a new channel is a new set of facts about you and a policy that quietly grew one would be worth less than none.

Last updated: 2026-09-16.