Privacy policy

1. Who we are

The Cantorite games are made by MVIT, a business in the Netherlands (published under the Hollowcut name). MVIT is the controller of the personal data described here (“we”, “us”).

E-mail

[email protected]

Business

MVIT, the Netherlands, KvK 84170980

This one address is for everything about your data: questions, any of your rights below, and deleting your account if you can’t do it yourself.

2. Playing without an account

Without an account, nothing about you leaves your device unless you choose an online feature. No game needs a network to be played. The games keep these on your device:

• Your progress: campaigns, levels solved, best scores, unlocked content, statistics and recent history.
• Your settings: graphics, sound, language, controls, which hints you’ve seen.
• Saves and replays, where a game has them.

Where: in a browser, in that browser’s storage for the game’s site (local storage and IndexedDB); in the Windows, Android, iOS and Steam apps, in the app’s own data folder on your device. Some apps also write a small technical log and, if they ever crash, a crash dump to that folder. The crash dump is never sent; what a game does send when it crashes is described under “Crash reports”.

Removing it: clear the site’s data in your browser, or uninstall the app.

In a browser a game also stores its own files (code, models, music) in a cache so it loads quickly and plays offline. That cache holds no personal data.

3. Your Cantorite account

An account is optional. One account works in every Cantorite game. It keeps your progress in sync between devices and is needed for ranked play, leaderboards, achievements and feedback.

Signing in

You type your e-mail address and we e-mail you a six-digit code, valid for 10 minutes. That is the only way to sign in: there is no password, and no sign-in through Google, Apple or other accounts. The code e-mail is sent through Cloudflare Email Sending, contains only the code, and has no links, images or tracking.

What we store

Your e-mail address

To send sign-in codes and to know which account is yours. We send no newsletters.

Your game profiles

For each game you play signed in: the profile that game syncs, such as progress, cosmetics, preferences, your display name and statistics. Night Freight also syncs saved squad templates, holdings, veteran progress and wounds. Your other settings, saves and replays stay on your device.

Sign-ins

For each signed-in device: when it was created and last used. We store only a scrambled (hashed) copy of the sign-in token, never the token itself. At most 20 sign-ins exist per player across all games and devices; the oldest is dropped.

Dates

When the account was created and when you last signed in.

A game keeps your sign-in on your device: in the browser’s local storage (not a cookie), or in the app’s encrypted storage.

To stop abuse (for example someone asking for many codes), we count requests per network for at most a day. Your IP address is never stored as such: it is shortened to its network and turned into a keyed, one-way code before it is counted. We don’t log e-mail addresses, codes, tokens or IP addresses.

Where and how long

• Stored in a Cloudflare D1 database in the EU jurisdiction.
• Codes expire after 10 minutes. A signed-in device stays signed in for 90 days after you last used it, and never longer than a year.
• Your account and everything with it is kept until you delete it.
• The database keeps a 30-day history for recovery from mistakes. After you delete your account it can still be restored from that history for 30 days; after that it is gone.

Deleting your account

In any Cantorite game: open the account or settings screen and choose Delete account. Or on the web: cantorite.com/account/delete. Deleting removes your account, every game profile, every sign-in, your achievements and unlock progress, your leaderboard and ranked entries, and the feedback you sent. If one of these services fails, nothing is deleted and you can try again. The progress on your own device stays until you clear it. Can’t sign in any more? Write to [email protected] from the account’s address and we’ll delete it for you.

4. Online features, per game

Everything here needs an account (or, for online matches, at least a name) and is optional.

Achievements

When you unlock an achievement signed in, we store which one and when, linked to your account. Rarity figures on the portal count unlocks without naming anyone. Deleted with your account.

For unlockables, we also keep one snapshot of your progress per game: the play counters they need (such as fights won) and which unlockables you own. Each new report replaces the last. Deleted with your account.

Counting players

To see how many people play each game and how many come back, we keep a list of the days you were active per game, worked out from what the services above already record (sign-ins, profile saves, achievements, progress reports and purchases) and linked to your account. Only our team sees it, on an internal page behind a sign-in; we use it for counts such as players per day and how many return after a week, and the team’s own accounts are left out. Days older than 400 days are removed, and your list is deleted within a day of deleting your account.

Leaderboards and daily scores

• Leaderboards show a display name or callsign and a score, never an e-mail address. Behind the scenes your entries are stored under a pseudonymous player code (a keyed, one-way code of your account id), not the account id itself.
• Chime Walk and Night Freight send daily, weekly and all-time scores when you are signed in: the score, a tie-break value, the day’s seed, a run hash, the duration and the game version. Day and week scores are removed 400 days after their period ended. A score you’ve earned offline is sent when you are back online.
• Hush Money’s ladder stores your callsign, your runs and their scores, awards and seasons. Run counts are kept 30 days (held runs 90, unfinished starts 2 days).
• You can delete your entries at any time by deleting your account.

Harrowfall: online play and ranked

Online matches run in lockstep through our relay server: every player’s game runs the same simulation, and the relay passes the orders between them and checks that the games agree. The relay runs on Cloudflare Workers, and its rooms are stored in Cloudflare’s EU jurisdiction.

• What passes through: your commander name, your browser family (Chromium, Firefox, Safari or other, not the full browser details), your faction, colour, emblem and headquarters look, your connection’s ping, your game orders, and any lobby chat.
• What others see: the players in your room see your commander name, browser family, faction, colours, emblem, headquarters look and ping (the last two only if they leave “Show opponents’ looks” on). Chat goes to the room and is not stored.
• What is kept: a room’s data is deleted 10 minutes after the last player leaves, except the official result of the match (the winner, each seat’s commander name, faction and match statistics). That result stays stored with the room, in the EU, for 30 days, and can be looked up by anyone who has the room code; then it is deleted.
• Server logs: the relay keeps no logs with Cloudflare: logging is switched off, as it is for the account and feedback services.
• Ranked queue: to limit how many connections one network can open, the queue uses a one-way code made from your IP address, only in memory while you are connected.
• Ranked play needs an account. Your rating and its history, wins, losses and draws, your leaderboard name and your ranked matches (opponents, factions, outcome, rating change and match statistics) are recorded in your account. The ranked leaderboard is public: it shows the leaderboard name, rating, tier, and games, wins, losses and draws of everyone who played ranked in the last 28 days. After you delete your account you appear as “A deleted player” in your former opponents’ match lists.
• If you set a skirmish’s AI to run on the server, the game opens a one-player room on the relay in the same way, with your commander name.

Harrowfall’s notifications (on iPhone and iPad) need your permission, which the game asks for the first time you open or join an online room. The reminder that your online match waits for you is set on your device itself and sends nothing. With “Online play” on, your device’s push token (a code from Apple that lets a notice reach this device) and its language go to the room you are in, so the relay can tell you when a player joins your room while you are away; it is deleted when the match starts or the room closes. With “News” on (it is off until you turn it on), the push token, its language and the topic are kept by our account service in the EU, not linked to your account; it is deleted when you switch News off, or 120 days after the game last used it. A notice holds a short text and nothing personal. Apple delivers it.

Hush Money, Night Freight and Chime Walk

These games use the account, profile sync, achievements and leaderboards described above. Chime Walk’s web demo and Night Freight’s web demo are private test builds that behave the same way.

Night Freight’s co-op raids run through our raid server on Cloudflare Workers, with each raid stored in Cloudflare’s EU jurisdiction. Joining a raid needs an account. A raid stores its five-letter code, seed, boss and mode choices, each seat’s faction, squad and attack choices (which units and attacks, no names), readiness and preparation times, and the list of moves the players made. Per seat it also keeps a one-way code made from the raid code and your account id so one account takes one seat. Your account session is checked with the account service when you join and is never stored in the raid; a separate raid-only token lets that seat send moves. A started raid is deleted 48 hours after its last saved change. A raid that never starts is deleted 24 hours after it was created. The raid server keeps no logs with Cloudflare.

Night Freight’s alerts are off until you allow them. Reminders that your raid is about to close, and the daily, are set on your phone itself and send nothing. With raid alerts on, your phone’s push token (a code from Apple or Google that lets a notice reach this phone), its language and its time zone are kept with the raid’s seat and deleted with the raid, so the raid server can tell you when it’s your move or your ally moved. With season alerts on, the push token, its language and the topic are kept by our account service in the EU, not linked to your account; it is deleted when you switch the alert off, or 120 days after the game last used it. A notice holds a short text and nothing personal. Apple (iPhone) or Google (Android, through Firebase Cloud Messaging) delivers it.

Chime Walk’s new-area notice is off until you say yes (the game asks once, after the first area) or switch it on in Settings. With it on, your phone’s push token, its language and the topic are kept by our account service in the EU, not linked to your account, so we can send one notice when an update brings a new area. It is deleted when you switch the notice off, when Apple or Google tell us the token no longer works, or 120 days after the game last used it. A notice holds a short text and nothing personal. Apple (iPhone) or Google (Android, through Firebase Cloud Messaging) delivers it.

Purchases

All games are fully free to play. Optional purchases are cosmetic or give no gameplay advantage, including room decoration; no gameplay is sold. Where a game offers purchases, Apple, Google or the relevant store handles your payment; we never receive card details. To verify and restore ownership, our EU purchase service keeps your account id, game, product, cosmetic entitlement, store transaction reference or purchase token, test/production status, purchase state and times. We send that reference and an opaque account identifier to Apple or Google to verify it and check refunds. Raw purchase references are not included in your data export or logs. Account deletion removes ownership and raw purchase records, keeping only one-way hashes of purchase references and the account id to prevent replay and writes racing deletion. This version cannot automatically transfer or restore a deleted account’s purchases to a newly created account; contact us before deleting an account that owns purchases.

Supporters, season badges and credits

If you buy a game’s supporter pack, your name on that game’s leaderboards is shown in gold with a supporter badge; if you buy a season pack, your entries carry that season’s badge while the season runs. Everyone who can see the leaderboard sees this, because it is part of the public entry. To do this, our purchase service tells the leaderboard service which pseudonymous player codes own a supporter or season pack, and when they bought it. In the game you can also choose to show your name in the game’s credits, under Supporters or under the season. That is off unless you turn it on, and you can turn it off at any time in the game’s settings; the credits then show your public leaderboard name (for Harrowfall, the name you last played ranked with) and nothing else. Your choice is stored with your purchases in the EU, is part of your data export, and is deleted with your account. A refund removes the badge, the gold name and the credits line.

5. Feedback

You can send us a bug report or an idea from a game. Where a game offers it, you need to be signed in, so the service isn’t flooded with spam. The form shows what goes with your report before you send it.

What a report contains

• Your text, the category you picked and, if you set it, how bad the problem is.
• Your account’s e-mail address, so we can ask you about it, unless you turn on Send anonymously. Even then the report is linked to your account in the background, only to enforce limits and to delete it when you ask; the people reading reports see “anonymous”.
• Technical details: the game and its version, the platform, whether you were in a match, game settings, frame rate, the game’s recent error messages (with e-mail addresses and tokens filtered out), your language, and your device: operating system and browser version, graphics chip, processor cores, memory, screen and connection. When you send anonymously, the device details are reduced to coarse classes and your language and full browser details are left out.
• A save of the match or level, if the game offers it. It can be switched off. A save can contain names of the players in it, also when you send anonymously.
• Screenshots, only if you add them.

If you are offline, an unsent report waits on your device and is sent when you are back online.

Where, who and how long

• Stored in Cloudflare D1 and R2 in the EU jurisdiction.
• Read only by the small team that runs the games, through a private site that needs a personal sign-in.
• Screenshots and saves are deleted after 180 days, the rest of the report after two years.
• You can delete one report or all of them at any time in the game’s feedback screen. Deleting your account deletes them too.
• To limit abuse we count reports per account and per network for up to a day; the network is stored only as a keyed, one-way code, never as an IP address.

GitHub, outside the EU

We track the work on the games in private repositories on GitHub (GitHub, Inc., part of Microsoft), which stores its data in the United States. When a report needs work, a person on our team may turn it into a GitHub issue. Nothing is sent there automatically.

• The issue contains the report’s text, category and severity, and its technical details (build, device, graphics chip, browser version, settings, recent errors), plus a link that only our team can open.
• It never contains your e-mail address or account. Screenshots and saves are never copied to GitHub; they stay in our EU storage.
• The team member reads the issue before creating it and can leave things out.
• If you delete a report later, an issue made from it stays. Write to [email protected] and we will remove your text from it.

GitHub handles this data under its data protection terms, including its safeguards for transfers out of the EU.

6. Crash reports

When a game crashes, or hits an error it can’t recover from, it sends us a crash report so we can find and fix the problem. This is on by default, and you can switch it off at any time with Send crash reports in the game’s settings. Crash reports are anonymous: you don’t need an account, and a report is never linked to your account.

What a report contains

• The error message and where in the game’s code it happened (the stack trace).
• The game and its version, the platform, the operating system and its version, the device model, and the version of the game engine or browser.
• A few facts about where you were in the game, such as the screen, level, mode or turn, and the last few things that happened before the crash (such as “level 2-3 started”). Never your name, e-mail address, messages or anything you typed.
• When an app stopped unexpectedly, the next launch sends a report about it, with the end of the game’s own technical log where there is one.

Before a report is stored, our server removes e-mail addresses, sign-in tokens, the user name in folder paths (such as C:\Users\<name>) and the query part of web addresses. A report that can’t be sent right away waits on your device and is sent later.

Where, who and how long

• Stored in Cloudflare D1 in the EU jurisdiction.
• Read only by the small team that runs the games, through the same private site as feedback.
• Each report is deleted after 90 days. Counts per day and per game version are kept until a crash hasn’t happened for a year, then removed too.
• Your IP address is not stored. To limit abuse we count reports per network for up to a day, stored only as a keyed, one-way code.
• When a crash needs work, a person on our team may turn it into a GitHub issue (see “GitHub, outside the EU” above) with the error, the stack trace and the version and device details. Never anything that identifies you.

Because a report isn’t linked to you, we can’t look up “your” reports to show or delete them. If you think a report holds something personal, write to [email protected] and we’ll find it and remove it.

7. What we don’t do

• No analytics, no advertising, no attribution, no tracking pixels and no profiling for marketing. No advertising, analytics, attribution or crash-reporting SDKs in any game.
• No crash or error reporting beyond the anonymous crash reports described above, which you can switch off. Crash dumps and the game engines’ own crash handlers stay on the device.
• No device or advertising identifiers.
• No third-party requests when a web game loads: its fonts and files come from our own sites. Links to other sites only load when you follow them.
• Our sites set no cookies. Our hosting provider may use strictly necessary security measures to protect the service from attacks.
• We don’t sell your data or share it with anyone for their own purposes.

8. Who handles data for us

Cloudflare

Hosts the websites, the account, achievements, leaderboards, feedback and online-play services, their databases and storage, and sends the sign-in e-mails. It works for us as a processor. Our stored data is kept in its EU jurisdiction. Like any network, Cloudflare handles your IP address to deliver the games to you, in its data centres worldwide.

GitHub

Only for issues made from feedback and crash reports, as described above (United States).

Apple and Google (notices)

Only if you allow Night Freight’s alerts, Harrowfall’s notifications or Chime Walk’s new-area notice: Apple’s push service (iPhone, iPad) and Google’s Firebase Cloud Messaging (Android) carry a notice and your device’s push token to your device, outside the EU. Nothing else from Firebase is in the games.

Google, Apple and Valve

If you get a game from Google Play, the Apple App Store, Steam or the Microsoft Store, or buy something in it, that store’s own privacy terms apply to buying, downloading, updating and paying. They are the merchant of record. We don’t receive your store account or payment details.

9. Why we may use your data (legal bases)

• To give you what you asked for (performance of a contract): your account, syncing your progress, online and ranked play, achievements, leaderboards, and your purchases.
• Your consent: the feedback you choose to send, with the attachments you choose. You can withdraw it by deleting the report.
• Our legitimate interests: keeping the services safe and working (limits against abuse), fixing the problems you report and the crashes the games report (you can object by switching crash reports off), including the GitHub issues described above, and counting how many players play and come back (the activity days under “Counting players”).

10. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you and get a copy of it;
• correct it (your display name can be changed in your profile);
• delete it (your account and your feedback can be deleted in any game, or at cantorite.com/account/delete);
• take it with you in a common machine-readable format (an export is available in the games that offer it);
• restrict or object to how we use it;
• withdraw your consent at any time, without affecting what happened before.

For anything you can’t do in the game yourself, such as a full copy of your data, write to [email protected]. We answer within one month. We may ask you to confirm the request from your account’s e-mail address so we know it’s you.

If you are unhappy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live. We’d appreciate the chance to sort it out with you first.

11. Children

You can play without an account at any age a game’s rating allows. To create an account or send feedback you must be at least 16, or have permission from a parent or guardian. We don’t check ages. The games are not directed at children. If you think a child gave us personal data without that permission, write to [email protected] and we’ll delete it.

12. Changes to this policy

When a game or service starts to handle data differently, we update this page and its date. For important changes we’ll also tell you in the game.