Draft: the highlighted parts of this policy are still to be filled in.
Fifteen Lights Privacy Policy
Effective [DATE]. Applies to Fifteen Lights on the web (https://fifteenlights.com/), the desktop app (macOS, Windows, Linux) and the Android app.
Fifteen Lights is made by Paperweight Studios ("we"). Questions about this policy: privacy@fifteenlights.com.
The short version
- We do not collect your personal information. There is no account, no sign-in, no analytics, no advertising and no crash reporting in the game.
- Your progress and settings stay on your device.
- On the web, our host (Cloudflare) sees the request for the page, as any web host does. The desktop and Android apps send nothing at all.
- On a computer, the website's game page opens a connection to our server as it loads, so a phone can join it as a controller. If you use your phone that way, its button presses pass through our server to the game and are not kept.
- If you email us, we keep your email so we can answer it.
What stays on your device
The game saves to your device only:
| What | Why | Where |
|---|
| Progress: stages cleared, best scores, settings | so CONTINUE works | local storage (fl.save) |
| Controller button and keyboard key bindings | so your remapping survives a restart | local storage (fl.binds, fl.keys) |
| A cache of the game's own files (web only) | so the site works offline | the browser's cache |
| The last phone-controller code you typed, on the phone (web only) | so the phone page fills it in next time | local storage (fl.padcode) |
None of this is sent to us. We cannot see it. Clearing the site's data in your browser, uninstalling the app, or using Android's "Clear storage" deletes it.
The web, desktop and Android versions each keep their own save. EXPORT SAVE in settings turns your save into a code you copy yourself; IMPORT SAVE reads one back. COPY puts the code on your clipboard, and PASTE reads your clipboard only when you press it. The code is created and read on your device and goes nowhere unless you paste it somewhere.
What outside services can see
Hosting (web only). The site is served by Cloudflare. When you load it, Cloudflare receives the usual request data: your IP address, browser type, the page requested and the time. Cloudflare processes this to deliver the site and keep it secure, under Cloudflare's privacy policy. We do not turn on Cloudflare's analytics and do not use this data to identify you.
Phone controller (web only). On the website you can use a phone as a controller. On a computer, the game page makes up a five-letter code at random on your device as it loads and shows it as a QR code above the game (pressing H shows it larger). The game opens a connection to our site straight away, so it is ready when a phone scans the code; until a phone joins, the only thing it sends is a short keep-alive every 25 seconds, which our server answers and does not store. The phone opens its own connection when you scan or type the code, and our server (a Cloudflare Worker) joins the two that share a code. While they are connected, the phone sends which buttons are held and where its sticks are, and the game sends back a few numbers to light the phone's buttons (grenades left, whether BURST and the slash are ready, whether sound is muted). The server passes these along as they arrive and does not store them, and nothing in them identifies you. As with any visit to the site, Cloudflare sees both devices' IP addresses and browser types. The room ends when the game closes the connection. It does not work in the desktop or Android apps, which have no server behind them and send nothing.
Email. Mail to our @fifteenlights.com addresses passes through our server (the same Cloudflare Worker), which forwards it to the inbox we read and keeps no copy. Mail to support@fifteenlights.com also gets one automatic reply with answers to common questions; so that you are not sent it twice, a one-way fingerprint of your address (a SHA-256 hash, which cannot be turned back into the address) is kept in Cloudflare's cache for up to a day. Your message, your address and anything you put in it stay in our inbox for as long as we need them to help you, and you can ask us to delete them. Our inbox is provided by Proton, under Proton's privacy policy.
We do not sell your data, share it for advertising, or build profiles. We do not receive your data from anyone else.
Platform notes
Web. No cookies are set by the game. Local storage and the offline cache are described above.
Desktop. The app is the same page as the website, opened in its own window. It stores its save in the app's data folder on your computer. It has no updater and no crash reporter, and sends nothing to us.
Android. The app asks for no permissions: not Internet, and not your location, contacts, camera, microphone, photos or files. Android may back up the app's data to your Google account under your device's backup settings; that is Google's feature, not something we receive. [CONFIRM before release: either leave allowBackup on and keep this sentence, or turn it off and delete it.]
Steam. [ADD when Steam integration ships: what Steam Cloud and achievements send, and a pointer to Valve's policy.]
Children
Fifteen Lights is not directed at children under 13 and we do not knowingly collect anything from anyone. [DECIDE the audience and age rating with the store questionnaires, then make this paragraph match them.] The game contains cartoon-style combat violence.
Your rights
Apart from any email you send us, we hold no personal data about you, so there is nothing else for us to access, correct or delete. To see or delete your emails to us, write to the address below. Your data is on your device and you can remove it at any time as described above. If you are in the EU, UK or California you also have the usual rights over data held by our web host; exercise those with Cloudflare directly. You can also complain to your local data protection authority.
Security
Everything is served over HTTPS and nothing sensitive is stored. Save data in local storage is plain text and can be edited by anyone with access to your device or browser.
Changes
If we change this policy we will update the date at the top and, for a material change, say so in the game or on the site. Earlier versions are kept in [REPO OR URL: not the GitHub repo, which is private].
Contact
Paperweight Studios
privacy@fifteenlights.com