Privacy
Last updated 26 July 2026. Short, because there is not much to say.
RIFTFALL has no accounts, no cookies, no third-party trackers and no ad networks. You can play a full match without telling us anything. This page describes the four things we do store, and how to get rid of them.
1. Playing the game
The first time you open the game your browser generates a random id and keeps
it in localStorage. It is not derived from anything about you —
it is 16 random bytes — and it exists so the server can recognise the same
browser next time and give you back your level and your unlocks.
| Stored on your device | A random player id, your callsign, your equipped cosmetics, your sound preference. |
| Stored on our server | That same random id, the callsign you typed, and your progression: XP, level, rounds, wins, knockouts, slams, best streak, and which days you played (so we can tell whether people come back). |
| Not stored | No password, no email, no IP address against your progression, no chat — the game has none. |
| How to erase it | Clear site data for this domain. The id is gone from your browser and you become a new player. To be precise: the old progression row still exists on our side, keyed by an id nobody holds any more — orphaned rather than deleted. Ask and we will remove it outright. |
Because the id lives in your browser rather than behind a login, it is not an account and we make no claim that it is secure. It gates cosmetic progression and nothing else.
2. Measuring the website
We count visits with our own code on our own server. There is no Google Analytics, no Facebook pixel, no session recorder and nothing that follows you to other sites — which is also why you are not looking at a cookie banner.
| What each event records | The event name (a page view, a click on a play button, how far down the page you scrolled, whether you reached the game), a random per-browser id, a random per-session id, a timestamp, a coarse device class (mobile/desktop), the address that referred you, and the campaign tag in the link you followed. |
| Your IP address | Used momentarily to rate-limit abuse, and not written to the analytics log. |
| Retention | Aggregates are computed over a rolling 14 days. Raw event logs are deleted automatically after 90 days and are not shared with anyone. |
| How to opt out | Any tracker blocker stops the beacon, and the game works identically without it. Both Do Not Track and Global Privacy Control are honoured as an opt-out — if your browser sends either, nothing is recorded at all. |
3. The founders list
If you type your email into the founders form, we store the address so we can tell you when something worth knowing happens — ranked play, new arenas. The game itself is already live and needs no signup. That is the only reason the list exists.
| What we store | The address, when you signed up, which page and campaign sent you, your random browser id, and the IP the signup came from (for abuse only). |
| What we will send | Launch news, roughly never more than monthly. No sold lists, no partner mail, no third-party marketing — ever. |
| Unsubscribing | One click, from a link in every mail, with no login and no form. It works immediately and permanently, and every export excludes anyone who has opted out. |
| Getting it deleted | Unsubscribe suppresses you. If you want the row gone entirely, ask — see below — and we will remove it. |
4. Playing us somewhere else
If you found RIFTFALL embedded in another site — a games portal, for instance — then that site is running its own analytics and its own ads, which we neither control nor see. Browsers also isolate storage inside an embedded frame, so your progression there is separate from your progression here, and on some browsers it will not persist at all. Play on this domain if you want your level to stick.
5. If you buy something
Nothing is for sale yet. When it is, checkout is handled by Stripe — your card number never reaches our servers, and we could not see it if we wanted to. What we keep is the record of what you were given.
| What we store | The email you bought with, which pack it was, the items it granted, Stripe's reference for the payment, and the timestamp. Kept against your random browser id, not against a name. |
| Why the email | It is the only way to give a purchase back to you if you clear your browser storage and lose the id it was attached to. Without it, a paid pack is unrecoverable. |
| Refunds | A refund adds a "revoked" record; it does not erase the original. Both halves are the evidence of what was sold and when. |
| Deletion | This is the one thing we will not delete on request. A purchase record is a financial record, and a card network can ask us to account for a payment months later. Ask and we will tell you exactly what is held and remove anything not needed for that. |
| Lawful basis | Performing the contract you entered by buying, and our legal obligation to keep records of payments. |
6. Where it lives
On two servers in AWS — us-east-1 and us-west-2, both
in the United States — in plain files that only we can read. Progression and
purchase records are also held in a shared DynamoDB table in
us-east-1 so that they follow you between the two, which is the
only reason your level and your unlocks survive being routed to a different
one. Backups are encrypted, private, and expire after 90 days.
If you are in the EU or UK, this means your data is transferred to the US. The lawful basis for the email list is your consent; for the anonymous measurement it is our legitimate interest in knowing whether a free game is working; for purchase records it is the contract and our record-keeping obligation.
7. Children
RIFTFALL is not directed at children under 13, and we deliberately collect no profile information from anyone. If you believe a child has given us an email address, tell us and we will delete it.
8. Asking us anything
Access, correction, deletion, or a question about any of the above: No press address yet — it will be listed here before any coverage push. The founders form on the home page reaches us in the meantime.. A human answers, and deletion is a file edit rather than a process.
If this page ever changes in a way that matters, the date at the top changes with it.