Privacy Policy

Last updated 3 November 2026

This policy covers Krillion Space at https://krilion.app ("Krillion Space", "we", "us"). You can reach us at support@krilion.app. We are the data controller for the personal data described here. This policy explains what we collect, why, who we share it with and the choices you have.

The short version

You can play without an account. Your browser gets a random guest identifier, and your answers are stored with it so the game can score them and keep your streak.
If you sign in, you do it with a one-time code or link sent to your email, or a passkey. We keep your email address.
We run our own analytics, Minilytics, to count visits and see which pages and links bring players to Krillion Space.
We do not sell your data, show ads or use advertising trackers.

What we collect

Game data. A random guest identifier stored in your browser, and with it your daily answers, results and voyage progress. Your settings, pilot and history are kept in your browser's local storage.
Account details, if you sign in. Your email address, the sign-in codes we send you (stored only as hashes, for a short time), and, if you add one, your passkey's public key. We never see a password, because there isn't one.
What you choose to share. Your callsign, which appears on leaderboards and to other pilots. If you join a crew: your crew's name, its members and depths, the colonies it starts, and the crew transmissions you send, which are stored so your crewmates can decode them. Crew transmissions are a game puzzle, not private messages: don't send anything personal.
Technical data. Like any website, our hosting provider processes your IP address, browser type and the pages you request to deliver the site and protect it from abuse. To stop one network flooding a daily transmission with answers, we store a salted one-way hash of your IP address with each answer, never the address itself.
Usage analytics. Our own analytics service, Minilytics (minilytics.app), records the pages you view, the site that sent you here, your screen width, how long a page stays open and visible, and clicks on some buttons and on links to other sites. It tells visits apart with two random identifiers stored in cookies (below). If you are signed in, we link these visits to your account by sending Minilytics your account identifier, email address and callsign.

We do not use advertising tools on Krillion Space.

Why we collect it, and our legal basis

To run the game and your account, because you asked us to (performance of a contract).
To keep the service secure, fair and working, which is in our legitimate interests.
To understand how the site is used and which links bring players in, which is in our legitimate interests.
To meet legal obligations, where they apply.

Cookies and local storage

ks_session is a strictly necessary cookie that keeps you signed in. It holds a random token; signing out deletes it.
The game uses your browser's local storage for your guest identifier, pilot, voyage, history and sound setting.
Minilytics sets two first-party analytics cookies: ml_vid, a random visitor identifier kept for a year, and ml_sid, a random session identifier that expires after 30 minutes without activity. Only the Minilytics script on Krillion Space reads them. To opt out, block minilytics.app with a content blocker, or open any page with ?ml_ignore=true at the end of its address (?ml_ignore=false undoes it). We set no advertising cookies.

We share personal data only with the providers that run the service for us:

Cloudflare: hosting, database, content delivery, DNS and the email that delivers sign-in codes. See Cloudflare's privacy policy.
Minilytics: our analytics, described above.

Other players see your callsign on leaderboards, in duels and in orbit around you, and your crewmates see your crew activity. We may also disclose data if the law requires it, or to protect the rights and safety of our players and the service.

International transfers

We are based in the United States, and our providers process data in the United States and other countries. Where data from the UK or the EEA is transferred, our providers rely on recognised safeguards such as Standard Contractual Clauses.

How long we keep it

Account details, game records, duels, crews and crew transmissions: until you ask us to delete your account.
Guest game data: as long as the game runs, linked only to a random identifier in your browser.
Sign-in codes and links: until used, or 15 minutes. Sessions: 30 days, or until you sign out.
Analytics cookies: a year for ml_vid, 30 minutes of inactivity for ml_sid.
Technical logs held by our hosting provider: for the short periods their policies set.

Your rights

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, or object to how we use it. To delete your account and everything linked to it, or for any other request, email support@krilion.app from the address you sign in with. We answer within 30 days. If you are in the UK or the EEA, you can also complain to the Information Commissioner's Office or your local data protection authority.

California

California residents have the rights above, including the right to know what we collect and to delete it, and to appeal our decision on a request. We do not sell or share personal information for cross-context behavioural advertising.

Security

The site is served only over HTTPS. There are no passwords to steal: sign-in uses one-time codes and passkeys, and we store only hashes of codes and session tokens. No system is perfectly secure, but we take reasonable steps to protect your data.

If there is a breach

If a breach affects your personal data, we will tell you and the relevant authorities when the law requires it.

Children

You must be at least 16 to create an account. Anyone can play as a guest. We do not knowingly collect personal data from anyone under 16; if you believe we have, contact us and we will delete it.

Changes

We may update this policy. We will change the date at the top, and for significant changes we will give notice on the site before they take effect.

Contact

Questions about this policy or your data: support@krilion.app.