--- title: "Privacy Policy – Krillion Space" description: "How Krillion Space handles your data: what we collect and why, cookies and local storage, who we share it with, how long we keep it and your rights." url: https://krilion.app/legal/privacy language: en-US --- # Privacy Policy Last updated 3 November 2026 This policy covers Krillion Space at https://krilion.app ("Krillion Space", "we", "us"). You can reach us at [support@krilion.app](mailto:support@krilion.app). We are the data controller for the personal data described here. This policy explains what we collect, why, who we share it with and the choices you have. ## The short version - You can play without an account. Your browser gets a random guest identifier, and your answers are stored with it so the game can score them and keep your streak. - If you sign in, you do it with a one-time code or link sent to your email, or a passkey. We keep your email address. - We run our own analytics, Minilytics, to count visits and see which pages and links bring players to Krillion Space. - We do not sell your data, show ads or use advertising trackers. ## What we collect - **Game data.** A random guest identifier stored in your browser, and with it your daily answers, results and voyage progress. Your settings, pilot and history are kept in your browser's local storage. - **Account details, if you sign in.** Your email address, the sign-in codes we send you (stored only as hashes, for a short time), and, if you add one, your passkey's public key. We never see a password, because there isn't one. - **What you choose to share.** Your callsign, which appears on leaderboards and to other pilots. If you join a crew: your crew's name, its members and depths, the colonies it starts, and the crew transmissions you send, which are stored so your crewmates can decode them. Crew transmissions are a game puzzle, not private messages: don't send anything personal. - **Technical data.** Like any website, our hosting provider processes your IP address, browser type and the pages you request to deliver the site and protect it from abuse. To stop one network flooding a daily transmission with answers, we store a salted one-way hash of your IP address with each answer, never the address itself. - **Usage analytics.** Our own analytics service, Minilytics (minilytics.app), records the pages you view, the site that sent you here, your screen width, how long a page stays open and visible, and clicks on some buttons and on links to other sites. It tells visits apart with two random identifiers stored in cookies (below). If you are signed in, we link these visits to your account by sending Minilytics your account identifier, email address and callsign. We do not use advertising tools on Krillion Space. ## Why we collect it, and our legal basis - To run the game and your account, because you asked us to (performance of a contract). - To keep the service secure, fair and working, which is in our legitimate interests. - To understand how the site is used and which links bring players in, which is in our legitimate interests. - To meet legal obligations, where they apply. ## Cookies and local storage - **ks_session** is a strictly necessary cookie that keeps you signed in. It holds a random token; signing out deletes it. - The game uses your browser's local storage for your guest identifier, pilot, voyage, history and sound setting. - Minilytics sets two first-party analytics cookies: **ml_vid**, a random visitor identifier kept for a year, and **ml_sid**, a random session identifier that expires after 30 minutes without activity. Only the Minilytics script on Krillion Space reads them. To opt out, block minilytics.app with a content blocker, or open any page with `?ml_ignore=true` at the end of its address (`?ml_ignore=false` undoes it). We set no advertising cookies. ## Who we share it with We share personal data only with the providers that run the service for us: - **Cloudflare**: hosting, database, content delivery, DNS and the email that delivers sign-in codes. See [Cloudflare's privacy policy](https://www.cloudflare.com/privacypolicy/). - **Minilytics**: our analytics, described above. - **YouTube (Google)**: the home page embeds our launch trailer from YouTube. When the player loads, YouTube receives your IP address and may set its own cookies. See [Google's privacy policy](https://policies.google.com/privacy). Other players see your callsign on leaderboards, in duels and in orbit around you, and your crewmates see your crew activity. We may also disclose data if the law requires it, or to protect the rights and safety of our players and the service. ## International transfers We are based in the United States, and our providers process data in the United States and other countries. Where data from the UK or the EEA is transferred, our providers rely on recognised safeguards such as Standard Contractual Clauses. ## How long we keep it - Account details, game records, duels, crews and crew transmissions: until you ask us to delete your account. - Guest game data: as long as the game runs, linked only to a random identifier in your browser. - Sign-in codes and links: until used, or 15 minutes. Sessions: 30 days, or until you sign out. - Analytics cookies: a year for ml_vid, 30 minutes of inactivity for ml_sid. - Technical logs held by our hosting provider: for the short periods their policies set. ## Your rights Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, or object to how we use it. To delete your account and everything linked to it, or for any other request, email [support@krilion.app](mailto:support@krilion.app) from the address you sign in with. We answer within 30 days. If you are in the UK or the EEA, you can also complain to the Information Commissioner's Office or your local data protection authority. ## California California residents have the rights above, including the right to know what we collect and to delete it, and to appeal our decision on a request. We do not sell or share personal information for cross-context behavioural advertising. ## Security The site is served only over HTTPS. There are no passwords to steal: sign-in uses one-time codes and passkeys, and we store only hashes of codes and session tokens. No system is perfectly secure, but we take reasonable steps to protect your data. ## If there is a breach If a breach affects your personal data, we will tell you and the relevant authorities when the law requires it. ## Children You must be at least 16 to create an account. Anyone can play as a guest. We do not knowingly collect personal data from anyone under 16; if you believe we have, contact us and we will delete it. ## Changes We may update this policy. We will change the date at the top, and for significant changes we will give notice on the site before they take effect. ## Contact Questions about this policy or your data: [support@krilion.app](mailto:support@krilion.app).