1. Information we process

• Google member login: Google account identifier (sub), verified email address, display name, and email verification status
• Account and security records: internal user ID, account creation, update and last-login times, login sessions, and CSRF tokens
• Information that may be generated during operation: IP address, browser and device information, request times, and error records

We do not store Google access or refresh tokens. Guest nicknames and active online match state are processed in server memory and are not stored as permanent match history.

2. Purposes

• Identify members, maintain login sessions, and provide account pages
• Prevent abusive login attempts and requests, diagnose failures, and secure the service
• Analyze service usage and improve features
• Receive and answer privacy and service inquiries

3. Retention and account deletion

• Member information: until account deletion
• Server login sessions: up to seven days after the last use, or until logout or account deletion
• IP data used for login rate limiting: up to ten minutes in server memory
• Access records used for security and troubleshooting: up to 30 days

When an account is deleted, we immediately anonymize the Google identifier, email address, and display name in the operational database and revoke all server sessions. Data remaining in disaster-recovery backups is not used for other purposes and rotates out within 30 days. We may separately retain information when applicable law requires it.

4. Information stored in your browser

Game strategy code is stored in your browser's localStorage, not on our server. It is not automatically removed by logout or account deletion. You can remove it using your browser's site-data controls. Do not put API keys, passwords, or personal information in your code.

5. External services and international processing

• Google Identity Services for Google login and ID token verification
• Google Analytics for page and feature usage analytics
• Amazon Web Services Lightsail for hosting and the member database
• Forward Email for inquiries sent to support@codebattle.online
• Google Fonts, Font Awesome, and jQuery/Bootstrap CDNs for page resources

When these services are used, IP addresses and request information may be transmitted to and processed in the providers' data centers in various countries. Each provider protects information under its own privacy terms.

6. Cookies and sessions

Member login uses the codebattle.sid session cookie. In production it is configured with HttpOnly, Secure, and SameSite=Lax. Blocking this cookie prevents login, but guest games remain available.

7. Your rights

You can review your member information and delete your account from the account page. Contact support@codebattle.online to request correction, deletion, restriction, or other privacy assistance.

8. Users under 14

Until we provide a verifiable parental-consent process, users under 14 must not use Google member login. When using guest games, do not put your own or another person's personal information in nicknames or code.

9. Security and policy changes

We use reasonable safeguards including access restrictions, protected file permissions, encrypted transport, CSRF defenses, and isolated execution of user code. We will update this policy and its effective date when our processing or service changes.