1. Information we process

• Google member login: Google account identifier (sub), verified email address, display name, and email verification status
• The public username you choose and the time you last changed it
• Account and security records: internal user ID, account creation, update and last-login times, login sessions, and CSRF tokens
• Information that may be generated during operation: IP address, browser and device information, request times, and error records

We do not store Google access or refresh tokens. Guest nicknames and active online match state are processed in server memory and are not stored as permanent match history.

2. Purposes

• Identify members, maintain login sessions, and provide account pages
• Prevent abusive login attempts and requests, diagnose failures, and secure the service
• Analyze service usage and improve features
• Receive and answer privacy and service inquiries

3. Retention and account deletion

• Member information: until account deletion
• Server login sessions: up to seven days after the last use, or until logout or account deletion
• IP data used for login rate limiting: up to ten minutes in server memory
• Access records used for security and troubleshooting: up to 30 days

When an account is deleted, we immediately anonymize the Google identifier, email address, display name, and public username in the operational database and revoke all server sessions. To prevent impersonation, a released username cannot be reused; we keep only an irreversible fingerprint of it, never the username itself. Data remaining in disaster-recovery backups is not used for other purposes and rotates out within 30 days. We may separately retain information when applicable law requires it.

4. Information stored in your browser

Game strategy code you write while signed out is stored in your browser's localStorage, not on our server. It is not automatically removed by logout or account deletion. You can remove it using your browser's site-data controls or the prompt on each game page. Browser storage is per address, so code may remain separately under codebattle.online and game.codebattle.online.

Game strategy code saved by a member is stored on our server and linked to that account: one main code per game plus up to ten versions you name. The server stores this code as data only; it does not run or analyze it. It is deleted immediately when you delete your account.

Saved code is not published by default. It becomes public only when you enter it into the Code Arena yourself. When you do, a copy of the code as entered, your public username, and that code's battle record become visible to anyone, including signed-out visitors. Entering requires a separate confirmation, and withdrawing the entry makes the code private again — but copies other people downloaded while it was public cannot be recalled. When you delete your account we remove the entered code and its link to your account; the numeric record and the recorded moves of past matches remain so that opponents' records stay factual. Those records contain no code.

Do not put API keys, passwords, or personal information in your code.

5. External services and international processing

• Google Identity Services for Google login and ID token verification
• Google Analytics for page and feature usage analytics
• Amazon Web Services Lightsail for hosting and the member database
• Forward Email for inquiries sent to support@codebattle.online
• Google Fonts, Font Awesome, and jQuery/Bootstrap CDNs for page resources

When these services are used, IP addresses and request information may be transmitted to and processed in the providers' data centers in various countries. Each provider protects information under its own privacy terms.

6. Cookies and sessions

Member login uses the codebattle.sid session cookie. In production it is configured with HttpOnly, Secure, and SameSite=Lax. Blocking this cookie prevents login, but guest games remain available.

7. Your rights

You can review your member information and delete your account from the account page. Contact support@codebattle.online to request correction, deletion, restriction, or other privacy assistance.

8. Users under 14

Until we provide a verifiable parental-consent process, users under 14 must not use Google member login. When using guest games, do not put your own or another person's personal information in nicknames or code.

9. Security and policy changes

We use reasonable safeguards including access restrictions, protected file permissions, encrypted transport, CSRF defenses, and isolated execution of user code. We will update this policy and its effective date when our processing or service changes.