Tinwar keeps as little about you as it can. You can play as a guest without an account. There are no ads, no analytics and no third-party trackers.
If you make an account
The server saves these in a file on the game server so your stats carry from game to game:
- Your account name.
- A scrypt hash of your password and the random salt used to make it. Your password itself is never saved.
- Your stats: kills, deaths, total score, games played and best score.
- An email address, only if you give one. It is optional.
Your account name and stats are public. They appear on the leaderboard, and anyone can look them up by name. Your email is not.
Your email address
Adding an email is optional, at sign-up or later in the Account panel. It is used for one thing only: sending you a link to reset your password when you ask for one. Without an email the account works the same, but its password can't be reset.
- It is never shown to other players, never on the leaderboard, a profile or in a match, and never sold or shared. Only you can see it, in your own Account panel while you are logged in.
- The game sends no newsletters or other mail, and does not check the address by mailing it. It sends a reset email only when someone enters both your account name and that email in the "Forgot password?" form.
- To deliver a reset email, the address and the email's text go to the operator's email provider (configured by the operator, for example Resend), which handles them under its own privacy policy.
- A reset link works once, for 30 minutes. The server keeps only a hash of it, never the link itself, and deletes the hash once it is used or a newer one replaces it.
- You can change or delete your email at any time in the Account panel (it asks for your password). Deleting it removes it from the server's account file at once.
Staying logged in
When you log in or register, the server gives your browser a session token, which your browser keeps in its local storage. The token holds your account name and the times it was issued and expires, 30 days later. The server signs it, so nobody can make a token for an account they do not own. Logging out deletes it from your browser. Resetting your password signs out every session made before the reset.
What your browser keeps
The game stores a few settings in your browser's local storage, under these keys:
skirmish.tokenandskirmish.account: your session token and account name, while you are logged in.skirmish.name: the name you last played under.skirmish.guestClaims: as a guest, a claim for each guest name whose record this browser started. It goes to the server only when you register, so that guest's stats and medals come with you to the new account, and is deleted once it has.skirmish.loadout: your last weapon, armor and color.skirmish.muted: whether sound is off.skirmish.mutedNames: the players you muted in chat.
Your name, loadout and token go to the server when you join a room. The sound setting and your muted list never leave your browser. Clearing this site's data removes all of them.
Matches and chat
Positions, health and scores during a match live only in the server's memory. If you are logged in, your kills, deaths and score are added to your saved stats.
Chat messages pass through a word filter and go to the players in your room. The server does not save or log them. Guest names go through the same filter.
Rate limits
To slow down password guessing, reset-email spam and connection floods, the server counts login attempts, password-reset requests (per IP address and per account) and open game connections per IP address. These counters exist only in the server's memory and are never written to disk or to logs. A login counter is dropped about a minute after your last attempt, a connection count when the connection closes, and all of them when the server restarts.
No cookies, ads or trackers
The game sets no cookies. Every page, script and style comes from the game's own server. It loads nothing from other sites, and it sends nothing about you to anyone else, except a password-reset email you asked for, which goes out through the email provider described above.
Where it runs
The game is hosted on Fly.io, in its iad region near Ashburn, Virginia, USA. Fly.io carries the traffic to the game and may keep its own network logs under its own privacy policy.
Keeping and deleting your data
Accounts stay until the operator deletes them. You can delete your email yourself in the Account panel. There is no button to delete the whole account yet. To have your account name, password hash, email and stats removed, ask the operator at the contact below.
Contact
A contact address will be added here before launch.