Privacy Policy

This Privacy Policy explains what data Popcorn Army (“we,” “us”) collects when you play, why we collect it, and the choices you have. We aim to collect the minimum needed to run the game and to remember your progress across sessions.

1. What we collect

1.1 When you play as a guest

• A random anonymous identifier (popcornarmy.userKey) generated and stored in your browser's local storage. It is the only thing we use to recognize you across sessions while you are not signed in.
• A display tag (e.g. Kernel#A4F2) that you can change. This is shown to other players in matches and on leaderboards.
• Gameplay state we need to keep score: total experience points (XP), kill / death counts, equipped and owned cosmetic skins, in-game currency (“Popcorn”), daily-challenge progress, and login-streak day count.
• Standard server logs: your IP address, the time of the connection, and the URL or WebSocket path that was requested. These are retained for up to 30 days for abuse prevention and debugging.

1.2 When you sign in

• Email sign-in (magic link). Your email address, and a short-lived one-time code we send you to verify it. The code is stored as a hash, not in plain text, and is deleted as soon as it is used or expires (10 minutes).
• Google sign-in. Your Google account's stable identifier (“sub”), your email address (if your Google account verified it), and the display name you've set on Google. We never receive your Google password.
• A session token in an HttpOnly cookie so we can remember that you signed in. The cookie is essential to the sign-in feature; it is not used for tracking across other sites.

1.3 What we do not collect

• We do not collect your real name, address, phone number, or payment information.
• We do not run third-party analytics or advertising trackers on our own pages.
• We do not knowingly collect any information from children under 13.

2. How we use it

• To run multiplayer matches and persist your progression between matches.
• To show leaderboards (all-time and weekly), in which your display tag and XP may appear to other players.
• To send you a sign-in code if you request one by entering your email.
• To investigate abuse, debug errors, and maintain the service.

3. Service providers

We share data with the following providers only as needed to run the game:

• CrazyGames — if you are playing the game embedded on crazygames.com, CrazyGames' own privacy practices apply to ad delivery and the embedding page. See their privacy policy. We pass them ad-related signals (e.g. “gameplay started,” “please show a rewarded ad”) through their SDK; we do not pass them your email, sign-in identifiers, or progression.
• Google — if you sign in with Google, the Google Identity Services SDK runs in your browser and authenticates you with Google. See Google's privacy policy.
• Resend — we use Resend to deliver the one-time sign-in code to your email address when you request one. Resend processes only the destination email address and the code itself for delivery.
• Cloudflare — routes traffic to our servers and protects against denial-of-service attacks. See Cloudflare's privacy policy.
• DigitalOcean — hosts our game servers and database. See DigitalOcean's privacy policy.

4. Cookies and local storage

• popcornarmy.userKey — local storage. Anonymous guest identifier. Stays until you clear your browser data.
• popcornarmy_session — HttpOnly cookie set after sign-in. Lasts 30 days unless you sign out.
• Preferences (volume, reduced motion, etc.) — local storage. Never sent to our server.

We do not use third-party advertising cookies on the page itself. Ads inside the CrazyGames embed are governed by CrazyGames and their ad partners.

5. Your choices and rights

• Stay anonymous. You can play without signing in. Clearing your browser data resets your progress.
• Sign out. Use the “Sign out” button in the menu to invalidate your session cookie.
• Delete your account. Email support@popcorn-army.example from the address on file and we will delete your account record and associated progression. We will respond within 30 days.
• Access or correct your data. Use the same address above to request a copy or correction.

If you are in the EEA, UK, or Switzerland you have rights under the GDPR (access, rectification, erasure, restriction, portability, objection). If you are in California you have rights under the CCPA/CPRA (the right to know, delete, correct, and limit; we do not sell or share personal information as those terms are defined under California law).

6. Data retention

• Account records and progression are kept while your account exists, and deleted within 30 days of a verified deletion request.
• Server logs are kept for up to 30 days.
• One-time sign-in codes are deleted on use or expiry (10 minutes), and the hashes are garbage-collected within 24 hours.

7. Security

We hash one-time sign-in codes before storing them, sign session tokens with HMAC, transport traffic over TLS, and restrict origin access to our own client and the CrazyGames embed. No system is perfectly secure; if we ever experience a breach affecting your data we will notify you and the appropriate authorities as required by law.

8. International transfers

Our servers are hosted in the United States. If you access the game from outside the United States, the data described above is processed in the U.S. by us and the service providers listed in §3.

9. Children

Popcorn Army is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact support@popcorn-army.example.

10. Changes

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top. Material changes will be announced in-game before they take effect.

11. Contact

Questions about this policy or about your data: support@popcorn-army.example.