Privacy

The short version

• No accounts: we never ask for your name, email or password.
• No ads, no third-party trackers or analytics services, and the game sets no cookies.
• Play data is deleted after 30 days. One short line per browser id, used to count who comes back after a month, goes 31 days after your last visit (below).
• You can turn it off for this browser at any time (below, or in the game: ⚙ Settings → Play data).
• We never sell it or pass it on. Only the game's own server stores it.
• You can download or delete what the server holds for this browser yourself, at once (below, or ⚙ Settings → Your data).
• The game asks your age once. Until you answer, the only thing sent is an anonymous count with no id: that the page was opened, or that it failed to start (below). Under 13, nothing at all is sent after the answer (below).

What the game sends, and why

A count of page opens, with no id

Each time the game page opens, and once if it fails to start (still loading after 15 seconds, or your browser cannot start its graphics), the game sends one anonymous count: that the page was opened, or that it failed to start and why, with the tag on the link (as below), the kind of device (web, iOS or Android) and the browser family (Chrome, Safari, Firefox, Edge, Samsung Internet or other). It has no id and no time from your browser. The server adds it to a total for that day and keeps nothing else, so nothing is kept per person and there is nothing to copy or delete. It is the only thing sent before you answer the age question. It stops when play data is off, when your browser asks not to be tracked, and once the answer is under 13. This shows how many people open the game, how many get as far as playing, and how many cannot start it.

A random visitor id

Made by your browser and kept in its storage (tdt.visitor). It is not tied to your name, email or device. We use it to count players who come back the next day or the next week. It is made from a secret key that also stays in your browser (tdt.visitorKey) and is never sent with play data. Only that key can ask for this browser's copy or deletion, so nobody who learns the id can read or delete your data.

Visits and playtime

A new id for each visit, when it starts and ends, and a heartbeat every 25 seconds while the game is on screen.

Where the visit came from

The tag on the link you followed (for example ?src=reddit-playmygame). Without a tag, only whether you came from CrazyGames, another site, or nowhere. Never the full address of the page you came from.

Platform

Web, iOS or Android, worked out in your browser. Nothing more about your device is kept.

Match results

When a match starts and ends: Full, Quick or Endless, Normal or Hard, how many players, solo or online, the heroes in it and yours, and at the end won or lost, the Heart's HP left, the wave reached and how long it took. This is how we tune difficulty.

How far a visit got

A few milestones, each once a visit: the lobby came up, each card of the first-match lesson (or that you skipped it), and reaching waves 3, 5 and 10. This shows where new players stop.

Error reports

If the game hits an error it did not expect: the error's message and the few lines of the game's own code where it happened (web addresses cut down to the file name), the game's version, and your browser's family (Chrome, Safari, Firefox, Edge, Samsung Internet or other). If the game is slow to start or your browser cannot start its graphics, the report is one fixed word for that and nothing else (the same word also goes in the count above). At most five a visit. This is how we find and fix crashes.

Ratings and notes, only if you leave one

A 1–5 rating at the end of a match and an optional note of up to 140 characters. Please don't put personal details in a note.

We don't collect your name, email, contacts, location or advertising ids, and we don't store your IP address with any of this. The data is pseudonymous: a random id, not you. The count of page opens has no id at all.

Playing online

The nickname you type is shown to the others in your room. When an online match ends, the game server writes one log line with the room code, each player's nickname and hero, and the match numbers. Pick a nickname that isn't your real name. Save match report stays on your device unless you send it to someone.

A posted Daily run

A Daily run is posted only when you tap Post my run on its end screen, never on its own, and only from 13. The post sends the nickname you give, the replay of your inputs in that run (where you moved, what you built and cast, and when) with the game's report of it, and this browser's secret key, from which the server works out the same visitor id as above; the key itself is not kept. The server re-runs the replay to check the score, then keeps the nickname, your hero, the result (Heart left, the wave reached, the time) and the visitor id, and drops the replay. The result is shown on that day's public board under your nickname, which anyone who plays can see, so pick one that isn't your real name. Each day's board is kept 90 days. Because posting is something you do rather than something sent in the background, it works whether play data is on or off. Download my data and Delete my data (below) include your posted runs, and so does a deletion asked for by email.

Who hosts it, and where

Vercel serves the game's files and Render runs the game server, in Singapore. Like any web host, they keep their own request logs, which include IP addresses, under their own policies. We use no other services. If you play from outside Singapore, your play data is stored in Singapore.

The legal basis

Under the EU and UK GDPR we rely on our legitimate interest in finding out whether the game works and is fun; you can object at any time with the switch below. Under Singapore's PDPA, this page is our notice of the purpose, we use the data only for it, and you can withdraw by turning it off.

Your rights

The EU and UK GDPR and Singapore's PDPA give you these rights over your data. Here is how each works in this game.

To know what we collect and why

This page. If it changes, the date at the top changes.

To get a copy (access, and taking it elsewhere)

Press Download my data below. You get a file with everything the server holds for this browser, in a common format (JSON).

To have it deleted

Press Delete my data. It is gone from the server at once, and this browser gets a new id.

To object, or to withdraw

Turn play data off. Nothing more is sent from this browser.

To have it corrected

Play data is a record of what happened in the game, so there is little to correct. If something is wrong, delete it, or email us.

To complain

To Singapore's Personal Data Protection Commission, or to the data protection authority where you live.

We keep the data safe, use it only for the purpose on this page, and keep it no longer than it says. If it were ever exposed, we would tell the authorities and say so on this page, as the law asks. You do not need to give a reason or prove who you are: the buttons work for this browser only.

How long we keep it

Play data is deleted automatically 30 days after it was sent. To count who comes back a day, a week and a month after their first visit, the server also keeps one short line per visitor id: the day of its first visit, the link tag of that visit, the last day it was seen, and whether it came back on day 1, 7 and 30. That line is deleted 31 days after the last day the id was seen. Daily totals with no id in them (how many new visitors a day, how many of them came back, and how many times the page was opened or failed to start) are kept for 90 days. A Daily run you posted stays on that day's board for 90 days (above). The visitor id stays in your browser until you clear this site's data.

Your choices

• Off stops everything this browser sends straight away, ratings, error reports and the count of page opens included. What was already sent under this browser's id is still deleted on the schedule above, or sooner if you ask.
• If your browser sends Global Privacy Control or Do Not Track, it starts off. You can still turn it on.
• Until the game knows your age, the only thing sent is the anonymous count with no id (above). Under 13 it stays off and nothing is sent; from 13 to 15 it starts off (below).
• The same switch is in the game: ⚙ Settings → Play data.

Get a copy, or delete it

These buttons work for this browser only. Your browser proves it is yours with its secret key; the server works out the id from the key, so nobody can ask for another browser's data.

• Delete removes every event and the return-count line kept under this browser's id, then clears the id and key here. If play data is still on, the next visit starts with a new id.
• A copy holds nothing about you beyond what this page lists.

Or ask by email

Email towerdefensetogether@gmail.com and include your browser's id, for example if you cleared this site's data or use another device. With no accounts, the id is the only way we can find your data. Deleting it removes everything kept under that id, including the line used to count returns. We reply within 30 days.

Your browser's id: shown here when JavaScript is on Copy

Children and the age question

Before any play data with an id is sent, the game asks once: "How old are you?" Until you answer, the only thing sent is the anonymous count with no id (above). The answer stays in your browser (tdt.age) and is never sent. It only decides what is sent. Everyone can play.

• Under 13: nothing more is sent from this browser, not even the count, and play data cannot be turned on. Anything sent before under this browser's id is deleted. A count sent before the answer has no id: it is only part of that day's total, so there is nothing of it to find or delete.
• 13 to 15: play data starts off, and so does the count. You can turn it on yourself.
• 16 and over: play data starts on, unless your browser asks sites not to track it. You can turn it off.

There are no accounts, no ads, chat is a few fixed phrases, and we never ask for personal details. Online, the nickname is shown to the others in the room, so pick one that isn't your real name. If a child has typed personal details into a note, a parent can press Delete my data on the child's device. For a nickname in an online match's log line, email us.

Changes

If any of this changes, we will update this page and its date. Accounts, if they come later, will get a fuller policy before they launch.