Privacy policy
Hypersmash Studios ("we", "us") is a two-person independent game studio. This page says what we collect when you use this site and play Mini Wars, why, for how long, who else touches it, and how to ask us about any of it. We have tried to write it so it can be read in one sitting. If something is unclear, write to us.
The short version
- You can read the site and follow the game without an account and without giving us anything.
- An account needs a username and a password. A recovery email is optional. We never see your password — only a salted hash of it.
- We keep one cookie, to keep you signed in. No advertising, no analytics cookies, no tracking pixels.
- Accounts are for players aged 13 and over. We ask before you sign up, and we do not store your answer.
- You can delete your account yourself, from the account page, at any time.
What we collect, and why
| Data | When | Why we have it | Kept for |
|---|---|---|---|
| Username, display name, commander name | When you create an account | To run your account and show you on the ladder and at the table. Names are permanent by design (see the terms). | Until you delete the account |
| Password (as a salted scrypt hash — never the password itself) | Password accounts | To let you sign in | Until you delete the account or change it |
| Recovery email, and whether it is verified | Optional; if you give one at signup or later | To send verification codes and password-reset links, and to answer you if you write to us from it | Until you remove it or delete the account. Unverified codes expire after 15 minutes; reset links after 30 |
| Google or Discord identity (the provider's user ID, your name and email there) | Only if you sign in with one of them | To recognise your account when you come back; the provider tells us the email is verified, so it can be your recovery email from the start | Until you unlink the provider or delete the account |
| Sign-in log: time, method, and your IP address truncated to its first two octets | Each sign-in | So you can see recent sign-ins on the account page and notice one that wasn't you | Last 5 sign-ins, at most 90 days |
| Recovery codes (as hashes) | Only if you generate them | A way back into the account if the inbox is gone | Until used or regenerated |
| Founder's Pass and playtest status, and how it was granted | If a pass or code is applied to your account | To open the game to you | Until you delete the account |
| Ladder rating, wins and losses | If you play ranked duels | To run the ladder | Until you delete the account |
| Table Talk messages (35 characters, shown with your display name) | If you post one on the front page | The message wall | 25 seconds. Nothing is archived — that is the point of it |
| Contact form: your name (optional), email, message | If you write to us | To answer you, and for nothing else | In our mailbox for as long as the conversation needs; in a holding queue for at most 30 days while mail is not yet configured |
| Rate-limit counters, by IP address | Sign-up, sign-in, reset, contact and message-wall requests | To stop abuse — bots and brute-force attempts | Minutes to an hour; the IP is not attached to anything else |
What we deliberately do not collect
- Your date of birth. Sign-up asks the month and year you were born before anything else. The check happens in your browser; the answer is never sent to us. All we keep is a single flag that the check was passed.
- Payment details. No Founder's Pass has been sold yet. When the pass goes on sale, payment will be handled by Stripe; card numbers will go to Stripe, not to us, and we will receive only a payment reference and the fact that it succeeded. This page will be updated before the first sale.
- Analytics or behavioural data. Nothing on this site tracks what you do across pages or across the web. If we ever add page counts, they will be aggregate and cookie-free, and this page will say so.
Cookies
One cookie, hs_sess, keeps you signed in for up to 30 days. It is HttpOnly, Secure and strictly necessary for the service you asked for, which is why there is no consent banner. Signing out clears it. The under-13 stop at sign-up is remembered only in your browser tab's session storage — not a cookie, nothing that outlives the tab.
Children
Hypersmash accounts are for players aged 13 and over. Sign-up asks your birth month and year before any other field; if the answer is under 13 no account is created and nothing is kept. If we learn that an account belongs to someone under 13 we will delete it promptly; a parent or guardian who believes this has happened can write to us and we will act on it.
Who else handles the data
We run on services that store or move data on our behalf, under their own security and privacy terms:
- Vercel — hosts the site and runs its code.
- Upstash — the database that holds accounts and the queues above.
- Resend — sends verification codes, reset links and contact-form mail.
- Google and Discord — only if you choose to sign in with them; what they collect when you do is governed by their policies.
- Stripe — will handle payments when the Founder's Pass goes on sale.
We do not sell personal data, share it with advertisers, or use it to build profiles. Data may be stored and processed in the United States, where these services run.
Our legal bases
Where a legal basis is required: running your account, the ladder and the game is performance of the agreement you accept when you create an account; abuse prevention and the sign-in log are our legitimate interest in keeping the service working and secure; the optional recovery email and the contact form rest on your choice to give them to us.
Your rights, and how to use them
- See and correct — the account page shows what we hold and lets you change your display name, commander name and recovery email.
- Delete — the account page has self-service deletion. It removes the account record, the sign-in log and any pending verification; ladder history is removed with it. If you cannot sign in, contact us from the email on the account.
- Export, restrict, object, or ask anything — write to us. We answer within 30 days; we may ask you to confirm you own the account first.
- If you are in the EU or UK and are not satisfied with our answer, you can complain to your data-protection authority.
Security
Passwords are salted and hashed with scrypt; recovery codes are stored as hashes; sessions are signed and can be revoked from every other device at once; the game and its APIs are served only over HTTPS. Staff access to accounts is limited to the two founders, through a console that records every action.
Changes
We will change this page as the site changes — before the Founder's Pass goes on sale, and if we ever add analytics. The date at the top is the date of the current version; material changes will be announced on the site.
Contact
Use the contact page. It reaches the two of us who build the game.