Privacy Policy
Version 1.0, effective 2026-11-03
This policy explains what Those Scary Slayers (the "game"), at scaryslayers.com, collects, why, how long it is kept, and what you can do about it. The game is run by Michał Turek-Brzozowski, Poland ("we"). You can contact us at [email protected].
The short version
- You can play without an account. Signing in is optional.
- Your game progress is saved in your browser.
- If you allow it, the game sends statistics about your runs, tied to a random id for your browser. You choose the first time you play, and you can change your choice at any time under Play statistics in the menu on the World Map.
- If you sign in, we store your account details and your saved bloodlines.
- If you send a report, we store what you send.
- We do not sell your data.
Information saved in your browser
The game stores your progress, saved run, settings, unsent or recent feedback reports, your statistics choice, whether you accepted the Terms at sign-in, and, if you allow statistics, a random device id, in your browser's local storage and IndexedDB. These stay on your device until you clear this site's data in your browser. They are not sent to us, except as described below. Signing out or deleting your account removes your synced progress from the browser, but it does not remove the device id, settings or feedback history. Choosing Decline under Play statistics removes the device id.
Game statistics
The first time you play, the game asks whether you allow play statistics. If you choose Accept, the game sends us the following, to understand how the game plays and to balance it, whether or not you are signed in. If you choose Decline, or have not chosen yet, it sends none of this and stores no device id.
- Events, when a run starts or ends, when you survive a wave, and when you build a new nest. Each has a random device id, the game version and details such as a random run id, the outcome, the run's length, the wave number or the number of expansions.
- Run summaries, at the end of each won run and each lost run of 30 seconds or longer. These contain the random device id, a random run id, start and end times, outcome, length, the wave reached, gameplay statistics, your bloodline state for that run and the game version. If you are signed in, the summary is also linked to your account.
Run-start and run-end events also include the kingdom, map, difficulty and whether it is the tutorial.
The device id is random and is not derived from your name or hardware, but it is persistent: it stays the same in your browser until you clear site data, and it lets us see that runs came from the same browser. We therefore do not describe this data as anonymous.
How long we keep it. Cloudflare, which stores events for us, documents that it keeps them for three months. We do not automatically delete run summaries. We currently keep them indefinitely.
Your choices. You can change your choice at any time under Play statistics in the menu on the World Map. Choosing Decline stops all statistics, including Cloudflare Web Analytics, and deletes the device id from your browser straight away; if statistics were on, the game reloads the page to do this. Choosing Accept after a Decline creates a new device id. If this browser already has a device id from an earlier version of the game and you have not declined, Accept keeps it. Neither choice deletes what was already sent. Statistics sent before you made a choice, including by versions of the game from before this choice existed, stay as described above. While statistics are on, the Play statistics screen shows your device id. To ask us to delete run summaries, contact us with that id. We cannot delete individual events from Cloudflare's store. They expire as described above.
Accounts and cloud saves
You can sign in with Discord or Google to sync your bloodlines between devices. The game has no passwords of its own.
What we receive. From Discord: your user id, email address and whether it is verified, display name or username, and avatar. From Google: your user id, email address and whether it is verified, name and profile picture. We use the sign-in tokens once and do not store them.
What we store:
| Information | Why | How long |
|---|---|---|
| Random account id, display name, avatar link, creation date | To show you your profile | Until you delete your account |
| Provider name, provider user id, link date | To recognize you when you sign in | Until you unlink it or delete your account |
| Email address, only if the provider verified it | To notice that you already have an account when you sign in with a second provider. We do not use it to contact you or show it in the game. It appears in your own data export | Until you unlink that provider or delete your account |
| Saved bloodlines, with save version and date, and game version | Cloud save | Until you delete your account |
| Your Nest (the account-level meta-game), with its save version and the time it was last brought up to date | To run your Nest on any device | Until you delete your account |
| Session id, dates and a browser user-agent of up to 128 characters | To keep you signed in, and for support | A session ends after 90 days of inactivity or when you sign out. The server record of an expired session may remain until you delete your account |
| Your account id on run summaries sent while signed in | To connect your runs to your account and include them in your export | Removed when you delete your account |
We do not automatically delete inactive accounts. Your display name and avatar link are set at sign-up and stay in place if you unlink that provider.
Cookies. We set two cookies, only when you use sign-in: __Host-tss_session, which keeps you signed in for up to 90 days since your last refresh, and __Host-tss_flow, which protects a sign-in in progress for 10 minutes. We do not use advertising cookies.
Your avatar. Your browser loads your avatar image directly from Discord or Google.
Export and deletion. In Profile, Export my data downloads your account details, linked sign-ins, save, Nest and the run summaries linked to your account. It does not include session records, feedback reports or run data not linked to your account. Delete account immediately erases your account, save, Nest, linked sign-ins and sessions from our live database. It does not delete your run summaries: we remove the account link and keep them, along with their device id, for balance analysis. Our hosting provider's database recovery feature may retain earlier states for up to 7 days. Feedback reports and browser data are handled separately.
Feedback and bug reports
If you send a report from the Feedback form, we receive what you wrote and what you leave selected. The form lets you preview each group before sending. It may include:
- the type, summary and details you write, and any contact you give;
- the game version;
- your browser's user agent and language, screen size and pixel ratio, and basic device capabilities;
- details of your current run, and recent game log lines, errors and events. We remove email-like text, the site address and your device id from logs and errors, but not from what you type;
- your device id, if "Link to my play statistics" is ticked. It is ticked by default if you allowed play statistics, and unticked if you did not. Ticking it when statistics are off creates a device id for that report;
- a screenshot of the game map or a copy of your saved run, only if you tick them.
Do not include anything you do not want us to have in a free-text field.
Who sees it. The developer reads reports. A short notice goes to a private Discord channel with the type, summary, up to 300 characters of details, game version, kingdom, wave, report id and the names of the attached groups, but not your contact, device id or attachments. If a report leads to a public GitHub issue, the developer reviews the text first and it does not include your contact or device id, though it may include what you wrote.
How long. We delete reports after about six months, contact details after about three, and attachments after about thirty days. Deletion runs when new reports arrive or when the developer runs it, so it can be late. Discord notices and public issues are not removed automatically, including when you delete a report.
Deleting a report. Reports linked to your device can be deleted in My reports in the Feedback form. For other reports, or if you have lost access to that browser, contact us with the report id.
Service providers and other sites
- Cloudflare hosts the game and stores our data. It handles your IP address and request details to deliver the game and protect it from abuse, including rate limits. Our own code and database do not store your IP address.
- Cloudflare Web Analytics runs on the game page, only if you allow play statistics, to measure page views and performance. Cloudflare describes it at developers.cloudflare.com/web-analytics/about. It does not run on this page.
- Discord and Google provide sign-in if you choose them, and have their own privacy policies.
- Discord receives report notices as described above, and hosts our community if you use the invite link.
- GitHub hosts public issues as described above.
- Fandom hosts the game's wiki at scaryslayers.fandom.com. It is a separate site with its own terms and privacy policy. The game does not send it your data, but following the link takes you there.
We use no third-party web fonts, advertising or payment services.
Legal bases
- Play statistics and Cloudflare Web Analytics: your consent, which you can withdraw at any time under Play statistics.
- Accounts and cloud saves: performing our agreement with you, the Terms of Service.
- Feedback handling and protecting the game from abuse: our legitimate interest in fixing and running the game.
Your data is transferred outside your country through Cloudflare, Discord and Google, under their standard contractual clauses. The supervisory authority for the operator is the Prezes Urzędu Ochrony Danych Osobowych (UODO), Poland.
Your rights
Depending on where you live, you may have rights to access, correct, delete or object to the use of your information, to withdraw consent, and to complain to a data protection authority, such as UODO. Contact us at [email protected]. Because we do not ask for your name when you play signed out, we may need your device id or report id to find your data.
Children
The game is not intended for children under 16. Do not sign in or send a report if you are under that age. The game has no age check. If you believe a child has given us information, contact us and we will delete what we can identify.
Security and location
Sign-in cookies cannot be read by page scripts and are sent only over secure connections. No system is perfectly secure. Your data may be processed in countries other than your own, wherever our providers operate. See Legal bases.
Changes
We may update this policy. We will change the version and date above and list the change below. For significant changes, we will also mention them in the game's patch notes. If a change adds to the play statistics we collect, the game asks for your choice again.
- 1.0, 2026-11-03: First version.
Contact
Michał Turek-Brzozowski, [email protected]