David of Columbia is a pixel-art game you play in your browser at davidofcolumbia.com. It is made by Michael Lubash, Ilya Pakhilka and Maxim Shlomo Voro (“we”, “us”). This policy explains what we collect when you use the website and the game, why, and what you can do about it.
Short version: we collect only what we need to save your game and, if you choose, sign you in. We don’t show ads, we don’t track you across other sites, and we never sell your data.
What we collect
You don’t need an account to play. When you first press Play, the game creates a guest account for you on our server, with a random ID and no email, so your saves are kept safe. If you want to play on more than one device, you can sign in with Google in Settings → Account; your guest account then becomes your Google account, with the same saves.
| What | Where it comes from | Why we need it |
|---|---|---|
| A random guest ID | Created when you first play | To keep your saves on our server |
| Email address, Google account ID | Sign in with Google (optional) | To sign you in on any device |
| Name and profile picture | Sign in with Google (optional) | Google sends them with sign-in. Our sign-in service keeps them with your account; we don’t show or use them |
| Game saves: progress, team, items, playtime | The game | To save your game and load it on any device |
| Avatar, in-game name and teams for online battles | What you pick in the game | To show your character to other players |
| PvP data: match codes, moves | Online battles | To run the match. Your opponent sees your avatar, in-game name and team |
| IP address, browser and device type | Your browser | To keep the site and online battles working and secure, and to stop bots |
The game keeps your sign-in and a copy of your saves in your browser’s storage on your device, so it works offline. We don’t use advertising or analytics cookies. Cloudflare, which runs our website, may set technical cookies to protect the site from attacks and bots.
We never get your Google password.
How we use Google user data
When you sign in with Google, we ask Google only for your basic profile: your email address, your Google account ID, your name and your profile picture. We don’t ask for access to Gmail, Drive, Contacts or any other Google service.
- Access: we receive this data when you sign in.
- Use: we use your email address and Google account ID only to sign you in and connect your saves to you. We don’t use your name or picture.
- Storage: we store your email address and Google account ID with your account on our servers. Our sign-in service also keeps the name and picture link that Google sends; we don’t show or use them.
- Sharing: we don’t share, sell or transfer Google user data. The only exceptions are our providers, which store it for us, and when the law requires it.
- Ads: we never use Google user data for ads or to build profiles about you.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
How we use all other data
- To run the game, save your progress, and let you play on any device.
- To run online battles.
- To keep the site safe, stop bots and abuse, and fix errors.
We don’t send emails.
Who we share data with
We don’t sell your data or share it with advertisers. We share it only with:
- Supabase, which stores accounts and saves for us.
- Cloudflare, which runs our website and the online battle server, and checks that new guests aren’t bots (Cloudflare Turnstile, which works invisibly; its use of data is described in Cloudflare’s Turnstile Privacy Addendum).
- Google, only when you choose to sign in with Google. Google’s own privacy policy applies.
- Other players: in online battles, your opponent sees your avatar, in-game name and team. Nothing else.
- The law: if a court or the law requires it.
- A new owner: if the game is ever sold or merged. We’ll tell you first, and this policy will still apply to your data.
Where we store it and how we protect it
Accounts and saves are stored by Supabase in the European Union (Ireland). The website and the online battle server run on Cloudflare’s network around the world. Data is encrypted when it travels between your browser and our servers. Only the team members who run the game can access it, and only to keep the game working.
How long we keep it
- Account and saves: until you delete your account.
- Guest accounts: deleted with their saves after 90 days without play. A guest account can only be opened from the browser that created it, so if you clear that browser’s data before signing in with Google, the game can’t be found again.
- Online battles: the battle server keeps a match only while it is being played.
- Backups: after you delete your account, your data may stay in our providers’ backups for up to 30 days, and is then erased.
- Server logs: our providers keep server logs for no longer than 30 days.
Deleting your account
In the game, go to Settings → Account → Delete account. This erases your account, your Google sign-in and all your saves on every device. It can’t be undone.
You can also email us at [email protected] and we’ll delete it for you.
To remove the game’s access to your Google account, go to your Google Account → Security → Your connections to third-party apps & services.
Your rights
You can ask us to show you, correct, export or delete your data at any time. Email [email protected]. We reply within 30 days. If you think we’ve handled your data badly, you can also complain to your local data protection authority.
Children
David of Columbia is not meant for children under 13. We don’t knowingly collect data from them. If we learn that a child under 13 has an account, we delete it. Where local law sets a higher age for consent, the player needs a parent’s permission.
Changes to this policy
If we change this policy, we’ll update the date at the top. For big changes, we’ll show a notice on the website before they take effect.
Contact
Michael Lubash, Ilya Pakhilka and Maxim Shlomo Voro, Israel
[email protected]