1. Who is responsible
The data controller is STOIC AS, organisation no. 926 193 880, Vulkan 10, unit H0408, 0178 Oslo, Norway. Contact: support@hardblocklife.com.
2. The quick version
- The beta has no player account, advertising profile, payment data or cloud save.
- Your world save, settings and chosen player name are stored in your browser. STOIC does not receive them during ordinary single-player play.
- Cloudflare receives normal request and security metadata to deliver and protect the website. The beta-session cookie is an opaque signed token with no player identity.
- Cloudflare Web Analytics is not currently enabled. If enabled later, its cookie-free beacon will run only on public marketing and legal pages—not inside gameplay.
- If you join an online room, selected live game state and your player name pass through Supabase Realtime in Stockholm so the room can work.
- If you email support, Cloudflare forwards the message to STOIC’s support inbox hosted by Google.
3. What we process and why
| Data | Purpose and legal basis | Where it goes |
|---|---|---|
| Website request and security metadata IP address, date/time, requested URL, browser/user-agent, response status, network and Cloudflare security signals. | Deliver the site, prevent abuse, rate-limit code attempts and investigate faults. Legal basis: performance of the beta service you request and STOIC’s legitimate interests in security, reliability and fraud prevention. | Cloudflare’s network and limited STOIC Worker logs. We never log the beta code, session token or request body. |
| Beta access attempt The code you submit and a per-IP rate-limit key. | Check authorised closed-beta access and prevent brute force. Legal basis: performance of the requested beta service and legitimate security interests. | The code is compared in Worker memory against an encrypted Worker secret and is not written to application logs or storage. Rate-limit counters are held by Cloudflare. |
| Beta-session cookie A random, signed, opaque token containing only a version and expiry—not your name, code or player ID. | Remember that this browser was unlocked. Legal basis: necessary to provide the access you expressly request. | Your browser and Cloudflare Worker verification. See the Cookie Notice. |
| Optional aggregate public-site analytics When enabled: page path without query string, page-load performance and general browser/device metrics. No cookie, localStorage, stored IP address or cross-visit fingerprint. | Understand whether public information loads and works. Legal basis: STOIC’s legitimate interest in measuring and improving a low-data public site. | Cloudflare Web Analytics when configured. The beacon is never included in /play/. |
| Local game data World save, settings, key bindings, high scores and chosen player name. | Save your local progress and preferences. This processing happens on your device at your request. | Your browser storage. STOIC receives none of it in ordinary single-player play. Clearing site data deletes it. |
| Online room traffic Five-letter room code, chosen player name, positions, vehicle/player state, block edits, score/combat events and connection metadata. | Put 2–8 players in the same temporary room. Legal basis: performance of the online feature you choose to use and legitimate interests in service security. | Other players in the room and Supabase Realtime in the North EU (Stockholm) project. |
| Support email Your address, headers, message, attachments and any diagnostic details you choose to send. | Answer questions, investigate bugs and enforce rules. Legal basis: responding to your request, legitimate support/security interests, and legal obligations where relevant. | Cloudflare Email Routing forwards to STOIC’s Gmail inbox; authorised STOIC personnel can read it. |
4. Temporary rooms and other players
The game connects directly from your browser to the Supabase Realtime service when you choose online play. It uses broadcast channels; the game creates no room tables and STOIC does not build a replay archive. Live messages are shared with the other players who know the room code.
Room codes are short coordination codes, not passwords. Do not use a room code, player name or chat-like field to share a real name, address, beta access code or other private information. Other players can see what is broadcast to their room and may record their own screen.
Supabase can keep operational connection and error logs according to the project plan and its processor terms. STOIC does not export room-message logs for profiling, advertising or resale.
5. Service providers and international transfers
- Cloudflare, Inc. provides DNS, TLS, static hosting, Worker execution, rate limiting, security and email forwarding, plus Web Analytics only when the public-site build enables it.
- Supabase, Inc. provides Realtime room transport in the North EU (Stockholm) project.
- Google LLC provides the Gmail inbox that receives forwarded support messages.
These providers may use group companies and subprocessors in the EEA and other countries, including the United States. Where personal data is transferred outside the EEA, STOIC relies on the providers’ applicable data-processing terms and recognised GDPR Chapter V safeguards, such as adequacy decisions or standard contractual clauses. Contact us if you want more information about the safeguard relevant to your data.
We do not sell personal data and do not use it for behavioural advertising or automated decisions with legal or similarly significant effects.
6. How long information lasts
- Beta cookie: 30 days from unlock, unless you use “Lock beta access” or clear cookies sooner.
- Local game data: until you clear site data, the game resets it, or your browser removes it. STOIC cannot restore it.
- Worker application logs: sampled operational errors and request events are kept no longer than 30 days. Codes, session tokens and request bodies are not logged.
- Cloudflare Web Analytics, when enabled: Cloudflare currently keeps unsampled beacon data for 7 days and makes aggregated/sampled reporting available for up to 6 months.
- Online rooms: live game messages are not stored in game-owned room tables. Provider security and operational logs follow the Supabase project’s current plan; STOIC does not retain exported room logs.
- Support email: ordinarily deleted 12 months after the issue is closed, unless needed longer for an active dispute, security investigation or legal duty. Backup deletion may take longer.
We may keep a minimal record longer where necessary to establish, exercise or defend legal claims, or to comply with law.
7. Your privacy rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction, portability or objection to processing based on legitimate interests. Where processing is based on consent, you can withdraw it; this beta does not currently rely on consent for tracking or advertising.
Some rights do not apply to data that STOIC never receives, such as a world save that exists only in your browser. To exercise a right, email support@hardblocklife.com. We may need enough information to locate the relevant support message or request record, but we will not ask you to disclose the beta code.
You may complain to Datatilsynet, the Norwegian Data Protection Authority, or the supervisory authority where you live or work.
8. Security, age and changes
The site uses encrypted HTTPS, an HttpOnly signed access cookie, secret values stored as encrypted Worker secrets, constant-time code comparison, rate limiting, same-origin checks and restrictive browser security policies. No system is perfectly secure, especially beta software.
The service is only for adults aged 18 or older and is not directed to children. If you believe a child has provided personal information, contact us.
We will update this notice when data practices change. The effective date at the top identifies the current version. Material changes will be made visible before or during continued beta access where practical.
9. Contact
STOIC AS
Organisation no. 926 193 880
Vulkan 10, unit H0408
0178 Oslo, Norway
support@hardblocklife.com