← Back to Shooty

Privacy

Who we are

Shooty is an online multiplayer game played in a web browser at shooty.fun, and inside Discord as an Activity. It is run by its owner, who decides what is kept and is the one to write to about it (see the end of this page).

What we keep, and why

Your account. Your email address, your username, the look of your soldier, when the account was made and when you last changed your username. If you made a password, we keep only a salted hash of it, from which the password cannot be read back. We need these to let you sign in and to show you to other players.

If you sign in with Google, Google tells us your email address and your name (which we use to suggest a username). We never see your Google password, and we keep nothing from Google but the email address.

If you sign in with Discord, or connect your Discord account to your Shooty account, Discord tells us your Discord user id, your Discord name, and your email address if Discord has verified it. We keep the id and the name, so that signing in with Discord takes you to the right account. A verified email address is used to find an account you already have, or as the email of a new one. We do not keep the token Discord gives us: it is used once, to ask who you are, and inside Discord it is handed back to Discord so that it can show what you are playing.

Your games. The matches you play (the map, the game, when, and how you did: kills, deaths, assists, damage, captures and coins won), your coins and every change to them, the skins and emotes you own and wear, your friends and friend requests. We need these to run the game, pay you coins and keep your things.

Chat is passed to the other players in your match as you send it. It is not kept.

Fair play. When the game notices play that looks like cheating, it keeps a note of what it saw, against your account. If an account is suspended, we keep the reason and how long for.

Your browser's name for itself. The first time you visit, your browser makes up a random code and keeps it, in its local storage and in a cookie called sd. It is sent when you sign in, and we note which accounts have signed in from it. We use it for one thing: when an account is suspended for breaking the rules, new accounts made from the same browser are kept out too. It is not a fingerprint and says nothing about your device or about you.

Buying coins. When you pay by UPI, we keep which pack you bought, the amount, the UPI reference number and the screenshot of the payment you send, and whether and by whom it was approved. We need these to check that the money arrived, to give you your coins, and as a record of the sale. If you pay through a payment provider's form, the provider takes your payment details and your mobile number on its own secure page; we keep only the order, its amount and whether it was paid, never your card, bank or UPI details.

Your internet address is used for a few minutes, in memory only, to stop anyone trying to sign in too many times. We do not store it with your account. Like any website, the computers that host Shooty may keep ordinary logs of requests, which include internet addresses.

In your browser the game keeps your sign-in, so you stay signed in (for up to 30 days), and your settings: graphics, controls, sensitivity, volume, music and how you laid out the screen. These stay on your device.

What other players see

Your username, your soldier's look and the skins you wear, how you do in matches you play with them, and, if you are friends, whether you are online. Never your email address.

Who else sees it

• The owner and the administrators of Shooty, in its admin panel, to run the game, check payments and deal with cheating. Some of what happens (new accounts, payments waiting to be checked, anti-cheat notices, admin actions) is also posted to the owner's private Discord channels, by username, so it can be dealt with quickly. A payment's screenshot can be posted there to be approved.
• The companies that host the game for us: the server it runs on, and Supabase, which hosts the database.
• Google and Discord, when you choose to sign in with them, under their own privacy policies. Inside Discord, Discord's own privacy policy also applies to everything around the game.
• A payment provider, when you pay through its form, under its own privacy policy.

We do not sell anything about you, we show no advertising, and the game has no tracking or analytics scripts.

How long we keep it

For as long as your account exists. Records of payments are kept for as long as the law requires us to keep records of sales. A sign-in stops working after 30 days, or when you log out.

Your choices

• You can change your username, and disconnect your Discord account, on the account page in the game.
• You can ask us for a copy of what we keep about you, or to correct it.
• You can ask us to delete your account. We then delete it and what is kept about you, except records of payments we have to keep, and notes that we must keep to keep a suspended player out.

Children

Shooty is not meant for children under 13, and nobody under 13 should make an account. Buying coins needs you to be 18 or over, or to have the permission of a parent or guardian who is (see the terms).

Changes

If what we keep changes, this page will say so, with a new date at the top.

Contact

To ask about your data, or to have your account deleted, use the contact address given on the Shooty site.