Privacy
Privacy
Short version: you can play without giving me anything but a callsign. Analytics from Google stay off until you press Allow analytics. Profiles are deleted after 24 months without use, or at once when you press Delete my data.
Last updated 2026-10-28
Who is responsible
SubnetSiege is run by Kim Asplund, a private person in Finland. I am the controller of the personal data described here. Write to privacy@subnetseige.com for anything about your data.
What is collected, why, and on what basis
| What | Why | Legal basis (GDPR art. 6) | Kept |
|---|---|---|---|
| Sign-in (Firebase Authentication) | An anonymous guest account is created when you open the game, so your stats can be saved. If you link Google sign-in you also give me the Google user id, your name, email address and profile photo address. These are kept by the sign-in service, not in the profile database. A new profile never takes your Google name as its callsign; an existing profile keeps its callsign until you change it. | Necessary to provide the game you asked for (b) | Until you delete it, or 24 months without activity (see below for sign-in accounts that have no profile) |
| Profile and stats (Firestore) | Callsign, team choice, stats (frags, flag captures, matches played and similar), and when the profile was created and last used (the last-used time is updated when you sign in or finish a match, at most once a day). Only you can read your profile, and it holds no email or photo address. Older profiles that still had them lose them the next time their owner signs in, or when the daily cleanup job next touches them. | Necessary to provide the game (b) | Same as sign-in |
| Online play (game server) | When you join an online match the server receives your callsign, team, arena, and the gameplay messages (movement, shots, hits). Your IP address is used to keep the connection open. Short-lived server logs record joins, leaves and errors with callsign and arena. The game writes no IP address to its own logs. | Necessary to provide the game (b); security and abuse prevention (f) | Gameplay data lives for the match. Logs are short-lived and rotated. |
| Google Analytics | Only after you press Allow analytics. Match start and end, score, arena, online or offline, team, frags, deaths, captures, match length, a bucket for frame rate, graphics tier and connection delay, and sign-in method. Google adds device, browser and approximate location, and sets its own cookies (_ga and _ga_ followed by the stream id) in your browser. No callsigns and no free-text values are sent. |
Your consent (a) | 14 months in Google Analytics, or until you withdraw consent and ask me to delete it |
| Cloudflare Web Analytics | Aggregate visit counts: page, referrer, country, browser and page speed. It sets no cookies and builds no profile of you. | Legitimate interest in knowing whether the site works and is found (f) | Aggregates only |
| Hosting (Cloudflare) | Cloudflare serves the site and sees the IP address and request details of every visit, for delivery and protection against attacks. | Legitimate interest in a secure, working site (f) | Under Cloudflare's own retention rules |
| Email you send me | Your address and message, to answer you. | Legitimate interest in answering (f) | As long as the conversation needs it |
I do not sell data, run ads, or make automated decisions about you. The ad code in the game is switched off, and it would not load without your consent.
Analytics and your choice
Nothing from Google for analytics loads before you choose. Allow analytics and No thanks are equal buttons, and the game plays the same either way. Change your mind at any time with Cookie settings in the footer or the game menu. Withdrawing consent stops new collection and deletes the Google Analytics cookies (_ga, _ga_*) this site set in your browser. It does not undo what was collected before, so email me if you want that deleted too.
The home page loads no Firebase and nothing from Google. The game page does load Firebase sign-in and the profile database, because saving your stats needs them. That means Google receives your IP address and technical request data when the game starts, as part of providing the service.
What is stored on your device
SubnetSiege sets no cookies of its own; the only cookies are Google Analytics’, and only after you allow analytics. It uses your browser’s local storage:
ss_consent: your analytics choice and when you made it.ss_player_nameandss_player_team: your callsign and team choice. The callsign is sent to the game server and shown to other players when you play online.ss_guest_profile: a copy of your profile (user id, callsign, team and stats), kept for when the profile database cannot be reached. It never holds your email address or photo address, and the game removes them from older copies when it reads them.ss_selected_arena: the last arena you picked.ss_tutorial_begun: a marker that the first-visit analytics event was sent, so it is not sent again. It is written only after you allow analytics.ss_firebase_config: only present if someone sets a test configuration by hand. It holds no personal data.ss_protocol_reload(session storage): a flag that stops a reload loop after a game update.- Firebase keeps your sign-in state in the browser’s IndexedDB. After you allow analytics, Google Analytics adds its own cookies (
_ga,_ga_*); withdrawing consent deletes them.
The first group is needed for the game to remember you and works without consent. Clearing your browser data removes all of it.
Who else handles your data
- Google (Firebase Authentication, Firestore, Google Analytics) processes data on my behalf.
- Cloudflare provides hosting, Web Analytics and email forwarding for the addresses on this site.
- The server host runs the online game server once it opens. Its access logs may briefly hold the IP addresses of players who connect.
Google and Cloudflare may process data outside the EU/EEA, including in the United States. Both are certified under the EU-US Data Privacy Framework, and their data processing terms include the EU Standard Contractual Clauses as a fallback. Your Google account, if you link it, is covered by Google’s own privacy policy.
How long data is kept
- Profiles (sign-in account and stats, guest accounts included) are deleted after 24 months without activity. Activity means signing in or finishing a match. A daily job finds profiles that have passed 24 months and deletes each one together with its sign-in account (guests included), at most 500 per run. A sign-in account that has no profile record is not found by that job; I remove it on request at privacy@subnetseige.com. Profiles made before the last-used time was recorded count as used on the day the job first ran.
- Delete my data in your profile (after you confirm) deletes the profile, the stats and the sign-in account at once, and clears the game’s entries in your browser’s local storage. If you linked Google and signed in more than a few minutes ago, a Google window first asks you to confirm it is you; if you cancel it or your browser blocks it, nothing is deleted. If the profile is deleted but the sign-in account cannot be removed, the game tells you exactly that and shows an ID; email me and quote that ID, and I will remove the account. You then continue as a new guest.
- Google Analytics data is kept for 14 months.
- Cloudflare Web Analytics keeps aggregate figures only.
- Server logs are short-lived.
Your rights
Under the GDPR you can ask to see your data, correct it, delete it, restrict its use, receive it in a portable format, and object to processing based on legitimate interest. You can withdraw consent at any time. Use Delete my data in your profile, or email privacy@subnetseige.com. I answer within one month. A guest account has no email on it, so I may ask for the callsign and the time you played to find it, or for the ID that Delete my data showed you.
If you think your data is mishandled, you can complain to the supervisory authority: the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi), or the authority in your own country.
Children
SubnetSiege is not aimed at children. If you are under 13, you need a parent or guardian’s permission to play and to allow analytics. A guardian can use the same email address to have a child’s data deleted.
Changes
If this notice changes in a way that matters, the date at the top changes and the news page says so.