Privacy

Short version: reading this site stores nothing in your browser. The server writes the request to a log, with your address shortened first. Playing the game stores a few things locally. Only submitting a score to the leaderboard creates anything that recognises you on a later visit, and that is a single random number.

There are no ads, no tracking pixels, no third-party fonts, no CDN and nothing embedded from elsewhere. No analytics script runs on these pages. The only request your browser makes to another company is one you make yourself by clicking a link. Visitor counts come from the server's own logs, described under server logs below.

Who is responsible

Controller under Art. 4(7) GDPR:
Brutenis Gliwa
brutenis@gmail.com

A person reads that address. Use it for anything on this page: a leaderboard entry you want removed, a question about what is stored, or a correction to something here that is wrong.

What is stored on your device

The site creates all of it, and nobody else can read any of it. Each item is needed for something you asked the site to do, so none of it requires a consent banner under §25 Abs. 2 TDDDG. That is why you are not being shown one.

• theme is whether you picked light or dark. It stays in your browser.
• attackers-enabled is whether you turned the game on or off. It stays in your browser.
• leaderboard-name is the name you last typed into the submit box, so you do not have to type it again. It leaves your browser only if you submit a score.
• bnet-session-id and bnet-session-token are created the first time you hit a monster. They tell the server that a submitted score belongs to a game it handed out. They live in sessionStorage and are gone when you close the tab.
• lastSubmittedRank is the position your last score reached, so the leaderboard can highlight your row. Also sessionStorage, also gone with the tab.
• _bnet_uid is a random identifier, kept as a cookie for 90 days. It is written only when you submit a score, never on a page view and never for someone who just plays. It is HttpOnly, so no script on the page can read it, and scoped to /api, so it travels with the game's requests and not with ordinary page loads.

Why the identifier exists

It does two jobs, and the leaderboard needs both. It lets the board show your best run instead of one row per attempt, and it lets a new score be compared against what the same player did before, which is most of what keeps impossible numbers off the board.

It is a random number. Nothing about your device or your address goes into it, it cannot follow you to another site, and it is not combined with anything else. Clearing your site data for brutenis.net ends it, and the next score you submit starts a new one.

What reaches the server

Starting a game creates a row holding a random session identifier, the player identifier above, and the time.

Submitting a score adds to that row:

• the name you typed, which can be anything you like;
• your score, your level, and how long the run lasted;
• whether you played on desktop or mobile, and which version of the game;
• a log of the run: its kills, level-ups and pickups, each with a timestamp in milliseconds from the start. The anti-cheat check runs against this.

The leaderboard shows the name, score, level, duration, date, weapon and platform. Nothing else is public.

Legal bases

• Everything up to and including starting a game is storage needed for a function you asked for, under §25 Abs. 2 TDDDG. No consent is needed and none is asked for.
• Publishing your chosen name and score rests on your consent, Art. 6(1)(a) GDPR, given by filling in the name and pressing submit. You can withdraw it whenever you like by having the entry removed.
• Checking a run for cheating, and keeping the site up, rest on legitimate interests under Art. 6(1)(f) GDPR. Recital 47 names fraud prevention as one.

How long it is kept

• A game started but never submitted is deleted after 2 hours.
• The run log is deleted after 7 days. The leaderboard entry stays; the record of how you played it does not.
• The leaderboard entry itself, meaning the name, score, level, duration and date, stays until you ask for it to go.
• The _bnet_uid cookie lasts 90 days, counted again from each score you submit.
• Web server logs are rotated and deleted as they age. The summary built from them is kept, and it holds counts rather than addresses.

Server logs and hosting

The site runs on a server rented from Hetzner Online GmbH in Germany, which acts as a processor under Art. 28 GDPR. Your requests reach that server, so Hetzner handles them in passing. Nothing is transferred outside the EU.

The web server keeps an access log, so I can see roughly how many people visit and which pages they read. Each line holds the time, the page requested and how, the response status and size, your browser's user agent, the page you followed a link from if there was one, and the network the request came from.

That last part is shortened before it is written. An address is cut back to its network block: the last part of an IPv4 address becomes zero, and an IPv6 address keeps only its site prefix. No full address reaches this log. What is left cannot pick out a household, but it is enough to say which country a visit came from, which is all it is used for.

Those files are rotated and deleted as they age. What outlasts them is a summary of pages, days, browsers and countries, with no addresses in it. It is not published; it sits behind a password and only I see it. The basis is Art. 6(1)(f) GDPR: knowing whether anyone reads the thing, and noticing when the site is under attack.

No analytics script is involved in any of this. Nothing is added to the pages, nothing is stored on your device, and nothing is sent to another company. It is the server writing down requests it had to answer anyway.

The game's API keeps no request log of its own, because that one would have recorded full addresses and the log above already covers the same requests. It does note that a session was created, and the name and score of a submitted run. Separately, the firewall records connections it turns away, and those entries do hold the full address. That is the one place on the server that keeps one, and it covers refused connections rather than visits to the site.

Your rights

You can ask for your data (Art. 15), have it corrected (Art. 16) or erased (Art. 17), have its processing restricted (Art. 18), receive it in a portable form (Art. 20), and object to processing based on legitimate interests (Art. 21). Where something rests on consent, you can withdraw it at any time without affecting what was lawful before.

For a leaderboard entry you can skip all of that and do it yourself. Your own row carries a Remove button, which deletes every run you have submitted, with no email and no waiting. You are also free to complain to a data protection supervisory authority, which in Germany is the one for the federal state the controller is established in.

If the identifier is gone

That cookie is the only thing linking you to an entry. There is no account and no address on file, so once it has been cleared or has expired, the Remove button can no longer find your row. Art. 11 GDPR covers this: a controller who cannot identify the person behind the data does not have to start collecting extra details so that it could.

Email me instead, with whatever you remember about the run. I check these by hand.

Doing it yourself

Clearing site data for brutenis.net in your browser removes everything in the first section, including the identifier.

Scores first, though. The Remove button works by recognising the identifier in your browser, so clearing that first takes the button with it. Remove the entry, then clear whatever you like. If you have already done it the other way round, see if the identifier is gone above.

Changes

This page lives in the site's source code, so its history is public in the repository. Last updated: 21 September 2026.