Privacy policy
Version 2026-10 — last updated: 10 October 2026
This English version is a translation provided for convenience. The French version (Politique de confidentialité) is the reference text.
1. Who is responsible for your data?
Data controller: the publisher of the game (a private individual, non-professional publisher), who can be reached at contact@galaxyslam.com for any question about your data.
No data protection officer has been appointed (not mandatory).
2. What data, why, and on what legal basis?
| Data | What it is used for | Legal basis (GDPR, art. 6) | How long |
|---|---|---|---|
| Account: nickname, email address, password (stored only as a scrypt hash, which cannot be read back), creation date. Signing in with Google is optional: if you choose it, we only receive from Google your Google account identifier, your email address and the fact that it is verified. | Creating and managing your account, signing you in, showing your nickname next to your maps. Your email is never shown to other players; it identifies you when you sign in and lets us reply if you write to us. | Performance of the contract (the Terms of use) | As long as the account exists |
| Consent at sign-up: date you accepted the Terms and this policy, accepted version, statement "15 or older, or parental consent" | Proving that the terms were accepted and that the age rule was declared | Accountability (art. 5.2 and 7.1) and legitimate interest | As long as the account exists |
| Sign-in sessions: hash of the sign-in token, creation and expiry dates, date of your last sign-in | Staying signed in on a device, signing out all devices | Performance of the contract | 30 days maximum (then deleted automatically) |
| Community maps: name, map content, settings, draft / published, dates, number of plays, ratings received | Saving your creations, publishing them and letting others play them | Performance of the contract | Until you delete the map or your account |
| Account statistics: level and XP, matches played, wins, knockouts, podiums, damage % dealt, MVP titles, matches per mode | Keeping your progress (level, unlocked characters and bats) on all your devices; limits prevent it from being inflated artificially | Performance of the contract | As long as the account exists |
| Play time per community map | Only allowing a map to be rated after playing it for at least one minute (honest ratings) | Legitimate interest (reliable ratings) | Until the map or your account is deleted |
| Friends: your friends list, requests sent and received | Finding your friends: they see your nickname, whether you are online and the code of the room where you are waiting for them (never your email) | Performance of the contract | Until you remove the friend or delete your account |
| Anti-cheat checks: anomalies detected during online matches (impossible values, bursts of hits or parries), reason, possible suspension | Keeping matches fair: removing a player from a match, suspending an account for repeated cheating | Legitimate interest (security and fairness of the game) | As long as the account exists; a suspension can be appealed (see the Terms of use) |
| Ratings and reports you give: stars, reason for the report, dates | Ranking maps, moderating reported content | Performance of the contract; legitimate interest (community safety) and obligations under the Digital Services Act (DSA) | Until the map concerned or your account is deleted |
| Moderation log: moderation actions (hiding, deletion, ban), identifiers concerned | Keeping a record of decisions so they can be explained or appealed | Legitimate interest; DSA obligations | As long as needed to follow up and justify decisions; the nickname is removed from it when the account is deleted |
| IP address | Limiting abuse (number of sign-ups, sign-ins and matches per address); security and the hosts' technical logs. For moderation of rooms with friends, the game also sends an anonymous device identifier (a random number kept in your browser): it is only used to stop a player without an account who was kicked by the host from coming back to that room, and the server only keeps it in memory for the life of the room, never storing it. | Legitimate interest (security of the service) | Anti-abuse counters in memory only: 24 hours maximum, cleared at each restart. Hosts' logs: retention set by each host (Vercel, Railway). |
| Online match data: displayed nickname, appearance (character, colour, bat), positions, hits, score | Running the match: sent to the other players in the same room | Performance of the contract | In memory during the match only; nothing is kept afterwards |
| Proximity voice chat (accounts only, off by default; not available in the CrazyGames version) | Talking with players near you in the match | Your consent (you turn it on yourself and your browser asks for microphone access) | Nothing is recorded, neither by us nor by the server |
Voice chat in detail
- Sound goes directly from one browser to another (WebRTC technology, encrypted). Our server only relays the technical messages that let browsers connect; it does not receive the sound and nothing is recorded.
- To connect directly, browsers exchange their IP addresses: other voice chat participants can therefore technically see yours. Public "STUN" servers from Google and Cloudflare help establish the connection and also see your IP address.
- Voice chat is reserved for players with an account, and therefore for those who are 15 or older, or have parental consent. You can mute your microphone, mute one player or everyone at any time.
What stays in your browser
The game stores in your browser's local storage (localStorage): your local profile (nickname, level, XP, statistics), your appearance, your settings, your map drafts, the list of maps you have rated, the players you muted in voice chat and, if you are signed in, your sign-in token. Video clips are saved only on your device. This data is not sent to our server (except the token, to prove you are signed in, and the anonymous room device identifier, see above). It is strictly necessary for the game, so no consent banner is required. You can erase it by clearing the site's data in your browser.
No advertising cookies, no advertising trackers. Audience measurement: Vercel Web Analytics counts page views (page, referring site, country, device type, operating system and browser), without cookies or storage on your device. Your IP address is not kept: visits are grouped by an encrypted fingerprint that changes every day, which does not allow you to be recognised from one day to the next.
3. Who receives your data?
- Other players see your nickname, your published maps and their average rating (never your email, nor who gave which rating).
- The publisher, the only person with access to the database, for administration and moderation.
- Our hosts, as processors:
- Vercel Inc. (United States) — hosts the website pages and measures their audience anonymously (Vercel Web Analytics, no cookies). 440 N Barranca Avenue #4133, Covina, CA 91723, United States.
- Railway Corporation (United States) — hosts the game server and the database of accounts and maps.
- Technical providers contacted directly by your browser on galaxyslam.com, which see your IP address: Google (Google Fonts typefaces, voice chat STUN server) and Cloudflare (three.js 3D library via cdnjs, voice chat STUN server; Turnstile anti-bot check, only when it appears at sign-in or sign-up). The Google sign-in script is only loaded if you choose "Sign in with Google". The CrazyGames version includes these files itself and does not contact these providers.
- On CrazyGames: the version of the game published on crazygames.com is displayed within their site, which loads its own tool (SDK) and may show its own advertising. This processing is the responsibility of CrazyGames and is covered by its privacy policy. In this version there is no Galaxy Slam account: your nickname is that of your CrazyGames account (or a randomly drawn guest nickname), and your progress is saved by CrazyGames (in your browser, or on your CrazyGames account if you are signed in). Online matches use the same match data as above.
Transfers outside the European Union: these companies are based in the United States. Transfers are covered by the EU–US Data Privacy Framework where the company is certified, or by the European Commission's standard contractual clauses.
We do not sell or rent any data, and we do no targeted advertising.
4. Your rights
You have the right to access, rectify, erase, restrict, object to the processing of and port your data, the right to withdraw your consent at any time (for example by turning off voice chat), and the right to set instructions about what happens to your data after your death.
- Download your data: game → Profile tab → Download my data (JSON file: account, maps, ratings, reports, sessions, and the data in this browser).
- Delete your account: game → Profile tab → Delete my account (confirmed with your password, or with Google). Deleted immediately: your account, your sign-ins, your ratings, your reports and your maps (drafts and published, with the ratings they had received). Your nickname and email become available again. Any backup copies of the database are erased as they are renewed.
- By email (forgotten password, suspended account, change of nickname, any other request): contact@galaxyslam.com. We reply within one month. We may ask you to prove that the account is yours (for example by writing from the account's email address).
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr/fr/plaintes, or by post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. You can also contact the data protection authority of the country where you live.
5. Minors
The game can be played without an account. To create an account, you must be 15 or older or, under 15, have the consent of a parent (or of a holder of parental authority), in accordance with article 45 of the French Data Protection Act (loi Informatique et Libertés). A parent can ask at any time for their child's account to be deleted by writing to contact@galaxyslam.com.
6. Security
- Encrypted connections (HTTPS / WSS).
- Passwords never stored in plain text (scrypt hash with a random salt); sign-in tokens stored only as hashes, and revocable.
- Limits on sign-in, sign-up and deletion attempts; your email is never returned by the server's public interface.
- Database access reserved for the publisher.
7. Changes
If this policy changes significantly, we will let you know in the game. The date and version at the top of this page show the latest update.