Privacy Policy

1. Controller

The game HyperPuck and its associated services (online match servers, website) are published by Nicolas Lidon EI (trading name Zarzaille Corporation, SIREN 990 993 651), 99 chemin des Libellules, 01600 Massieux, France. Details are provided in the legal notice.

For any questions about your data or to exercise your rights, you can contact us directly at: privacy@hyperpuck.net (or support@hyperpuck.net).

2. Data collected

When using the game and the website, the following data may be processed:

• Accounts: In the installed game (Google Play, App Store, Steam, itch.io, Epic, GOG, direct download), an account is created automatically on the first connection to the server. On the web and on TikTok, it is only created if you ask for it; without an account, progress stays in the browser. It consists of an identifier randomly generated by the server and a token per device. No email address, password or name is requested. The server stores only a hash of the token. A temporary single-use code lets you link another device.
• Google sign-in: If you sign in with Google, in the game (Google Play Games) or on hyperpuck.net, Google gives us your Google account identifier and, for Google Play Games, your player identifier, the gamer name and the avatar address of your Play Games profile. We receive neither your email address nor your name. The gamer name and avatar are shown in your account; they are deleted if you detach Google Play Games. These identifiers let you find the same account on all your devices, and the Play Games identity shows that the game was installed from Google Play.
• Apple sign-in: If you sign in with Apple (“Sign in with Apple”), in the game on iPhone or iPad or on hyperpuck.net, Apple gives us an identifier specific to HyperPuck, used only to find your account. We ask for neither your name nor your email address. A sign-in from the App Store game also shows that the game was bought on the App Store. You can detach Apple from your account in Settings → Account, and remove access in your Apple Account settings.
• Game data and progress: Your progress profile remains on your device and the game works offline. During synchronisation, the server stores the last known version of the profile as a versioned JSON block so you can resume your progress on linked devices. Synchronised progress is not evidence for rankings, which are maintained separately by the game server.
• Account connections: The server sees your IP address and limits linking attempts per IP address. Service logs contain the request method, path, status and duration, never tokens, codes or profiles.
• Technical match data: Mallet control inputs (target coordinates) transmitted live to our servers to provide the deterministic 60 Hz physics simulation.
• Match replays: Match recordings, including single-player matches and matches with two players on the same screen, are sent for game analysis and balancing. They contain the inputs (target position at each tick), the pseudorandom seed and the match settings: they are not videos. The associated context file contains, among other things, the powers and the match score.
• Device name: A six-character device name randomly generated at first launch can be read in Settings → Device name and is associated with the replays and logs sent. It is not derived from any machine identifier or any information about the person; it is used to distinguish the files uploaded by different devices.
• Diagnostic logs and crashes: At the next launch, the full logs of previous sessions containing a script error or a crash marker (“SCRIPT ERROR”, “Program crashed”, “CrashHandler” or “handle_crash”) may be sent. Before sending, occurrences of the path to the game's data folder are replaced with user:/, and occurrences of the home folder indicated by the HOME variable with ~, if this variable contains a path longer than one character. No other masking is applied to the log contents.
• Updates and voice packs: Depending on the edition, the game checks for updates and offers to download them. It also downloads missing voice packs for the selected language. These requests do not send any personal data in their contents, but the server sees your IP address, as with any web request. The selected language can be inferred from the voice pack requested.

You can opt out of these uploads in Settings → “Send my matches and crashes”: disabling this option stops all replay and log uploads. This does not affect online play: an online duel always transmits inputs live, and the game server records the replay of every online duel (player inputs, seed, match settings), whether the option is enabled or not.

3. What we NEVER collect

• No precise GPS geolocation data.
• No access to your contacts, photos or personal files.
• No biometric data.
• No banking information: the current game does not offer any in-app purchases and does not collect any credit card numbers.

4. Purposes of processing

Your data is used exclusively to:

• Enable matchmaking and real-time online multiplayer matches.
• Save your progress profile between sessions and synchronise its last known version across your linked devices.
• Analyse match replays to balance the game.
• Ensure fair play and prevent cheating.
• Improve the game's performance and technical stability.
• Rebroadcast online duels on HyperPuck TV: a replay contains only the inputs and the match seed, with no player names or identifiers.

Legal basis. Processing of duels, replays and diagnostic logs is based on our legitimate interest (Article 6, paragraph 1, point f of the GDPR): operating online play, fixing its errors, balancing it and securing our servers. The account and profile synchronisation, linked to a randomly generated identifier, are based on the performance of a contract (Article 6, paragraph 1, point b of the GDPR): they are part of the game service you use. You can object at any time to sending replays and logs (Article 21 of the GDPR) using the “Send my matches and crashes” setting; for online duels, transmitting inputs and recording the replay are necessary for online play, which you can simply choose not to use to avoid them.

5. Data sharing and recipients

We do not sell, rent or transfer any personal data to data brokers or intrusive advertising third parties.

The data transmitted is intended for our hosting infrastructure. Currently, the game servers and the repository for replays and logs are hosted on a single server rented from Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, which acts as a hosting processor. No data is transferred outside the European Union.

6. Data retention

Your profile remains on your device; the server stores its last synchronised version. An account with no connection for 2 years is deleted. Deleting the account immediately removes the account, profile, tokens and codes from the server; deletion from the game also removes the account identity from the device, but not local progress. Uploaded replays and logs, as well as online duel replays, remain stored for one year on our server, then are automatically deleted.

7. Your rights (GDPR & international laws)

Under the General Data Protection Regulation (GDPR) and applicable regulations, you have the following rights:

• The right to access and obtain a copy of your data.
• The right to rectification if information is inaccurate.
• The right to permanent erasure of your data (“right to be forgotten”).
• The right to restrict or object to the processing of your telemetry data.

You can export your account as JSON and delete your account from the game in Settings → Account, or request this in writing at privacy@hyperpuck.net. In Settings → Account → Linked devices, you can revoke a device: its token can then no longer access the account. For uploaded replays and logs, specify the device name associated with your uploads, visible in Settings → Device name.

If you believe that your rights are not being respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr/fr/plaintes.

8. Protection of minors

HyperPuck is intended for a broad audience. No processing is based on consent: the age of digital consent (15 in France, Article 45 of the French Data Protection Act) therefore does not determine whether the game can be used. The data processed is the same for everyone and includes no name, contact details or position. Holders of parental responsibility can disable sending replays and logs in Settings, or request the erasure of a device's data at the address above.

9. Changes to this policy

This policy may be updated to reflect changes to the game's features or legal obligations. The date of the latest revision at the top of the page is authoritative.

HyperPuck account deletion

Request deletion of my account and its associated data