Privacy notice

Last updated: 9 November 2026

Tiny Fronts is a browser game. This notice explains what personal data is involved when you play, who can see it, and what you can do about it. It is written to meet the information duties of the EU/UK GDPR and the Swiss Federal Act on Data Protection (FADP).

Who is responsible

Sébastien Morand. Contact: sebastien.morand83@gmail.com.

Playing alone (campaign, challenges, editor)

Single-player modes run entirely in your browser. Your settings, progress, badges, campaign saves and custom maps are stored in your browser's local storage and are never sent to us or anyone else.

When you open the website, your browser downloads it from Cloudflare (Cloudflare, Inc.), which hosts the site, and the fonts from Google Fonts. Like any website, these servers receive your IP address and basic browser information to deliver the files, under their own privacy policies. The site uses no cookies, analytics or tracking.

Supporting the game (Buy Me a Coffee)

The website and the game may show a "Buy me a coffee" link. It is a plain link: nothing from Buy Me a Coffee is loaded until you click it, and it then opens Buy Me a Coffee's own site in a new tab. Any payment and any data you give there are handled by Buy Me a Coffee under its own privacy policy. We only receive what Buy Me a Coffee shares with creators, such as your name and message if you choose to share them.

Playing online (multiplayer)

Multiplayer connects your browser directly to other players' browsers (peer-to-peer). Tiny Fronts has no game server of its own and keeps no account or profile of you. To make direct connections possible, the following data is shared.

With other players

• Your nickname, shown to everyone in the same lobby, and in the lobby list if you host a public game.
• Your IP address and network connection details. A direct connection cannot be made without them. While you are on the multiplayer screen, your browser connects to the other players browsing games, so they can see your IP address too, not only your opponents.
• A random player ID created by your browser. It is sent to the host of a lobby so you can get your seat back after a disconnect. It is not linked to your identity.
• Your game moves, sent to the host of the match. The host's browser keeps a copy of the match in its local storage so the match can resume if the host reloads the page; it is deleted when the match ends.

With connection services run by third parties

• Public Nostr relays. Several independent, publicly run relay servers pass connection set-up messages between browsers. The content of those messages is encrypted, but the relays see your IP address and the time of your connection. The relays are run by their own operators, may be located anywhere in the world, and may keep their logs under their own rules.
• Cloudflare's STUN service (stun.cloudflare.com). It tells your browser its public IP address so a direct connection can be set up. Cloudflare receives your IP address for that purpose.

Why we process this data

• To provide the multiplayer feature you asked for (GDPR Art. 6(1)(b)). Without sharing your IP address and nickname, a direct online match cannot happen.
• To let you rejoin a match after a disconnect (legitimate interest, GDPR Art. 6(1)(f)).

You are shown a short notice before your browser connects to anyone. If you don't want to share this data, don't use multiplayer; everything else works without it.

International transfers

Relays and Cloudflare may process data outside Switzerland, the EU and the UK, including in the United States. Other players may be anywhere in the world.

How long data is kept

We store nothing on any server. Data in your browser stays until you delete it. Other players and third-party services keep what they receive under their own rules, which we do not control.

Your rights

You may have the right to access, correct, delete or restrict the processing of your data, to object, and to data portability.

• In your browser: you can delete everything at any time by clearing this site's data in your browser settings.
• Third parties: data held by other players or by third-party services must be requested from them.
• Questions: contact us at the email address above.
• Complaints: you may complain to your data protection authority, for example the Swiss FDPIC or the authority in your EU country.

Children

The game is not directed at children under 16. If you are under 16, ask a parent or guardian before playing online.

Changes

If this notice changes in a way that affects multiplayer, the game will show you the online notice again before connecting.