Privacy Policy
info.airstraf.ing · Last updated: 2026-10-18
This page explains which personal data we process when you visit info.airstraf.ing and play the game, why we need it, how long we keep it and what your rights are.
1. Controller
info.airstraf.ing is a private, non-commercial project. The controller is its operator, reachable at contact@airstraf.ing. Please send every privacy request to this address.
2. In short
- You can play as a guest without an account, or create an account.
- We use no advertising or analytics services and no tracking cookies.
- Fonts and images come from our own servers, not from third parties.
- To fight abuse (cheating, ban evasion) we keep IP addresses for a limited time, see section 8.
- While you play, the game checks its own page for modified browser functions and foreign scripts, and reports findings for a person to review, see section 8.
- Some account data is public in the game, see section 6.
3. Hosting and infrastructure
When you open the site and play, your IP address, the date and time, the requested address and information about your browser are processed because this is technically necessary to deliver the site, connect you to a game server and fend off attacks (Art. 6(1)(f) GDPR: legitimate interest in a secure and stable service).
| Service | Provider | Purpose |
|---|---|---|
| DNS, CDN, website (Cloudflare Pages), DDoS protection | Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Delivering the site and the game files, passing connections on to the game servers, protection against attacks |
| Game servers | netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany | Servers in Nuremberg (Germany) and in Manassas, Virginia (USA). You play on the server with the best ping unless you choose a region. |
| Database, sign-in, file storage | Supabase, Inc., 970 Toa Payoh North #07-04, Singapore (data centre: Frankfurt am Main, Germany) | Accounts, progress, shop, leaderboards, bans |
| Sending confirmation e-mails | Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA | E-mails to confirm an account and to reset a password |
We have data processing agreements with these providers (Art. 28 GDPR). Where data goes to the USA (Cloudflare, Resend, the game server in Virginia), this is based on the European Commission's standard contractual clauses or on an adequacy decision (EU-US Data Privacy Framework) where the provider is certified under it. If you play on the server in the USA, the connection data and the game data of that match are processed there.
4. Playing as a guest
Without an account you need no e-mail address. Your progress (settings, statistics, guest inventory) is stored in your browser. So that guest progress can be carried over when you sign up later, your browser creates a random guest key that the game server checks in matches. During a match the game server processes your player name, your inputs and positions and your IP address. Legal basis: Art. 6(1)(b) GDPR (providing the game) and Art. 6(1)(f) (security).
5. Account
For an account we store your e-mail address, your username and your password (only as a hash, we cannot read it). We send you an e-mail to confirm the address. Your e-mail address is never shown to other players and is never used as your name. On top of that we store what comes from playing: level, statistics, rank and Elo, match results, best times, unlocked items and settings, friends and clans, messages in your inbox and your profile look (picture, banner, name style, clan tag). Legal basis: Art. 6(1)(b) GDPR. We keep this data until your account is deleted; write to us to have it deleted.
6. What other players can see
A game with leaderboards and friends shows some of your data to others:
- Everyone (also visitors without an account): your username, clan tag, badges and name style, profile picture and profile cosmetics, the date your account was created, your level, rank and Elo, your statistics (for example kills, deaths, accuracy, wins, matches and playtime), your kills per class, whether you are online or in a match, your place on leaderboards and your best times on courses, including the recorded path of top-100 runs.
- Signed-in players in addition: your KP balance, your Elo history and the members of your clan.
- In a match or party: your name, look, position and actions, and your chat messages.
Your e-mail address, your IP addresses, ban details and security data are never public. Legal basis: Art. 6(1)(b) GDPR (the public profile is part of the game).
7. Chat and reports
Chat messages go to the other players in the match, the party or the global chat. A word filter replaces disallowed words with asterisks. Messages the filter changed are stored for 30 days together with the account or name, to improve the filter and to check reports. When you report a player, we store your report and its evidence (for example the last chat lines). Legal basis: Art. 6(1)(f) GDPR (protecting players, enforcing the rules).
8. Security, cheat detection and bans
To keep the game fair we run technical checks and keep security data for them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fair game without abuse and in enforcing bans).
| Data | Purpose | Kept for |
|---|---|---|
| Sign-in log with IP address and browser identifier | Detecting abuse, enforcing bans, detecting second accounts | 90 days |
| List of the IP addresses of an account | Enforcing bans, detecting ban evasion | until the account is deleted |
| Network details of IP addresses (provider, country, data centre or VPN) | Detecting ban evasion | 180 days after the address was last seen |
| Cheat indicators (account, match, measurements) | Detecting cheating, justifying bans | 180 days |
| Integrity findings (account or guest id, match, names of changed browser functions, a fingerprint and a short excerpt of a foreign script, its address, browser type) | Detecting client modifications, reviewed by a person (no automatic decision) | 180 days |
| Match recordings (account IDs and names of the players, no addresses) | Reviewing suspected cheating and reports | 90 days, longer only for a ban or a report |
| Bans (account, IP address) with the reason | Enforcing the rules | for the duration of the ban, then as evidence until claims expire |
Most checks run automatically. A ban is imposed automatically only for clear violations; you can object by e-mail, and then a human reviews the case.
Integrity checks in your browser
While you play, the game checks on the game page whether browser functions it relies on have been changed (for example the functions that draw the game or read your input) and whether a foreign script was added to the page. This helps us keep the game fair against cheats that modify the running game. The check runs only on our own game page; it does not read other sites, your keystrokes or the page content, and it cannot block or remove browser extensions.
If the check finds something, it sends a small report to the game server, which stores it with your account (or, as a guest, the random key your browser uses for your progress), the match you were in, the names of the changed functions, a fingerprint and a short excerpt (at most about 2 KB) of the foreign script with its address, and your browser type (for example “Chrome”; never your full browser identifier). Nothing else about your device or your browsing is collected. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a fair game). We keep these findings for 180 days. They never lead to an automatic ban or kick on their own – a person reviews them before any action is taken.
9. Storage in your browser
The game stores settings, key bindings, guest progress, your sign-in session and your own images (for example for the crosshair) in your browser's local storage (localStorage, IndexedDB). A service worker keeps game files in the browser cache so the game loads quickly. This is necessary for the service (§ 25(2) no. 2 TDDDG); we set no cookies for advertising or analytics. You can delete this data in your browser settings at any time.
10. Links to other sites
The About page links to other sites (for example Kour.io, Poxel.io and our Discord server). Nothing is loaded from them until you click a link; after that, their own privacy policies apply.
11. Recipients
Apart from the processors named above, we only pass data on when the law requires it or when it is necessary to pursue violations of the law.
12. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to contact@airstraf.ing. You can also complain to a data protection supervisory authority, for example the one where you live.
13. Minimum age
The game is meant for people aged 16 and over. Younger people do not create an account.
14. Changes
We update this policy when the game or the law changes. The version published here applies, last updated: 2026-10-18.