Legal

Privacy Policy

This policy explains what information KTHX collects, how we use it, and the choices you have. We designed the Service to collect as little as possible.

Last updated July 27, 2026

This document describes the current devnet preview of KTHX, which is free to play and does not enable real-value wagering. It is provided for transparency and may be updated as the product evolves; it is not legal advice.

Summary

  • We do not use cookies, and we do not use any advertising trackers. We measure site traffic with our own first-party analytics, described below.
  • Most of what personalizes your experience is stored locally in your browser, not on our servers.
  • Gameplay analytics identify players only by a one-way hash, never a raw identifier.
  • Blockchain activity you choose to perform is public and permanent by design.

Information we collect

Identity and account

  • A device fingerprint generated in your browser to create a guest identity, and an optional email if you choose to provide one.
  • A session token, stored on our servers only as a hash, to keep you signed in.
  • A player id and display name derived at signup.

Gameplay

  • Your callsign (a cosmetic display name, limited to 12 alphanumeric characters). It is stored locally and shared with other players in your match for presence; it is never part of match settlement.
  • First-party gameplay telemetry (for example match start/end and in-game events). Player identifiers in telemetry are hashed - telemetry contains no name, email, IP, or wallet address.

Wallet and on-chain

  • If you connect a wallet, we process its public address to enable devnet features. We never receive your private keys or seed phrase. Signing a message to reserve a seat proves wallet control only and moves no funds.

Network and support

  • Your IP address is used to rate-limit abusive traffic, and it is recorded by our traffic analytics (described below) for up to 30 days. If you message us through the contact form, your IP is included in the message we receive so we can investigate abuse.
  • Traffic analytics. We run our own analytics on infrastructure we operate (hosted for us by Technomancy.IT, our service provider); no data is sold or shared with advertisers. For each visit we record the pages you view, how long you stay, what you click, the referring site, your browser and device family, your coarse location (country and city), and your IP address. The IP address and location are deleted after 30 days; the remaining page statistics, which identify your browser only by a hash that cannot be reversed, are deleted after 400 days.
  • When you use the contact form, we collect the name, email, and message you provide so we can respond.

Cookies and local storage

We do not set cookies. We use your browser’s local storage to remember preferences and your guest identity on your device, including: theme and display mode, your guest fingerprint and session, your callsign, and game preferences such as volume, colors, and control settings. Our traffic analytics keeps a random visit identifier in session storage, which your browser discards when the tab closes and which is never shared across sites. You can clear any of this at any time in your browser.

How we use information

  • To operate the games, matchmaking, presence, and (on devnet) escrow features;
  • To keep you signed in and sync your profile and progression;
  • To protect the Service through anti-cheat verification and rate limiting;
  • To respond to your support requests.

Where information is stored

  • Your device: preferences, callsign, guest fingerprint and session (local storage).
  • Our servers: accounts, profiles, hashed sessions, rate-limit counters, and telemetry live in an ephemeral key-value store (Redis, or in-memory in development) with limited retention. We do not operate a traditional marketing database.
  • The blockchain: escrow custody, match rosters, and settlement commitments you create are recorded on Solana and are public and permanent.
  • Content addressing / IPFS: settled-match replay artifacts may be stored as content-addressed data.

Sharing and third parties

We do not sell your personal information. The Service interacts with these third parties to function:

  • Solana RPC providers to read and submit blockchain transactions;
  • Phantom (or your chosen wallet) to connect and sign;
  • Jupiter, if you opt into swapping a payout;
  • Switchboard for verifiable randomness;
  • Our self-hosted real-time relay, which passes only gameplay frames and your callsign (there is no chat);
  • An email provider and/or a private webhook we use to receive and answer messages you send through the contact form.

Anything you write to the Solana blockchain is public and outside our control once submitted.

Your choices

  • Clear your browser’s local storage to remove your preferences, callsign, and guest identity on that device.
  • Disconnect your wallet at any time.
  • Contact us to request access to or deletion of account data we hold. Note that information recorded on the blockchain is immutable and cannot be deleted.

Children

The Service is not intended for children and is not directed to anyone under the age of majority in their jurisdiction. We do not knowingly collect information from children.

Changes

We may update this policy; the “Last updated” date above reflects the latest version. Material changes will be communicated through the Service.

Contact

Questions or privacy requests? Contact us.