Privacy Policy
1. Who is responsible for your data
Vexstorm Studios operates Tripo GameForge and is the data controller for everything described in this policy. We are based in New Castle, Delaware, United States of America.
The fastest way to reach us about anything in this policy — a question, a request to see or delete your data, or a complaint — is support@vexstorm.com. We are a small studio and we read it ourselves. Our full postal address is available on request by email, and we will supply it to any data protection authority or other regulator that asks for it.
Tripo is the 3D model provider and our event partner. Tripo is not a data controller for this service and does not receive player data. What Tripo does receive is described in section 7.
2. You can play without giving us anything
When anyone plays, the game sends one anonymous ping so we can count how many people played and how often they came back. That ping contains the game type and version, the event it was played on, and one-way cryptographic hashes of your IP address and browser user-agent string. A one-way hash cannot be reversed back into an IP address. We use these only to tell repeat plays from new ones. There is no login, no name, no email, and no advertising identifier in that ping.
3. Children’s privacy
You must be at least 13 to create a GameForge account. If you live in the European Economic Area or the United Kingdom, the minimum is the digital age of consent set by your own country, which in some countries is higher than 13.
Before you can create an account we ask for your birth month and year on a neutral screen. We do not store your date of birth. We work out which rules apply to you, record only the resulting age band (and, for 13–15-year-olds, the country you told us, because that is what the answer depended on), and discard the month and year.
If you are too young to hold an account where you live, we will not create one and we will not ask you for an email address, a name, or anything else about you. You can still play the whole game. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to support@vexstorm.com and we will delete it.
If you are 13 to 17 and allowed to hold an account, we ask you to confirm that a parent or guardian knows about the account and agrees to it, we tell you plainly that your display name will be public, and we leave the optional Discord field empty and never require it.
4. What we collect if you create an account
| What | Why |
|---|---|
| Email address | To verify your account, sign you in, and send account and event emails. It is never shown publicly. |
| Password | Stored only as a one-way bcrypt hash. We never store or log your actual password. |
| Display name | Shown publicly on the leaderboard. Choose something you are happy for others to see. |
| Discord username (optional) | Shown publicly if you supply it, so an event organiser can reach a winner. You never have to give one. |
| Age band and, for 13–15-year-olds, country | To apply the right minimum-age rule. Your date of birth is not stored. |
| Parent/guardian acknowledgement (under 18 only) | To record that a guardian agreed to the account and to the public display name. |
| Consent record and policy version | So we can always show which version of these documents you agreed to, and when. |
| Your runs and scores | Score, time remaining, health remaining, whether you finished, and when. This is what a leaderboard is. |
| Sign-in sessions | Held server-side as one-way hashes of a session token so you stay signed in and can sign out everywhere. |
| Security audit records | Sign-in and score-submission attempts, with hashed IP and user-agent, to detect abuse and defend a disputed result. |
5. What is public
Your display name, your Discord username if you gave one, your score, and your run statistics appear on the public leaderboard for the event you played. Nothing else does. Your email address is never published.
6. How long we keep it
Account data is kept for 730 days (24 months) after your last sign-in. After that, the account is anonymised automatically: the email address, password, sign-in sessions, verification tokens and Discord username are removed, and the display name becomes “Deleted Player”.
Past scores are kept after anonymisation. Once the account behind them is anonymised they no longer identify anyone, and removing them would rewrite the results of a competition other people also took part in.
7. Who we share it with
We do not sell your data, and we do not share it with advertisers. GameForge runs on infrastructure operated by Vexstorm Studios and sends email through our own mail provider so verification and reset messages can reach you. That is the whole list.
No player data is sent to Tripo. The only figures shared with Tripo are aggregate event metrics with no personal information in them — how many plays an event had, how many were repeat visitors, and which game type and version they used. There is no name, no email, no display name and no reversible identifier in that data.
8. What we do not do
- No advertising. There are no ad networks, no ad identifiers and no ad tracking anywhere on this site or in the game.
- No profiling. We do not build behavioural profiles and we make no automated decisions with legal or similarly significant effects.
- No AI training on your data. Your account details, your runs and your scores are never used to train any machine-learning model, ours or anyone else’s.
- No third-party trackers. This site loads no external scripts, no external fonts and no content delivery network.
9. Cookies and local storage
We set one cookie, gf_session, and only after you sign in. It holds a random
session token and nothing else, and it exists purely so you stay signed in. There is no
analytics or advertising cookie.
Your browser’s local storage holds two small items: the identifier of any site notice you have dismissed, and the outcome of the age question — the age band, the country if it was needed, and the policy version. Your birth month and year are never written to local storage.
10. Your rights and how to use them
Depending on where you live you may have the right to access, correct, delete, restrict or object to our use of your data, and to data portability. You can exercise the main ones yourself, immediately, from My Account:
- Get a copy of your data — “Download my data” gives you everything we hold about you as a JSON file.
- Delete your account — deletion is scheduled 7 days ahead and you can cancel it at any point in that window. After it runs, the account is anonymised exactly as described in section 6.
- Correct your details — you can change your display name and Discord username from your profile.
For anything else, including a complaint, write to support@vexstorm.com. If you are in the EEA or the UK you also have the right to complain to your national data protection authority, and you may do so without contacting us first.
11. Security
The site is served over HTTPS. Passwords are stored only as bcrypt hashes; session tokens, email-verification tokens and password-reset tokens are stored only as SHA-256 hashes, so a copy of our database does not yield a usable token. The database itself is kept outside the public web root. No system is perfectly secure, but we do not store anything we do not need.
12. Changes to this policy
Each version of this policy carries a version string, shown at the top of this page, and the version you agreed to is stored with your account. If we make a material change we will publish the new version here and raise that version string.