Privacy notice

Who is responsible

Ian Warwick, trading as Ship Software Games, operates Sci-Fi Space Battle (SFSB) and its Community website and is responsible for the personal information described here. Ship Software Games is the developer brand.

For privacy requests, account help or a complaint, email privacy@shipsoftware.ai or use our public contact route. You do not need to sign in to read these pages or make a request.

Epic sign-in and game ownership

What we collect and how

When you choose Epic sign-in or explicitly link an Epic account, our server receives and verifies your Epic account identifier, access and refresh credentials where issued, their expiry times, and the application and environment information needed to verify them. We connect that verified identifier to your SFSB Operator. When official access depends on ownership, we request an ownership check for SFSB and record its result and check times. We do not request email or friends-list permissions, and we do not receive your Epic password or payment-card details.

Why we use it

We use this information to sign you in, keep your selected account connected, renew authorized sessions, check official-play access and prevent conflicting or replayed account claims. Your SFSB career and clan history remain attached to your internal Operator rather than a storefront. We do not merge accounts by email or display name.

How long we keep it

The provider-to-Operator link and account-setup acknowledgements remain for account continuity, access control and dispute handling. Stored provider credentials are encrypted. Deactivation removes them and unfinished authentication from live account records but retains the private identity link to prevent a disabled identity from registering again. Ownership observations can authorize access for no more than five minutes, may remain as historical records until replaced or cleaned up, and are cleared from live account records on deactivation. Older database pages and recovery backups may still contain encrypted credentials; the backup retention criteria below apply.

Access and deletion

Use Account → Download my data to obtain your retained provider identifier, link dates, policy acknowledgements and ownership observations alongside your SFSB records. Credentials and other people’s private records are excluded. Contact privacy@shipsoftware.ai to request access, correction or deletion or if you cannot sign in. Deactivating SFSB does not delete your Epic account or revoke authorization at Epic.

See Hosting, recipients and other services for sharing and international-transfer information, and How long information remains for the full record and backup retention criteria.

Information we use

Your account and linked devices

Your internal account and Operator identifiers, public handle, sessions, security events and the friendly names you give linked game clients. Accounts that use a Community passphrase have a one-way passphrase verifier. Accounts created through a supported sign-in provider do not need a separate Community passphrase. We record account-setup dates and the versions of the game licence you accept and privacy notice you acknowledge. Community registration does not ask for an email address.

Linked sign-in providers and official access

If you use an enabled external sign-in provider, we receive its stable account identifier, authentication credentials and their expiry times. We keep the link to your SFSB Operator and protect stored provider credentials with encryption. Where access depends on a purchase, we ask a supported store whether that account owns SFSB and record the result and check times. We also retain authorised invitation grants and revocations. These checks do not give us your payment password, card details or full purchase history.

Your official career

Official servers send a summary after a completed battle: participation, team, result, contributions, penalties, game and map versions, and evidence needed to verify the result. Accepted summaries support profiles, standings, permanent career points, awards and corrections. Community does not receive your realtime input stream or precise per-tick movement history as part of that result record.

Community activity

Board posts and threads, clan membership, invitations and requests, name/tag reports, moderation decisions and related account or clan actions. Free text may contain information you choose to supply; please keep personal information out of public posts.

Support and service protection

Messages and diagnostic details you send for help, plus private recovery, moderation, security and service-audit evidence. Live connections necessarily use network addresses to deliver the service; that does not mean those addresses are included in the Community battle record.

We obtain account and Community content from you, sign-in and ownership evidence from the provider you use, verified battle summaries from official servers, and reports or administrative decisions from other Operators and authorised staff. You can browse these pages without an account. Authentication and an authorised invitation or verified ownership from a supported store are needed for official play; accepted battle records are needed for official progression. Without that evidence, official access may be unavailable. Local and LAN play are separate. Public posting and clan participation are optional.

Purposes and lawful bases

The bases below apply to the described service. We do not treat reading this notice as consent.

Providing the service you request — contract

Creating and authenticating your account, linking a sign-in provider or game client at your request, checking official-play access, maintaining your official career, and carrying out the Community and clan actions you request.

Protecting and operating the service — legitimate interests

Preventing cheating and abuse, keeping accounts and infrastructure secure, maintaining reliable results, moderating content, resolving disputes and diagnosing faults. These interests are balanced against your privacy and rights.

Required records and lawful requests — legal obligation

Keeping or disclosing information where an applicable legal requirement requires us to do so.

We do not sell your personal information or use it for advertising. If we introduce a use that needs consent, we will ask separately and explain how to withdraw it.

What other people can see

Other players can see your public handle, eligible profile and standings, public Board content and relevant clan information. Avoid using a real name as your handle if you do not want it displayed.

Private reports, recovery details and staff evidence are restricted to authorised staff. A report is not a private chat service. Only share information needed to investigate the issue.

Career points and clan eligibility use game rules and accepted results. These automated game calculations do not make decisions about employment, credit or other real-world entitlements. Contact support if you believe a result or restriction is wrong.

Cookies, downloads and presence

The website uses an essential sign-in cookie when you authenticate. It is protected from page scripts and expires with its server-issued sign-in session, normally seven days after sign-in. Signing out invalidates that browser session; it does not sign out your other devices or the external provider.

External sign-in uses additional essential cookies to keep the return from the provider bound to your browser and requested action. A sign-in or action-confirmation attempt lasts up to five minutes; unfinished new-account setup lasts up to fifteen minutes and may end sooner if its proof expires. Completing or cancelling the flow clears its temporary cookies. These policy pages work without JavaScript and do not themselves create sign-in cookies.

If you choose to remember your account in the game, its SFSB credential is stored using the operating system's credential storage. The game does not store your provider password. You can sign out or remove a linked client; removal from the service invalidates that client's access even if a local copy remains.

Download statistics count successful transfers and bytes by day, release, file and full or partial response. They do not count unique people and contain no account, cookie, IP address, user agent or referrer. A resumed download can produce several partial transfers. The download page can use a coarse Windows/macOS hint in page memory to order choices; it does not send or store that hint.

Players online uses fresh official-server human counts. It does not publish a list of accounts or create a Community presence history.

Community request logs omit client addresses, query strings, headers, cookies and bodies. Hosting, network and mail providers process connections under their own applicable arrangements; these application limits do not describe every provider's logs.

Hosting, recipients and other services

Authorised staff and service providers may process the information needed to host, secure, back up and support SFSB. The Community service is hosted with Akamai Cloud in London. Encrypted recovery backups are stored separately in Akamai Object Storage in London, with an additional encrypted copy held on the operator’s external drive. Tailscale is used for private network access. Support email uses Namecheap Private Email, whose published hosting location is Phoenix, United States. Messages to support, privacy and security aliases share the same monitored mailbox. Information may also be disclosed where law requires it or where necessary to protect people and the service.

Purchases, payments and refunds through a store are subject to that store’s terms and privacy notice. The external sign-in provider currently configured for SFSB is Epic Games. Epic sign-in is currently configured for authorized development testing. General Epic account access depends on completion of Epic brand review. Our integration sends authentication and SFSB ownership-check requests to Epic Games. It does not send your SFSB match results, Board posts or clan activity to Epic. The hosting, support, network and recovery providers described below process the information needed to operate the service. Epic has its own privacy relationship with you; see its privacy notice for that processing. Read the Epic Games privacy policy.

Your SFSB Operator, career and clan membership belong to the same internal account whichever supported sign-in method you use. Linking an existing account requires you to authenticate that account and choose the link. We do not merge accounts by email address or display name. An authorised invitation or ownership from any supported store can satisfy the access check; using these pages does not require an Epic account. Further providers need their own accurate disclosure before activation.

A UK hosting location does not mean that every provider processes information only in the UK. The providers publish their processing and international-transfer arrangements in the Akamai data processing agreement, Tailscale data processing addendum and Namecheap data processing addendum. Contact privacy@shipsoftware.ai for information about the safeguards applicable to your information.

How long information remains

Credential expiry, account closure and deletion of stored records are different. We use the following retention criteria; a request for deletion is considered against the purpose and any applicable legal requirement.

Accounts and official careers

While your account and the service remain active, we keep the identity and accepted result evidence needed to provide your account and permanent career, investigate disputed awards and make corrections. Permanent careers are not temporary alpha scores and do not routinely reset with an alpha epoch.

Board and clan content

Content and related actions remain while needed to provide the Community record, membership history and moderation. Closing an account does not automatically remove all authored text or shared clan content. Tell us if text contains personal information that needs removal.

Security, moderation and support

Records remain while needed to resolve a request, investigate abuse, protect accounts, establish what action was taken or meet a legal obligation. A continuing dispute or security incident may require relevant evidence for longer than an ordinary support request.

Sign-in credentials and unfinished setup

Browser sessions normally expire after seven days and one-use game-link codes after ten minutes. Current game sessions use five-minute access credentials, renewable for up to seven days without activity and no more than 30 days from sign-in. Older linked-client credentials last up to 30 days. Provider credentials have the provider's expiry times; we may refresh them for the sign-in and ownership checks you use. Unfinished external account setup expires within fifteen minutes. Expiry or revocation prevents use but does not by itself erase a stored row or backup.

Linked identities, policy records and access checks

We retain the provider-to-Operator link, account-setup acknowledgements and invitation history for account continuity, access control and dispute handling. Deactivation removes stored provider credentials and unfinished authentication from the live account records, but retains the private identity link to prevent a disabled identity registering again. It does not close the external account or revoke credentials at that provider. Ownership observations authorize access for no more than five minutes and may remain as historical records until replaced or cleaned up; deactivation clears the live ownership observations.

Result delivery

Handle-bearing sent-result files have a bounded verification window, normally 24 hours, configurable from one hour to 30 days. Pending or rejected delivery evidence needs separate investigation and is not covered by that automatic cleanup.

Diagnostics, aggregates and backups

Operational logs and recovery copies remain for service investigation and recovery. Container logs rotate by size, so their age depends on service activity rather than a fixed deletion date. Host snapshots and encrypted cloud backups use a 14-day retention window. Host snapshots keep at least seven copies; cloud backups keep at least seven distinct backed-up days, so missed runs can retain older recovery points. The independent encrypted external-drive copy is kept for recovery and reviewed separately; host or cloud pruning does not delete it. Incident evidence may remain while needed to investigate an issue or meet a legal obligation. Daily download totals contain no account-level record.

Your information and your rights

Use Account → Download my data for a JSON copy of your account, accepted match and career records, and your Board and clan activity. It also includes your retained provider identifiers and link dates, account-setup policy acknowledgements, invitation history and ownership-check observations, including expired observations still held. It excludes credentials, secrets and other people's private staff evidence. Contact support for a fuller access request or if you cannot sign in.

You may request access, correction, erasure, restriction or portability where those rights apply. We may need proportionate verification of your identity before sharing information or changing an account. Do not send identity documents unless we explain why they are necessary and how to send them privately.

Your right to object: you can object to processing based on legitimate interests by contacting us and explaining your situation. If we rely on consent for a particular use, you can withdraw that consent.

Deactivation revokes access and removes your old handle from public profiles and standings. Retained Board posts are attributed to Former Operator. Opaque identifiers, result evidence, private audit records and backups may remain. Older database pages and recovery copies can still contain encrypted credentials. This is de-identification, not a promise that every copy is erased or fully anonymous.

If you have a concern, contact us through Support. You may also complain to the UK Information Commissioner's Office, or your local supervisory authority where applicable.

Age and family safety

The current Community account policy is not for children under 13. Operators aged 13–17 should participate only with a parent or guardian's permission. Do not post a child's real name, address, school, phone number, email or precise location. Contact us privately if a child has supplied personal information or needs account help.

A game's content age rating is separate from this account policy. We do not claim that issuing an invitation verifies someone's age.

Changes to this notice

The version and effective date appear at the top of this page. We will explain material changes before introducing new uses where required. A future store integration or additional data collection will need an updated notice describing what actually changes.