NeonCrawl privacy policy
Effective · Last updated
1. Who we are and how to reach us
NeonCrawl is made by Yvan Boily, an independent developer in British Columbia, Canada. Yvan is NeonCrawl's Privacy Officer, and is responsible for the information described here.
Write to yvanboily@gmail.com about anything in this policy: a question, a request about your information, or a complaint. The same contact works wherever you live.
"We" and "us" in this policy mean Yvan. This policy covers the game at neoncrawl.ca. NeonCrawl Classic (classic.neoncrawl.ca) sends no play statistics.
2. The short version
- There are no accounts, no ads, no advertising cookies and no tracking across sites.
- Play statistics are off unless you turn them on in Options. If you do, they say how your runs go, linked by a random statistics id, never by your name. You can download or delete them at any time.
- Your saves and settings stay on your device. They are never sent.
- Feedback is public. A report you send from the Feedback dialog becomes a public GitHub issue. An email address you give us for a reply stays private.
- We never sell or share your information for advertising.
3. What we handle, why, and on what basis
Game saves and settings
- What: your runs in progress, saved floors, the graveyard of past heroes, your options, the hero name you last typed, and the choices you made on the hero creation screens. The full list is the storage table.
- Where: in your browser's own storage on your device only (IndexedDB
neoncrawl-savesand localStorage). None of it is ever sent to us or anyone else. - Why and basis: the game cannot keep your progress without it. This storage is strictly necessary for the game you asked to play, so it needs no consent.
Play statistics (only if you turn them on)
- Basis: your consent. Statistics are off until you tick Share anonymous play statistics in Options, under Privacy. Untick it at any time; anything not yet sent is dropped at once.
- What is sent, in everyday words (the appendix lists every field):
- When a run starts: the rules and game mode, the seed (a random seed as it is; a seed you typed or replayed only as a short scrambled code), your hero's species, background, class, fighting style and kit, how the ability scores were made, whether it was a Quick Start, your kind of device (phone, tablet or computer) and what you play with.
- When a run ends: how it ended, how deep you got, level, turns, gold, score, hit points, what killed the hero, kills, the features and options used, and the time played.
- For each floor: depth, layout, turns, kills, damage, items used, gold, how much was explored, and the way out.
- Choices: subclass, feats, ability increases, spells, shrine favours, fountains, and what you bought or sold.
- Each visit: when it started, active play time, how many presses of each input, screen class, whether the game is installed, browser and system family (never the full browser string), the hour on your clock, load time, the share of slow frames, and how far into making a hero you got.
- Errors: the first 160 characters of an error message, where in the game's scripts it happened, a short code to count repeats, and the save version. An error message is written by the game, but it may contain game text, such as an item's name.
- With every batch: the game's version and edition, a random id for this visit, and your statistics id.
- Your statistics id is a random value your browser makes the first time it sends statistics, after you turned them on. It groups the runs of one browser, and means nothing outside NeonCrawl. Treat it like a password: anyone who has it can download or delete the statistics stored under it.
- Country: Cloudflare, which runs our server, tells it the country your connection comes from. We keep only the two-letter code. Your IP address is not stored.
- Never sent: your hero's name or any other text you type, your IP address, your saves, and anything you write in the Feedback dialog.
- Why: to balance the game, see which features get used, learn how and where people play, and fix errors.
- Who sees it: only Yvan, on a private dashboard behind Cloudflare Access. The community lines on the death and victory screens show only totals from at least 20 runs, and are fetched only while statistics are on.
- Global Privacy Control: if your browser sends it, we honour it. Statistics stay off unless you turn them on yourself.
- Nothing is ever sent from a copy of the game opened from a file.
Feedback (optional)
- Basis: your consent when you send it, and our legitimate interest in reading and answering it.
- These become a public GitHub issue in the
ygjb/neoncrawlrepository:- your message and the kind of report;
- the diagnostics, only if you tick Attach diagnostics (it starts unticked): game version, screen, seed, depth, turn, game mode, the last 20 lines of the game's log (they can include your hero's name), your window size, and your browser's user agent string. What is sent in the dialog shows them before you send.
- Please don't put personal information in your message. It is public.
- Your email address, if you give one, goes privately to Yvan's Gmail through Cloudflare Email Routing, with a copy of the report. It is used only to reply to you, and is never published.
- The bot check: when you open the Feedback dialog, it loads Cloudflare Turnstile from
challenges.cloudflare.comto check you are not a bot. Turnstile processes your IP address, user agent and similar signals. Cloudflare is also a controller of those signals when it uses them to improve its bot detection. See Cloudflare's Turnstile privacy addendum. Turnstile is not loaded unless you open Feedback.
Hosting and security
- Basis: our legitimate interest in delivering the site and keeping it safe.
- Cloudflare serves the site and may process your IP address and request details (such as your browser and the page asked for) to deliver and protect it.
- Our own server code uses your IP address only to limit how many requests one connection can make (rate limiting). The count is held in memory for about a minute and the address is never stored.
- Request logs: Cloudflare's per-request logs, which would include your IP address, are turned off for our server. Our server's own log lines contain no personal information (no IP address, no statistics id, no email address) and are kept about 3 days.
- Cookies: the game sets none. Cloudflare may set strictly necessary security cookies (such as
__cf_bmorcf_clearance) when it needs to check traffic. Cloudflare Access sets a login cookie only for the developer, on the private/statsdashboard.
4. Storage on your device
Everything the game keeps on your device, in your browser's storage for neoncrawl.ca. None of it is a cookie, and only the two play statistics entries marked "Consent" are ever used to send anything. Clearing this site's data in your browser removes all of it.
| Name | What it holds | Needs consent? |
|---|---|---|
neoncrawl-saves (IndexedDB) | Your saved runs and their floors | No, strictly necessary |
| Offline copy (Cache Storage) | A copy of the game's own files (its page, scripts, styles and icons) so it opens without a connection. Nothing about you or your play; replaced by each new version | No, strictly necessary |
NEONCRAWL_AUTOSAVE_V1 | The run in progress | No, strictly necessary |
NEONCRAWL_MANUAL_SAVE_V1 | A run you saved yourself | No, strictly necessary |
NEONCRAWL_AUTOSAVE_OWNER | Which open tab owns the autosave | No, strictly necessary |
NEONCRAWL_SAVE_SYNC | A short note telling your other open tabs that a save changed | No, strictly necessary |
NEONCRAWL_GRAVEYARD | Your past heroes, how each was built (class, species, background, scores), and their epitaphs | No, strictly necessary |
NEONCRAWL_HEROES | Your last ten heroes who came home with the Amulet, and how each was built, so the town can show their statues | No, strictly necessary |
NEONCRAWL_NOVICE_STASH | The items a Novice hero left in the inn's chest, so the next Novice hero can take them; emptied when taken | No, strictly necessary |
NEONCRAWL_SEED_STATS | How your attempts at each seed went, and the hero of each, so a replay brings them back | No, strictly necessary |
NEONCRAWL_BONES | Floors left by heroes who died, to be found in later runs | No, strictly necessary |
NEONCRAWL_COMPENDIUM | What your heroes have discovered across runs (monsters, items, shrine favours and what was learned about them), and whether the whole Compendium is revealed | No, strictly necessary |
NEONCRAWL_COMPENDIUM_VIEW | How you last sorted and filtered each list of the Compendium | No, strictly necessary |
NEONCRAWL_MONSTER_AC | The Armor Class your heroes have worked out for each kind of monster from their attack rolls, across runs | No, strictly necessary |
NEONCRAWL_COMPENDIUM_VIEW | How you last sorted and filtered each list of the Compendium | No, strictly necessary |
NEONCRAWL_SHRINE_CODEX, NEONCRAWL_MONSTER_LORE, NEONCRAWL_CODEX_UNLOCKED | Older names for the discoveries above; read once, moved into NEONCRAWL_COMPENDIUM and deleted | No, strictly necessary |
NEONCRAWL_OPTIONS | Your options | No, strictly necessary |
NEONCRAWL_HERO_NAME | The hero name you last typed (never sent) | No, strictly necessary |
NEONCRAWL_TITLE_MODES | The game mode you last chose | No, strictly necessary |
NEONCRAWL_TITLE_SPECIES, NEONCRAWL_TITLE_SPECIES_CHOICE, NEONCRAWL_TITLE_ORIGIN2 | Your last species choices on the hero creation screens | No, strictly necessary |
NEONCRAWL_TITLE_BACKGROUND, NEONCRAWL_TITLE_BACKGROUND_INCREASE, NEONCRAWL_TITLE_INITIATE | Your last background choices | No, strictly necessary |
NEONCRAWL_TITLE_CLASS, NEONCRAWL_TITLE_KIT, NEONCRAWL_TITLE_SKILLS, NEONCRAWL_TITLE_MASTERIES | Your last class choices | No, strictly necessary |
NEONCRAWL_TITLE_STYLE, NEONCRAWL_TITLE_SKILLED | Your last feat choices | No, strictly necessary |
NEONCRAWL_TITLE_ABILITIES | Your last ability scores | No, strictly necessary |
Any of the above with _corrupt_latest after its name | A copy of data that could not be read, set aside so it is not lost | No, strictly necessary |
NEON_ROGUE_AUTOSAVE_V1, NEON_ROGUE_MANUAL_SAVE_V1, NEON_ROGUE_GRAVEYARD, NEON_ROGUE_SEED_STATS, NEON_ROGUE_OPTIONS, NEON_ROGUE_TITLE_MODES | Names used by very old versions; read once and replaced by the names above | No, strictly necessary |
NEONCRAWL_STATS_CONSENT | Your choice about play statistics (on or off, and when) | No: it records your choice |
NEONCRAWL_STATS_ASKED | That the play statistics window was shown, so it is not shown again | No: it records that you were asked |
NEONCRAWL_INSTALL_ID | Your statistics id, made only once statistics are on and first sent | Consent |
NEONCRAWL_TELEMETRY_QUEUE | Statistics waiting to be sent | Consent |
5. Who receives data
- Cloudflare, Inc. hosts the site, the server code, the statistics database and email forwarding, as our processor under the Cloudflare Data Processing Addendum, which includes EU-US Data Privacy Framework and Standard Contractual Clauses safeguards. For Turnstile's own use of its signals, Cloudflare is also a controller (see Feedback).
- GitHub, Inc. hosts the public feedback issues (
github.com). - Google LLC: Gmail receives the private feedback emails.
- No one else. We never sell your information or share it for advertising. There is no profiling and no automated decision-making about you.
The site links to other sites (GitHub, D&D Beyond for the System Reference Document, Creative Commons for its licence, and our other games). Nothing is loaded from them unless you follow a link, and their own policies apply there.
6. Where data is processed
- Your information is processed outside Canada: in the United States, and on Cloudflare's global network, which may handle a request in a data centre near you.
- While it is there, it may be accessible to the courts, law enforcement and national security authorities of those countries.
- For people in Quebec: your information may be communicated outside Quebec.
- For people in the EU, EEA, UK and Switzerland: transfers to Cloudflare rely on the safeguards in its Data Processing Addendum (the Data Privacy Framework and Standard Contractual Clauses).
7. How long we keep it
| Data | Kept |
|---|---|
| Raw play statistics: floors, choices, visits and errors | 180 days, then deleted |
| Run summaries | Anonymised after 180 days (the statistics id and the seed are removed), then kept |
| Daily totals | Kept; they hold no ids |
| Feedback emails | Up to 12 months, then deleted |
| Public feedback issues on GitHub | Public until closed or deleted at your request |
| Our server's log lines | About 3 days |
| Saves and settings on your device | Until you clear them |
The daily job that deletes and anonymises runs once a day, so data can outlast these limits by up to a day.
8. Your choices and rights
Everyone has the same rights here, wherever you live.
- Turn statistics on or off: Options, Privacy, Share anonymous play statistics.
- See, download and delete your statistics yourself: Options, Privacy shows Your statistics id once your browser has one, with Download my statistics (everything stored under it, as a file) and Delete my statistics (deletes all of it from our server, turns sharing off and forgets the id). Both work whether sharing is on or off.
- Reset my statistics id replaces the id; what was sent under the old one stays stored but is no longer linked to your browser.
- Clear local data: clearing this site's data in your browser removes your saves, settings and statistics id. Options also has Clear Codex, and the graveyard has Clear archive.
- By email: access, correction, deletion, portability, objecting, restricting, and withdrawing consent. Write to yvanboily@gmail.com and include your statistics id (Options, Privacy, Copy), so we can find your records. We reply within 30 days, at no charge. Statistics are stored under that id only, so without it we cannot tell which records are yours.
- Feedback: we remove a feedback issue or delete your feedback email on request.
- Withdrawing consent does not affect what was done before you withdrew it.
9. Children
- NeonCrawl is not directed to children under 13.
- If you are under 16 in the EU, or a child anywhere, please ask a parent or guardian before you turn on play statistics or send feedback.
- If we learn that something we hold came from a child without that permission, we delete it.
- Parents and guardians can write to yvanboily@gmail.com to ask what we hold or to have it deleted.
10. Security
- Everything travels over HTTPS.
- The statistics dashboard is behind Cloudflare Access, and the server checks the Access token again before answering.
- The keys the server uses have only the permissions they need (for example, the GitHub key can only work with issues, in NeonCrawl's one repository).
- We collect as little as we can: no names, no accounts, no IP addresses stored.
11. Breaches
If a breach of security affects your information and creates a real risk of significant harm, we will tell you as soon as we can, by email if we have your address and by a notice on this page and in the game's changelog otherwise. We will also notify the regulators the law requires, such as the Information and Privacy Commissioner for British Columbia, the Commission d'accès à l'information du Québec, or an EU or UK authority within 72 hours where that applies. We keep a record of every breach, whatever its size, for at least 24 months.
12. Complaints
Please write to us first at yvanboily@gmail.com; we will try to put it right. You can also complain to a regulator:
- British Columbia: the Office of the Information and Privacy Commissioner for BC, oipc.bc.ca
- Quebec: the Commission d'accès à l'information, cai.gouv.qc.ca
- EU and EEA: your local data protection authority
- United Kingdom: the Information Commissioner's Office, ico.org.uk
- Elsewhere: your local privacy regulator
NeonCrawl processes little data, occasionally and at low risk, so it has not appointed a representative in the EU or the UK (GDPR and UK GDPR Article 27(2)).
13. US state privacy notice
We do not sell or share personal information, and we do not use it for targeted advertising or profiling. We honour Global Privacy Control. The rights in section 8 are open to everyone, in every state.
14. Changes to this policy
When this policy changes, the "Last updated" date at the top changes and the change log below says what changed. Material changes are also noted in the game's changelog.
Change log
- : the storage table lists the Novice stash (
NEONCRAWL_NOVICE_STASH): the items a Novice hero left at the inn for the next Novice hero. This stays in this browser. - : the storage table lists the Walk of Heroes list (
NEONCRAWL_HEROES): the last ten victories and how each hero was built. This stays in this browser. - : the Compendium remembers how you sort and filter its lists (
NEONCRAWL_COMPENDIUM_VIEW). - : the storage table says that past heroes and seed attempts keep how each hero was built, so a replay brings them back. This stays in this browser.
- : the Compendium remembers how you sort and filter its lists (
NEONCRAWL_COMPENDIUM_VIEW). - : first version.
Appendix: exactly what play statistics send
For the curious: every field the game can send, by event. The server refuses anything else. Ids are short codes made of lowercase letters, digits, - and _, taken from the game's own tables, never from text you type.
| Event | Fields |
|---|---|
| Every batch | v, install (your statistics id), session (this visit's id), edition, version; each event has type, at (time) and seq (order) |
run_start | run, rules, mode_preset, modes, seed_kind, seed, species, species_choice, background, class_id, kit, style, ability_method, quick_start, device, input |
run_end | run, outcome, depth, max_depth, level, subclass, turns, gold, score, hp_max, hp_before_blow, killer_key, killer_kind, cause, floor_layout, kills, top_kills, counts, active_ms |
run_pause (save and quit) | run, depth, turns |
floor | run, depth, layout, theme, turns, kills, dmg_taken, dmg_dealt, potions, scrolls, wands, food, spells, rests, gold_delta, explored_pct, hp_end_pct, level_end, exit |
choice | run, kind, choice, detail, value, depth, level, turn |
session (a visit) | started_at, active_ms, inputs, viewport, standalone, browser, os, local_hour, slow_frame_pct, load_ms, funnel |
error | kind, hash, message (up to 160 characters), source, save_version |
| Added by our server | country (two letters, from Cloudflare) and the time the server received it |
Error reports are counted by day and version and are not stored with your statistics id, so they are not part of a download and are deleted after 180 days.