What we do with your data

01Who is responsible

Aegix Play is a project run by ITR, a cybersecurity consultancy based in Zaragoza. ITR is the data controller for everything described on this page. The corporate site is ip-sac.com and has its own privacy policy covering ITR’s consultancy work; this notice covers aegixplay.com only.

02What we use your data for

These are the only purposes. They are not a general list copied from a consultancy’s policy — each one corresponds to something this site actually does.

What we do not do

We do not advertise, and we do not let anyone advertise here. We run no analytics: there is no Google Analytics, no pixel, no tag manager, no heatmap, no session recording. We do not profile you, we make no automated decisions that produce legal effects, and we do not sell, rent or share personal data with third parties for their own purposes.

Playing does not subscribe you to anything. The report ends with an invitation to request a security assessment from ITR; that is an ordinary link, and following it is your decision. Until you write to us, nobody from ITR will contact you because you played a game.

03What we actually store

If you never sign in

One row describing the game, and nothing else: the scenario, whether you survived, your grade, shields left, blocks, hits, money spent, budget left, elapsed time, a random identifier for that single game, and the date. There is no name, no email, no address and no identifier that leads back to you.

If you sign in with Google

Google tells us three things about you, and only three, because those are the only ones we ask for (openid, email, profile):

• your Google account identifier — an opaque number, not your password;
• your email address;
• the name on your Google account.

To that we add, only if you choose it, the display name you type for the leaderboard and whether you consented to it being shown. We also record when your account was created here and when you last signed in.

We never see and never receive your Google password. The authentication happens on Google’s servers. We are told the outcome, not the credentials.

Technical data

To limit abuse, the server keeps your IP address in memory, paired with the route you called, for at most sixty seconds. It is never written to the database. Separately, our hosting provider keeps its own web server logs, as any hosting provider does; those logs are the provider’s and are covered by its own terms.

Identity and performance are kept apart

This is a deliberate design choice, not an accident of implementation. Who you are lives in one table; what you did lives in another, joined by an internal number. When an account is erased, the link is destroyed and the game statistics survive without it. That is what erasure has to mean when the statistics still need to work.

04Cookies and browser storage

All three cookies are first-party, HttpOnly (JavaScript cannot read them), SameSite=Lax and Secure.

Storage that is not a cookie

• ax_game in local storage — a spare copy of that same finished game, used only if the cookie above does not survive the trip. It expires after 30 minutes and is deleted as soon as it is used.
• ax_reloaded in session storage — a flag that stops the page reloading in a loop after we publish a new version. It contains a version number and nothing else.

How to get rid of them

Every browser lets you view and delete cookies and site data for a single site, usually under Settings → Privacy. Deleting ax_session signs you out immediately; it does not delete your account or your results. You may also block cookies for this site entirely: the game will still work from beginning to end, but you will not be able to sign in, and therefore not able to open the full report.

05Who else is involved

Google

Only if you click sign in. At that moment your browser goes to Google, you authenticate there, and Google returns the three items listed above. If you never click it, this site makes no request to Google at all. Google’s handling of that authentication is governed by Google’s own privacy policy. Google may process data outside the European Economic Area under the safeguards it publishes for international transfers.

The typefaces on this site used to be loaded from Google’s servers, which sent every visitor’s IP address to Google before they had agreed to anything. They are now served from this domain. That transfer no longer happens.

Hosting

The site and its database run on infrastructure provided by Hostinger, which acts as our processor: it stores the data on our behalf and under our instructions, and does not use it for its own purposes. Where its infrastructure involves processing outside the European Economic Area, that is governed by the safeguards in its data processing terms.

Nobody else

There is no third party beyond those two. No advertising network, no analytics provider, no email platform, no customer data platform.

06How long we keep it

These deletions are automatic. The site runs the check once a day and removes whatever has passed its date, without anybody having to remember. Deleting an account also deletes the results attached to it.

07Your rights

Under the GDPR and Spanish data protection law you may ask us to give you a copy of your data, correct it, erase it, restrict what we do with it, object to processing based on legitimate interest, or hand it to you in a portable format. Where we rely on your consent — which is only the case for showing your name publicly — you may withdraw it at any time, and withdrawing it does not affect what was lawful before.

You can switch the leaderboard consent off yourself, immediately, from the checkbox on the arena page. For anything else, write to privacidad@ip-sac.com from the address you signed in with, so we can be reasonably sure it is you. We will answer within one month.

If you think we have handled your data badly, you are entitled to complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). We would rather you told us first, but that is your choice and not a condition.

08Age

This site is not aimed at children. You must be at least 14 years old to sign in, which is the age at which Spanish law allows a minor to consent to the processing of their own data. Anyone of any age can play without signing in, because doing so involves no personal data. If you believe a child under 14 has created an account, write to us and we will delete it.

09How we protect it

• The whole site is served over HTTPS.
• We never handle your password. Google does the authentication.
• Session cookies are signed and verified in constant time, so the signature cannot be guessed by measuring how long a check takes.
• The rules of the game run on the server, so a game result cannot be forged from the browser.
• Requests are rate limited to make bulk abuse impractical.
• Email addresses are never included in the leaderboard, in any API response, or in anything a visitor can reach.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a weakness in this site, please tell us at contacto@ip-sac.com. We will take it seriously and we will not come after you for reporting it in good faith.

10Permitted use

What you may do

• Play as often as an arena allows, alone or with your team.
• Share your result and your report, including at work, as a training exercise or a conversation starter.
• Quote the report, provided you make clear where it came from and that it is the output of a game.

What you may not do

• Alter, forge or replay the signed tokens that carry the game state, or otherwise attempt to record a result you did not earn.
• Play automatically, or call the API by script, in order to extract the scenarios, the wave composition or the scoring formula.
• Deliberately overload the service, or work around the rate limits.
• Probe, scan or attack the site. Reporting a weakness you found by accident is welcome; going looking for one without asking us first is not.
• Choose a display name that insults anyone, impersonates a real person or organisation, contains someone else’s personal data, or that you would not want shown to a room full of strangers.

We may remove a display name without warning, and we may withdraw access from anyone who does the things in that second list. The leaderboard is a small pleasure and we intend to keep it usable.

11Changes to this notice

If what we do with data changes, this page changes with it, and the date at the top changes too. Two kinds of change, treated differently:

• Wording. A clearer sentence, a corrected typo, a new phone number. The date changes and the version does not. We will not interrupt you for it.
• Substance. A new purpose, a new recipient, new data collected, a longer retention period, a different legal basis. The version number changes, and if you have an account you will see a notice on this site the next time you visit, saying what changed, with a link back here. It disappears once you have seen it and does not come back.

That notice is information, not a consent form. Being told about a change is not the same as agreeing to it, and we will not pretend otherwise by putting an “I agree” button on something that is simply an announcement. If a change ever needs your consent, you will be asked for it properly, and you will be free to say no.

History