Privacy Policy

Last updated: October 27, 2026

This site is a beta game demo run by Ran Eilaty. This policy explains what happens with information when you use it.

What we collect

You can play without an account, and we never ask for payment details. If you create an optional account, see "Accounts" below.

Your game progress

Your progress and settings (skill tree, best waves, sound settings, chosen ship) are saved in your own browser's local storage, on your device. If you sign in, they are also saved to your account so you can play on several devices (see "Accounts" below). If you don't sign in, we don't receive them. You can delete them at any time by clearing this site's data in your browser; if you signed in, deleting your account deletes its copy too.

Game statistics (Google Analytics)

To see how the game is played and improve it, the game sends anonymous gameplay events to Google Analytics: for example when a run starts and ends, which wave it reached, which map, difficulty and ship you chose, which cards, upgrades and Devil deals you picked, which settings you changed and which menu buttons you used. We also get general device and location information (country, city level) that Google Analytics collects. We don't send your name, email or account ID. Google Analytics uses cookies (_ga) to tell visits apart. If you're in the European Economic Area, the UK or Switzerland, these cookies are only used if you agree in the consent message. How Google uses this data: https://policies.google.com/technologies/partner-sites. You can block it with Google's opt-out add-on: https://tools.google.com/dlpage/gaoptout.

Toot Tots (hqbg.ai/toottots) sends the same kind of anonymous gameplay events: when a match starts and ends, the mode, map and match settings, which baby was picked, pukes and flag captures, and whether online connections worked. No names, emails or account IDs.

Ads and cookies

We use, or may use, Google AdSense to show ads. Google and its partners use cookies and similar technologies to serve ads, limit how often you see them, measure them, and, where allowed, personalise them based on your visits to this and other websites.

• How Google uses this information: https://policies.google.com/technologies/partner-sites
• Turn personalised ads off: https://adssettings.google.com
• Other ad vendors' opt-out: https://www.aboutads.info/choices

If you're in the European Economic Area, the UK or Switzerland, you'll be asked for consent before personalised ads are used.

Hosting

Like any website, our hosting provider may automatically log technical data such as your IP address, browser type, and the pages you visit, for security and to run the site.

Children

The Service isn't directed at children under 13, and we don't knowingly collect personal information from them.

Accounts (optional)

You can play without an account. If you create one (with Google or an email and password), we store your email address and your game save (skill tree, levels, bests, settings and unlocked skins) so you can play on several devices. They are stored with our database provider, Supabase. You can delete your account and its save at any time from the game: tap your player name on the main menu → Delete account.

Leaderboard. If you're signed in, your best score on each leaderboard is posted to the public world leaderboard together with your player name (and, for co-op runs, your teammate's player name). Your email address is never shown. Deleting your account deletes your leaderboard entries too.

Leaderboard without an account. If you're not signed in and set a new best, you can post it to the public world leaderboard under a nickname you choose. It's linked to a random ID stored in your browser, not to you; we only keep a scrambled (hashed) form of it. If you later sign in on that device, those scores move to your account. Clearing your browser data removes the link.

Game statistics. When a run ends, the game sends an anonymous summary of it — difficulty, map, waves, score, time, kills, the cards and abilities used and similar game details, your game version and device type (phone or computer) — linked to that same random ID and, if you're signed in, to your account. We use it only to balance and improve the game. It contains no name or email. You can turn it off on a device by opening the game once with ?notrack at the end of the address.

Payments

Purchases are handled by our reseller Paddle.com, the Merchant of Record for all our orders. Paddle processes your payment, billing details and taxes under its own privacy notice (paddle.com/legal/privacy). We don't see or store your card details. We only store which items your account owns (and Paddle's transaction reference), so your skins work on every device you sign in on.

Online co-op

When you play Online co-op, your device connects directly to your teammate's device so the game can run between you. As in most online games, this means each of you can see the other's IP address. To introduce the two devices, the game sends a few short technical messages (a room code and connection details) through our hosting provider's realtime service (Supabase, via Lovable Cloud). These messages are not stored and contain nothing you type, except the player name you chose. There is no chat and no voice. If you use Google Analytics consent, we also count anonymous events such as "an online game connected" or "a connection failed", to improve the game.

If your two devices can't connect directly, the game is passed through Cloudflare's relay service for that session; it carries the game data only and does not store it. To protect the relay from abuse we keep, for 30 days, a scrambled fingerprint of your internet connection (never the address itself), when the relay was used and how much.

Toot Tots, Boom Box and Tagroo online games use the same 6-digit room codes and the same relay.

Your choices and requests

Questions, or a request about your information: Battlerwave@gmail.com

Changes

We may update this policy by posting a new version on this page.