This policy explains how IATPM Arcade at iatpm.com handles information when you play, save a score, or create an optional account. For questions or requests, contact Nick at Unbounded Solutions: nick@unbounded.solutions.
01 Accounts & email
You can play and submit scores as a guest without providing an email address. If you register, we collect your email address, chosen nickname, and password. Your email identifies your account and lets us send email-confirmation links, password-reset links, password-change notices, and other messages needed to operate or secure your account and this site. Email confirmation is optional and does not prevent play or sign-in.
We do not display your email publicly, send marketing emails, or sell your email address. We store a salted password hash to check sign-ins, rather than storing your password in readable form. Password-reset links contain a temporary, single-use credential; treat them as private.
You can change your nickname from your account using your current password. Account-linked scores display your current nickname. We keep previous nicknames reserved to prevent others from using them.
When you are signed in, new saved scores use your account nickname automatically. Registered nicknames are reserved: guests must sign in to use one or choose another nickname. Choose a nickname you are comfortable making public, and avoid putting your email, real name, or other private information in it.
02 Public scores
Submitting a score makes its nickname, score, country flag when available, submission time, and game statistics available through the public leaderboard and score APIs. Squid Sling entries also include the three throw distances and public nickname records such as longest throw, bounces and saved rounds. Boards show one best score per normalized nickname; repeated guest names share a public position without gaining account access. Guest nicknames appear in grey on the scoreboard. We keep an internal account reference for scores saved while signed in; your email and internal account reference are not included in public score responses.
The country flag comes from Cloudflare’s approximate IP-based country information when the score is saved. We do not ask for precise device location. Registering does not claim old guest scores, even when their names match your nickname. An administrator can link explicitly owner-confirmed aliases to an account while preserving an internal audit and original score history.
Saved scores and their game records help maintain fair rankings. Site administrators can review them and hide confirmed abusive entries while retaining their history. Crust Panic score notifications also send the public score details to the site operator through our mail service.
03 Cookies & your device
- Staying signed in
- An essential account cookie remembers your sign-in. It can last up to 400 days from its latest renewal and renews as you use the site, so regular visits keep you signed in. It is HttpOnly, uses same-site protection, and is sent securely over HTTPS. Logging out ends that browser’s account session; changing or resetting your password revokes existing account sessions and outstanding reset links. Your browser’s privacy rules, clearing site data, or private browsing can end a session sooner.
- Owning a game round
- A separate essential
arcade_browsercookie binds ranked rounds to the browser that started them, including for guests. Its configured lifetime is 30 days. It is HttpOnly, uses strict same-site protection, and is sent securely over HTTPS. - Local preferences
- Your browser’s local storage remembers a guest’s preferred name, sound settings, the local Squid Sling best score, and whether you dismissed the account-registration invitation. These stay until you or your browser clear them. They are separate from your saved server scores and account.
- Visit measurement
- The production game pages use Google Analytics cookies, described below. The account and privacy pages do not load our analytics tag.
04 Game security
To verify scores and reduce automated abuse, the server processes game inputs, timing, round identifiers, and verification results. We store game state and hashes of browser ownership tokens. Game request limits use daily-changing hashes derived from the IP address Cloudflare supplies. Account request limits use hashes of IP addresses and email, account or reset-token identifiers to limit repeated registration, sign-in and password attempts. These hashes are security identifiers; they should not be treated as completely anonymous.
Our database does not store raw IP addresses or raw browser ownership tokens. Cloudflare receives IP addresses and other network information to deliver and protect the site. When enabled, its Turnstile check runs at score saving, and our server sends the challenge token, round binding, and requesting IP address to Cloudflare for verification.
05 Site services
We use these services to run the arcade. They receive the information needed for their functions and may process information in countries other than yours:
- Cloudflare hosts the site, Worker APIs, and D1 database, and provides network security. Turnstile processes signals such as IP address, browser details, and site origin for bot detection and to improve its protection. Read the Cloudflare privacy policy and Turnstile privacy addendum.
- Google Analytics 4 measures page visits and scrolling on the production game pages. Google receives cookie identifiers, device/browser information, and usage information. Our tag removes query strings and fragments from page URLs and referrers, disables advertising signals, and does not send nicknames, emails, passwords, score-form values, or game-session identifiers. Local development and PR previews do not load the tag. Read Google’s privacy policy and its Analytics cookie explanation.
- Our Mailu mail service sends account-service and password-recovery messages through
im.iatpm.com. Email delivery processes your address and the message content; your own email provider also handles messages we send you. Crust Panic score alerts go to the site operator and do not include account email addresses.
We do not sell personal information or use account email addresses for advertising. We may disclose information when necessary to respond to a valid legal requirement, protect the service, or investigate abuse.
06 Keeping information
We do not set a fixed automatic deletion date for account details. Account sessions expire or are revoked, and player-requested password-reset credentials expire after 30 minutes. Administrator-created account invitation links expire after seven days. Email-confirmation credentials expire after 24 hours and are bound to the current email address and credentials. We store confirmation status and only hashes of these temporary tokens. Expired session, confirmation and reset records, and account attempt-limit records older than one day, are cleaned up in batches during later accepted account requests. Expiration prevents their use; it does not promise that every related database row or mail record disappears immediately.
Saved leaderboard entries and their supporting game, ownership, moderation, and notification history do not have a fixed automatic deletion date. Unsaved game sessions and ownership records become eligible for cleanup after one day; cleanup happens during later game starts and may take longer to clear a backlog. Locally stored preferences follow your browser’s storage settings.
Service-provider records and delivered email may have different retention periods. If you request deletion, we will review what can be removed and explain any information that needs to be kept for security, an unresolved dispute, or a legal requirement. We do not promise immediate removal of copies already made from a public leaderboard.
07 Your choices & contact
You can continue as a guest, log out on a shared device, reset your password, and clear site cookies or local storage through your browser. Clearing an essential cookie can sign you out or prevent an unfinished ranked round from being saved. Clearing site data does not delete an account or a score already stored on the server.
You can block Analytics with browser controls or Google’s Analytics opt-out browser add-on. The games do not require Analytics to work.
To request access, correction, or deletion of your account or score information, or to raise a privacy concern, email nick@unbounded.solutions. Include your nickname and the relevant game or score. We may ask you to confirm control of the account email or provide other reasonable ownership evidence before making a change. Never send your password or a password-reset link.
We will post policy changes on this page and update the effective date. Questions about a child’s account or information can also be sent to the same contact address.