ABYSSAL, Deep Sea Descent
Privacy Policy
ABYSSAL is made and operated by Tonye Brown. The short version: you can play the whole game without giving us anything. If you choose to create a pilot account, we keep a username, a hashed password and your game progress so they can follow you between devices. We do not collect your email, name, phone number, contacts, photos or location, we run no advertising, and we use no analytics or tracking software.
Playing without an account
Your progress, settings and run history are saved in your browser or the app's local storage on your device. Nothing about your play is sent to us. Loading the game does contact our hosting provider, Cloudflare, which keeps standard server logs (IP address, requested file, time, browser type) for a limited period to run and protect the service.
Optional pilot account
The Account screen lets you register with a username and password. When you do, our backend (a Cloudflare Worker with a D1 database) stores:
- your username, a salted PBKDF2 hash of your password (never the password itself), and the dates you registered and last signed in;
- your cloud save: ships, crew, campaign progress, currencies, research and settings that live in the save file;
- scores you submit to the Sonar Net leaderboard, with a small run summary (world, depth, kills). Your username appears next to your score for other players;
- Fleet Hunt records: which private hunts you created or joined, your ship, join and last-seen times, and any hunt rewards you earned;
- reports you file about another pilot, and reports filed about you: the hunt, the two accounts involved, the reason and the time.
Usernames are checked against a word filter when you register and masked on display if they slip through. Fleet Hunt chat is limited to a fixed set of short preset callouts; those messages are relayed live to the other pilots in your hunt and are not stored.
Purchases in the apps
The iPhone, iPad and Android apps sell optional one-time items (purchased Specimen Data packs and unlocks) through Apple's App Store and Google Play, using the RevenueCat SDK. To buy, you need a pilot account so the purchase can be attached to you and restored later. For each purchase our server records a random customer identifier (not your username or a device identifier), the store, the product, the store transaction identifier, quantity, purchase time and whether it was a sandbox or production purchase, plus the resulting purchased-data balance and what you spend it on. Payment details are handled entirely by Apple or Google; we never see them. RevenueCat processes purchase receipts and device identifiers under its own privacy policy at revenuecat.com/privacy.
What we do not do
- No advertising, no ad identifiers, no advertising SDKs.
- No analytics, crash reporting or behavioural tracking libraries.
- No selling or renting of any data, and no sharing except with the processors named above (Cloudflare for hosting, RevenueCat plus Apple or Google for purchases).
- No email, phone, address, name, contacts, camera, microphone or precise location.
Children
ABYSSAL is a deep-sea arcade shooter made for teens and adults. It is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has registered an account, write to us and we will delete it.
Keeping and deleting your data
Account data is kept until you delete the account. You can do that at any time from inside the game (Account, then Delete account) or from the web page at deep-sea-shooter-2026.pages.dev/delete-account. Deletion removes your account, cloud save, leaderboard entries, hunt records, reports, purchase mapping and purchased-data wallet from our servers, and clears that account's save from the device you delete from. Apple, Google and RevenueCat keep their own transaction records, tied to the random customer identifier, as their policies and consumer law require. Hosting logs expire on Cloudflare's normal schedule.
Security
All traffic between the game and our servers uses HTTPS and secure WebSockets. Passwords are hashed with PBKDF2 and 100,000 iterations. Purchases are verified server-side against RevenueCat records before anything is credited; nothing is granted on the client's word.
Your choices and contact
Play as a guest and nothing leaves your device. Sign out at any time to stop syncing. Delete the account to remove everything we hold. Questions, corrections or requests: www.tonyebrown.com@gmail.com. If we change this policy we will update the date at the top of this page.