ABYSSAL, Deep Sea Descent
Privacy Policy
ABYSSAL is made and operated by Tonye Brown. The short version: you can play the whole game without registering a pilot account. If you choose to create a pilot account, we keep a username or an email address, an optional hashed password and your game progress so they can follow you between devices. We do not collect your name (unless you type it into the contact form), phone number, contacts, photos or precise location, we run no advertising, and we use no third-party analytics or tracking software.
Playing without an account
Your progress, settings and run history are saved in local storage on your device. The game also sends first-party usage and diagnostic events to our own server (a random install number that is not tied to you, plus session and screen visits, visible time, navigation, dive progress, gameplay action counts and exits, Specimen Data earned or spent, performance and sanitized error locations) so we can see how many people play and balance the game. These records hold no account, name, email or device identifier and are deleted after 35 days; only aggregate totals are kept. Browser Do Not Track and Global Privacy Control disable this collection. Browser and operating-system categories, language, referring website hostname, and approximate country, region and city derived by Cloudflare from the connection are included. We do not store raw IP addresses or coordinates in analytics. Error messages, account details and full page addresses are excluded. Starting the game does contact our hosting provider, Cloudflare, which keeps standard server logs (IP address, requested file, time, device and software type) for a limited period to run and protect the service.
Optional pilot account
The Account screen lets you sign in with your email address (we email you a 6-digit code, and you can add a password) or register with a username and password. When you do, our backend (a Cloudflare Worker with a D1 database) stores:
- your username, your email address if you save progress with email, a salted PBKDF2 hash of your password if you set one (never the password itself), and the dates you registered and last signed in. Sign-in codes are stored only as a keyed hash and expire after 10 minutes. We use your email to send sign-in codes and replies you ask for, never for marketing;
- your cloud save: ships, crew, campaign progress, currencies, research and settings that live in the save file;
- scores you submit to the Sonar Net leaderboard, with a small run summary (world, depth, kills). Your username appears next to your score for other players;
- Fleet Hunt records: which private hunts you created or joined, your ship, join and last-seen times, and any hunt rewards you earned;
- reports you file about another pilot, and reports filed about you: the hunt, the two accounts involved, the reason and the time.
Usernames are checked against a word filter when you register and masked on display if they slip through. Fleet Hunt chat is limited to a fixed set of short preset callouts; those messages are relayed live to the other pilots in your hunt and are not stored.
Purchases
ABYSSAL sells optional items: purchased Specimen Data packs, permanent unlocks, and the Abyssal Pass, a monthly auto-renewing subscription. In the iPhone, iPad and Android apps these are sold through Apple's App Store and Google Play using the RevenueCat SDK. At abyssal.tonyebrown.com they are sold through RevenueCat Web Billing, with card payments processed by Stripe; the checkout asks for an email address and card details, which go to RevenueCat and Stripe, not to us. On iOS, purchases and Restore purchases do not require pilot registration. We use a separate purchase identity for guests to verify purchases and access their purchase wallet. For each purchase our server records a random customer identifier used for purchase verification, the store, the product, the store transaction identifier, quantity, purchase time and whether it was a sandbox or production purchase, plus the resulting purchased-data balance and what you spend it on. We also record which days you claimed the Abyssal Pass daily data. Payment details are handled entirely by Apple, Google or Stripe; we never see them. RevenueCat processes purchase receipts and device identifiers under its own privacy policy at revenuecat.com/privacy.
What we do not do
- No advertising, no ad identifiers, no advertising SDKs.
- No third-party analytics, crash reporting or behavioural tracking libraries. The anonymous usage counts described above stay on our own server.
- No selling or renting of any data, and no sharing except with the processors named above (Cloudflare for hosting, Resend for delivering sign-in codes and support replies, RevenueCat plus Apple, Google or Stripe for purchases).
- No phone, address, contacts, camera, microphone or precise location. Email only if you give it to us for your account or a contact message.
Contact messages
When you use the contact form we store your message, the topic, the email address you want a reply at, your name if you give one, your account if you are signed in, the platform, and a one-way hash of your network address used only to stop spam. We keep messages until the issue is closed and for up to a year after, and delete them with your account.
Children
ABYSSAL is a deep-sea arcade shooter made for teens and adults. It is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has registered an account, write to us and we will delete it.
Keeping and deleting your data
Account data is kept until you delete the account. You can do that at any time from inside the game (Account, then Delete account) or at abyssal.tonyebrown.com/delete-account. Deletion removes your account, cloud save, leaderboard entries, hunt records, reports, purchase mapping and purchased-data wallet from our servers, and clears that account's save from the device you delete from. Apple, Google, Stripe and RevenueCat keep their own transaction records, tied to the random customer identifier, as their policies and consumer law require. Hosting logs expire on Cloudflare's normal schedule.
Security
All traffic between the game and our servers uses HTTPS and secure WebSockets. Passwords are hashed with PBKDF2 and 100,000 iterations. Purchases are verified server-side against RevenueCat records before anything is credited; nothing is granted on the client's word.
Your choices and contact
Play as a guest to keep game progress on your device. Guest purchases and first-party usage events still use the services described above. Sign out at any time to stop cloud syncing. Delete your pilot account to remove its stored account data. Questions, corrections or requests: use the contact form. If we change this policy we will update the date at the top of this page.