Privacy
STICKKEN is a free browser fighting game. There are no accounts, no sign-in, no payments and no advertising. We designed it to collect as little as possible. This page explains exactly what does get processed and why.
In short
- We don't ask for your email, real name or any account details.
- We don't set cookies.
- Our own analytics store only anonymous counts (for example, "40 matches started today"), never who did what.
- Online matches connect you directly to your opponent's browser, which means your opponent's browser can see your IP address. Details below.
What is processed today
When you play online (friend rooms and Quick Fight)
- Display name. Optional, up to 16 characters, set in the game's settings (default "PLAYER"). It is sent to our room server and shown to your opponent. Don't use your real name if you'd rather not share it.
- Room code and seat token. A random five-character code and a random token that proves which seat is yours. They're kept in the room's temporary state.
- Lobby state. Your chosen fighter, ready status and connection signalling messages (the technical data browsers exchange to connect to each other).
- Retention. A room is deleted when it has been idle for 30 minutes, when both players have been gone for 45 seconds, or after 2 hours at most. Matchmaking entries last only while you're in the queue (about a minute at most).
- Gameplay. Fight inputs travel directly between the two players' browsers. Our servers never receive them.
Peer-to-peer connections and your IP address
Online matches use WebRTC, a standard browser technology that connects you directly to your opponent. To do that, each browser learns the other's network address, including its public IP address. Anyone you play online can therefore see your IP address, as with most online games that use direct connections. To find a route through home routers, browsers contact public "STUN" servers run by Cloudflare and Google, which also see your IP address. We don't run a relay server, so your traffic isn't routed through us. If you don't want to share your IP address with an opponent, play against the AI or on your local network only.
Rate limiting and abuse protection
Our server uses your IP address in memory to stop abuse, such as someone creating thousands of rooms. Those counters are not written to storage and expire within 10 minutes. The matchmaking queue uses a daily-salted hash of the IP address instead of the address itself.
Anonymous usage statistics (first-party)
To learn whether the game is actually fun (do people finish a fight, come back for a second, invite a friend?), the website and game send short event notes such as "match started", along with a few fixed labels: the mode, the fighters picked, the AI difficulty, the result, and a coarse duration such as "1–2 minutes". Each event carries a counter ("first match this visit", "second match") and, if you arrived through a link like ?ref=reddit, that source label for this visit only.
- Not collected: names, emails, IP addresses, device fingerprints, advertising IDs, keystrokes, chat, precise location or gameplay recordings.
- Stored as counters only. The server adds events to daily totals and discards them. It never stores individual events, session identifiers or IP addresses. It records your country, as provided by our hosting network, only as one more count toward that country's daily total.
- Retention. Daily totals are kept for 90 days, then deleted.
- Off switch. Statistics are automatically off if your browser sends Global Privacy Control or Do Not Track. You can also turn them off here:
Cloudflare Web Analytics
If the site operator enables it, Cloudflare Web Analytics counts page views, referring sites, browser type and country. It doesn't use cookies or local storage and, according to Cloudflare, doesn't fingerprint visitors. Referral labels are removed from the address bar before it loads.
Stored only on your device
- Game settings, key bindings and saved replays (up to 30) are kept in your browser's storage (IndexedDB) so they survive reloads. They aren't sent to us. Replay share links keep the replay after the
#in the URL, a part your browser never sends to a server. - Website preferences: your motion setting and the statistics off switch (localStorage).
- This visit's statistics counters and referral label (sessionStorage). They're cleared when you close the tab or after 30 minutes of inactivity.
You can delete all of this at any time by clearing this site's data in your browser settings.
Service providers
- Cloudflare, Inc. hosts the website, the game files, the room server (Workers and Durable Objects) and the statistics counters. Like any web host, Cloudflare processes your IP address and request details to deliver pages and protect the service. Its platform logs are kept for a few days under Cloudflare's own policies. If Cloudflare's bot protection is switched on, Cloudflare may set a strictly necessary security cookie.
- Google runs one of the public STUN servers browsers contact when setting up a direct connection.
We don't sell data, and we don't share it with advertisers or data brokers.
Children
STICKKEN has no accounts and asks for no personal information, but it isn't directed at children under 13. Online play shows your display name to strangers and shares your IP address with your opponent. If you're a parent and have questions, please contact us.
Security
All connections use HTTPS or encrypted WebRTC. Room tokens are random and short-lived, inputs are validated, and our servers never trust a player's game client to report damage or results. No system is perfectly secure; see how to report a problem on the contact page.
Your choices and rights
Because we don't keep data that identifies you, we usually can't look anything up for "you". Your choices: turn statistics off (above), use any display name you like, avoid online play if you don't want to share your IP address with an opponent, and clear this site's storage to remove local settings and replays. Depending on where you live, you may have rights to access or delete personal data. Contact us and we'll help where we can.
Possible future changes
None of the following exist today. If we ever add any of them, we'll update this page before the change goes live:
- Advertising. The site has a disabled placeholder for it, and no ad provider is configured.
- A relay (TURN) server so players behind strict networks can connect. It would hide your IP address from opponents, but traffic would pass through that relay.
- Accounts, rankings or leaderboards.
Changes to this policy
When this page changes, we'll update the date at the top. For significant changes we'll also say what changed.
Contact
See the contact page.