PRIVACY · LAST UPDATED 2026-08-24

WHAT RUN THE INTERNET STORES

Players do not need accounts. An essential signed cookie creates a random device identifier for official attempts, qualified-click deduplication, visit sessions, and abuse controls. The raw cookie token is not a name, email address, or third-party advertising identifier.

Game data

We store a hashed device identifier, your chosen display name, score, run duration, daily competition identity, monthly course seed, physics version, jump and slide input timings, sparse trajectory samples, death cause, verification result, and timestamps. Verified official runs may appear on the leaderboard, in recorded runner ghosts, challenges, and aggregated death statistics.

Browser-only data

Your display-name preference, personal best, and milestone progress may also be stored in your browser. Clearing site data removes those local preferences but does not reset server-enforced daily attempts.

Security and retention

Rate-limit subjects are HMAC-hashed before storage; raw IP addresses are not stored by the application. Run and challenge records are configured for 90-day retention. Essential session cookies may last up to one year. Infrastructure providers may retain short-lived security logs under their own policies.

Visits, presence, and outbound clicks

A visible session separated by 30 minutes of inactivity counts as a visit. “Online now” means a visible heartbeat within two minutes. A property click can qualify once per signed device every rolling 24 hours; known bots, invalid sessions, duplicates, and bursts do not qualify. Click and visit device hashes are anonymized after 31 days while aggregate counts remain.

Buyer accounts and commercial processing

Buyers provide an email for one-time-link authentication plus listing ownership, website, approved creative, colors, revisions, contribution intents, ledger records, and payment-provider identifiers. Logos are normalized to WebP and stored privately until approved. Resend handles login email, the configured payment provider handles payment data, and the configured private-object, hosting, database, and logging providers act as subprocessors.

Questions or deletion requests

Authenticated buyers can identify their account by email. Players should provide a device token only through the configured private support channel; never post it publicly. Eligible data and private objects are deleted or anonymized after identity and legal-hold checks, and the result is verified. Contact: privacy@runtheinternet.lol.

This operational privacy notice requires owner and jurisdiction-specific legal approval before a public launch.