Privacy

Epic Online Services - online multiplayer

Clanker Calamity uses Epic Online Services (EOS) for account authentication and online multiplayer.

When you use online multiplayer, Clanker Calamity requests the Basic Profile and Online Presence permissions associated with your Epic account. The game uses your Epic display name to identify you to other players, and uses the account identifier provided through EOS to associate you with your multiplayer session. Clanker Calamity does not request access to your Epic friends list, and there is no friends panel anywhere in it.

When you host a shift, Clanker Calamity sends multiplayer lobby information through EOS. This may include the join code, the route identifier, the number of seats, the programming time, and, when applicable, an identifier used to resume an interrupted match.

During multiplayer, game state and player display names are exchanged as necessary to operate the match. None of it is written to a server of ours, except where it appears in a diagnostic log as described below.

How Epic account data is handled

Captured. When you sign in, Clanker Calamity receives the account information covered by the two permissions it asks for. In practice that is your Epic display name and your account identifier. Online Presence is requested so the game can mark a shift you host or join as your presence lobby; the game reads nobody's presence information, including your own.

Used. Your display name identifies you to the other players in a shift, and is the name an uploaded diagnostic log is filed under. Your account identifier associates you with the session you are in, and is how the host recognizes you as the same person if your connection drops and you come back to your seat.

Shared. Your display name and the match information necessary to operate the session are exchanged with the other players participating in that session. Your account identifier is provided to the host as necessary to associate you with your seat and recognize you if you reconnect. Isolation Inc does not sell Epic account data, and does not share it for advertising, profiling, or data-broker purposes.

Retained. Clanker Calamity does not persist your account identifier as part of your player profile, saved match records, or other normal game data, and it does not store presence information at all. Your display name may appear in a diagnostic log and in that log's filename. If your Epic account has no display name, an account identifier string may appear there instead. Uploaded diagnostic logs are retained by Isolation Inc for at most 30 days.

For information about Epic Games' privacy practices, see the Epic Games privacy policy.

Steam - the store, the Workshop and achievements

Clanker Calamity is distributed through Steam. Steam is used for game distribution, Workshop publishing, and achievements. For information about Valve's privacy practices, see the Steam privacy policy.

Achievements. When you earn an achievement, Clanker Calamity sends the achievement identifier to Steam. The game may also query Steam for the achievement's unlock state so it does not announce the same achievement twice. Clanker Calamity does not send gameplay scores or general gameplay statistics through this feature.

The Workshop. If you publish a route you built, Clanker Calamity sends Steam the route file, a preview image generated from that route, the title, and the description. The route file itself contains the floor you created and its name. Clanker Calamity does not add your name or Steam account identifier to the route file itself. Clanker Calamity creates a new item as public, and if you change its visibility on Steam afterwards the game leaves your choice alone.

For information about Valve's privacy practices, see the Steam privacy policy.

When playing another person's route, Clanker Calamity queries the local Steam client for Workshop items available to the game and reads the downloaded route files from disk. Publishing, subscribing, unsubscribing, and Workshop visibility are provided through Steam.

Our own server - playtest logs

This is the part that exists because the game is in playtesting, and the part most likely to change before release.

A playtest build may upload a diagnostic log to a server we run at build.clankercalamity.com. It may do so when you ask it to, by pressing the button that sends a log; and it may do so on its own, without asking, when something has gone wrong that you would otherwise have to describe from memory - a sign-in that failed, a shift that could not be hosted or joined, a host hand-over that failed, or a benchmark run finishing. If another player in your shift sends a log while you are hosting, your machine may send one too, because the record of what actually happened in the match is on the host's machine.

And it uploads on its own after a crash. If the game closes without shutting down properly, the next time you start it the previous session’s log is sent, because that log is where the crash is. You can turn this off: Settings, Display, Send crash reports. With it off nothing is sent automatically after a crash; the button and the command-line switch still work when you ask for them.

A log that is sent may contain:

• the most recent part of the game's log file, and part of the previous session's, which is where a crash is;
• your Epic display name; if the signed-in Epic account has no display name, an account identifier string may be used instead; if you are not signed in, your computer's name;
• the technical settings the game is running with, the build number, your graphics card and its driver version;
• a record of the match: the route, the join code, and the display names of everyone in it, including names typed on a phone controller;
• the game's own record of matches played on this machine - the floor as it was built, and what every unit did step by step. If you played a route you made, the floor you made is in there;
• file paths from your machine, which on Windows normally include your Windows user name, because the game writes down where it loaded your routes from.

It does not contain your Epic password, your Steam credentials, your email address, or anything you have typed outside the game.

On our server, an uploaded log is stored as a file whose name is made of the date and time, the name above, the IP address it was sent from, and a word saying why it was sent. It is read by the game's developer and by the tools the developer runs, through a password-protected page. It is not published, and it is not given to anybody else.

The diagnostic-log server uses Cloudflare infrastructure.

If a build ships with no upload address configured, the button is hidden and nothing is sent at all.

Party Play - playing with a phone as a controller

Party Play lets people in the room use a phone as a controller. The host's game opens a room on a relay server we run, and shows a code and a QR code. The QR code contains the address of the join page and that room code, and nothing else - no id for you, your machine or your session. A room code is six digits: the first says which relay node the room is on, so the phone knows where to connect, and the other five are drawn at random.

Before the room opens, the host's game asks the join site for the current list of relay nodes and then times a small request to every node so it can pick the closest one. So the join site and all of the relay nodes see the host's connection, not only the one that ends up being used. None of this happens unless a Party Play match is started.

The join page is a single page with nothing loaded from anywhere else: no fonts, no analytics, no trackers, no cookies. On the phone it keeps two things in the browser's own storage, which stay on that phone: a token that lets it rejoin the room it was in, and the name you type, so you do not have to type it again next time. Clearing your browser's site data for the page removes both.

What a phone sends is the room code, that token, an optional name you choose, and your moves - your color, your chassis, the cards you pick. The name is the only identifying thing on this path, and you choose it. That name is shown to the other players in the shift, and can appear in a diagnostic log as described above.

The relay's job is to pass messages between a phone and the host's game. It does not open them - it cannot read what a phone sends or what the game replies. It writes nothing to disk: the room, its players, the tokens and the IP addresses it is holding exist only in memory, only while the room is open, and are gone when it closes or when the relay restarts. A room with no game attached closes after a couple of minutes, and no room lives more than half a day.

Two things around the relay do keep something, and this page would be wrong not to say so. The web server in front of each relay node writes an ordinary access log, which records the IP address of each connection; those logs are rotated and the old ones discarded. And while a room is open, the person operating the relay can see, on a password-protected page, the rooms that are open and the IP addresses currently in them - this is how somebody abusing a room gets removed from it.

The Party Play join page and relay services use Cloudflare infrastructure.

The playtest checklist site

Organized playtests use a separate checklist site at mptest.clankercalamity.com. It is not part of the game, and you only ever see it if you are asked to.

Signing in there is a name and nothing else - no password, no email, no account. That name is kept in a cookie on your own device so you do not have to type it again, and it is stored on the server as the name of your checklist. What is stored beside it is what you fill in: the build you played, the roles you took, your input device, what machine and what connection you were on, and pass, fail or skip with any notes for each step. Notes are free text, so what ends up in them is what a tester chooses to write - please do not put anybody's personal details in one.

The results are readable by the developer through a password-protected page. Because a name is the only credential, anybody who knows the name a tester used can open that tester's own checklist; treat it as a shared clipboard rather than as a private one. The playtest checklist site uses Google Fonts. For information about Google's privacy practices, see the Google privacy policy.

Crash reports

Playtest builds include Unreal Engine's crash-reporting component. In the current Clanker Calamity configuration, no remote destination is configured by us for that component, so these crash reports remain local unless the separate Clanker Calamity diagnostic-log process described above is used. If that ever changes, this page changes with it.