Privacy notice
Last updated: 2 October 2026
MapMuddle is a free geography game operated by a solo developer. You can play without an account, password, or email sign-up. The operator is the controller for MapMuddle gameplay, support delivery, and voluntary report records. Contact: patrick@mapmuddle.com.
Account-free identity and gameplay
- Browser token. The browser creates a random token in local storage. It is sent in an HTTPS Authorization header for game and privacy APIs, or the first WebSocket join message—never deliberately in a URL. The raw token is not stored server-side.
- Pseudonymous identifiers. The server uses a secret-keyed HMAC to derive separate identifiers for scores, multiplayer rooms, and supporter-device links. Purpose separation reduces linkage if one data set is exposed; these identifiers and the underlying records can still be personal data.
- Nickname and scores. Nicknames are optional for solo play and visible on leaderboards when attached to a best score. Room players see room nicknames, room-only player ids, turns, scores, and connection state. Do not use a real name. The server stores continent, country accuracy values, derived score, mode, status, and timing; it does not need solo drawing geometry.
- Multiplayer. Submitted geometry is processed and stored by the room service, then shared with authorized room participants so they see the same board.
Browser storage and cookies
MapMuddle does not set application cookies and does not use IndexedDB or sessionStorage. Local storage keys beginning mm_ hold the browser token, resumable solo progress, and pending result outbox. They are necessary for account-free identity and recovery. The privacy centre can reset all of them. It then creates a new browser identity; that reset does not delete already-saved server data.
Automated results
Game rules calculate accuracy, scores, ranks, capacity limits, and abuse checks automatically. They affect gameplay and leaderboard display, not access to employment, credit, healthcare, education, or another legal or similarly significant service. You can contact the operator if a result appears wrong.
Diagnostics and voluntary reports
There is no Cloudflare Web Analytics beacon. On server failure, MapMuddle’s custom event contains only a schema number, release label, handler name, and fixed error code. It excludes tokens, ids, nicknames, drawings, report content, URLs, and raw exceptions. Cloudflare may still process platform-generated request and security metadata. Production account settings and retention must be checked before release.
A bug report is assembled only after you open the report tool. You preview ten predefined fields and may remove recent action names before pressing Send. Reports exclude free text, identity/authentication values, URLs, raw errors, bodies, drawings, screenshots, keystrokes, fingerprints, and session replay. They use a separate request without the game bearer token and are retained for seven days plus a normally 15-minute bounded-cleanup delay. Provider or database failures can delay physical deletion.
Supporters
Ko-fi and its payment providers handle purchases under their own terms. Ko-fi sends MapMuddle a verified transaction reference and delivery email. The address and activation message pass to Resend but are not stored in MapMuddle’s application database or custom diagnostics. Resend states 30-day email/log retention on applicable plans and seven-day backup retention. MapMuddle stores a purchase reference, one-way activation-token digest, delivery state, and purpose-separated linked-device identifiers. Activation is available for 365 days on the first browser and up to five additional devices. Keep the link private.
Supporter records currently have no automatic deletion period while ownership, accounting, dispute, and entitlement requirements are being finalized. Automated gameplay deletion stops at this boundary for manual verification; an additional device can unlink itself without deleting shared scores or the entitlement.
Providers and international access
A direct provider request normally reveals connection details such as IP address, time, and browser headers. Cloudflare serves and protects the site and runs Workers, D1 databases, Durable Objects, and platform logs. NASA GIBS supplies the main satellite tiles; Esri World Imagery supplies detailed tiles at some zoom levels. Their published privacy terms govern their independent network logging. Natural Earth data and the exact Leaflet and Turf builds are served by MapMuddle, so playing creates no runtime request to Natural Earth or a JavaScript CDN.
Resend processes supporter delivery data for MapMuddle. Ko-fi acts under its own relationship with supporters for the purchase. Provider contractual roles, subprocessors, transfer safeguards, production regions, and account settings are release-gate checks and must be verified by the operator before launch; this notice does not claim that those checks are complete.
Retention
- Open solo runs: 30 days. Completed non-supporter runs: 730 days. Orphaned inactive non-supporter player records: 730 days.
- Unused multiplayer lobby: one hour. Finished room: one day; pending score-save state may remain up to seven days. Any active match reaches a maximum lifetime of 30 days. Private room-to-score links and compatibility aliases expire after 120 days without use. These aliases keep existing games and pending scores connected during identity upgrades; they are excluded from public game data, reports and downloads.
- Voluntary bug reports: seven days plus the scheduled-cleanup delay described above.
- Supporter purchase, delivery, and linked entitlement records: no automatic period yet; this is a documented release decision, not an unlimited-retention promise.
Cleanup runs in bounded batches every 15 minutes. Backlogs or provider/database outages may delay deletion; later runs retry. Backups and provider security records can follow provider schedules.
Your choices and rights
The account-free privacy centre can export gameplay data in bounded pages, delete non-supporter gameplay data, reset local browser data, or unlink an additional supporter device. Export deliberately excludes security secrets, internal identifiers, purchase references, delivery-security state, and data about room participants. Supporter-linked deletion and requests that cannot be safely verified in-browser use the contact route.
You may ask for access, correction, deletion, restriction, objection, or portability where applicable. Email patrick@mapmuddle.com with the request type and current nickname if one exists. Do not email the browser token or activation link. Identity verification is data-minimizing and may limit what can be safely disclosed for an anonymous identity. You may also complain to the data-protection supervisory authority applicable to you. The operator must finalize the controller’s publishable legal identity/address, the lead authority route, and legally reviewed lawful-basis wording before production release.
Children
No real name, account, or email is required to play, but pseudonymous gameplay and provider connection data are still processed. Younger players should not put personal information in a nickname. A parent or guardian can use the contact route. The operator has not yet approved an age threshold or child-consent model; this is a production-release blocker, not a claim that the service is suitable for every age.
Security incidents and changes
The operator maintains an internal incident and breach-response runbook. Notification decisions depend on the facts and applicable law; this notice makes no promise that every security event is reportable. If this notice changes, its last-updated date changes when the revision is published.