English · Deutsch · Türkçe · Português (Brasil)
The short version. You can play Hyperball without an account, email or name. If you make an account, we keep what's needed to run it: your name, your match record, your friends and messages. We record how matches play and how smoothly the game runs so we can fix lag, and these recordings don't carry your name. We don't sell your data. With your permission, or where the law doesn't require asking, we tell Meta when someone plays so we can measure our ads. Write to privacy@hyperball.app to see, correct or delete your data.
1. Who is responsible
Hyperball is made by Kaan Bursa, the data controller for this game and its website hyperball.app, including the browser game, desktop and mobile apps, and the servers behind them. Contact: privacy@hyperball.app.
2. What we collect, and why
When you just play (no account)
| Data | Why |
|---|---|
| Your IP address and the requests your browser or app makes to our servers | To connect you to a match and pick the nearest server. The game measures its connection to each of our servers, including our Istanbul and São Paulo servers, to choose one. Our game servers use your IP in memory to rate-limit requests, and our servers may keep it for a short time in technical logs. |
| The name you type to play under | Shown to the other players in your room. It is saved on your device. |
| Your moves and kicks during a match, the match settings and the result, linked to a random session number (not your name or account) | We record every match on our game servers, then replay it to find and fix bugs, lag and unfair physics. |
| A short summary of each match you play: the mode (for example Play Now or a room), format, opponent level, score, how long it lasted, whether you finished or left, a few counts such as kicks, and for matches against the AI your estimated skill before and after. It carries two random IDs: one made each time the game starts, and one kept on your device so we can see whether players come back and what made them stay. Neither contains anything about you, and clearing this site's data resets the second. Our server adds your country, and we don't store your IP address, browser identifier, name or account with it. Summaries also note how your visit arrived: the campaign label from the link you opened (for example an ad or a friend's invite), never the full address, so we can see which sources bring players who actually play | To learn which modes people play and finish, and to fix the first minutes of the game. Sent when a match ends or you leave. |
| When you challenge a friend: that the CHALLENGE A FRIEND button was shown and pressed, whether you shared or copied the link, and whether a friend opened it and took the seat, with the same two random IDs as the match summaries. Never names, contacts or the message itself. Like the match summaries, these note how your visit arrived: the campaign label from the link you opened, never the full address | To see whether players bring their friends. This is not ad measurement and is never sent to Meta. |
| When the game opens: a short note that it was opened, with the same random IDs, the game version and how the visit arrived (as above) | To see whether players come back, including those who leave before a match ends. Never sent to Meta. |
| Performance reports: frame timings, network delay, how your keyboard input arrived, the game version, a coarse device type (for example "web-android"), connection type (for example "wifi" or "4g"), graphics renderer details, and your "felt smooth/rough" vote if you give one | To measure and fix lag and stutter. Reports don't contain your name, account, IP address or full browser identifier. |
| In-room chat messages | Delivered to the players in the room. Rooms saved on our lobby server can keep a short chat history so people who join late can see it. |
When you make an account
You get an account when you register, or when you sign in with an email code. You also get a free guest account automatically when you create or join a saved room, or open a party link, so your seat and results can be kept.
| Data | Why |
|---|---|
| Display name, username, and your email address if you give one | To identify your account, let friends find you, and send you sign-in codes |
| Password (if you set one) and a device sign-in token (the server keeps only a hash of the token) | To keep you signed in securely |
| Match results: who played, teams, goals, own goals, who left early, ratings, ladder and season points | To run the ladder, seasons, stats and matchmaking |
| Friends, friend requests, blocks, players you've recently played with, parties | Social features you choose to use |
| Direct messages, and party and lobby chat | To deliver messages and show message history. Direct messages are stored on our servers until deleted. |
| Rooms you create and their settings | So your rooms keep their link and code |
Peer-to-peer (P2P) matches
In a P2P match your device connects directly to the other players. Like any direct connection, the other players' devices can see your IP address. To set up the connection, your device contacts Google's public STUN servers (stun.l.google.com), which see your IP address. If a direct connection isn't possible, the traffic goes through our relay server. Summaries of P2P matches (players, teams, goals) and performance reports are sent to our lobby server.
Ad measurement (Meta)
We advertise Hyperball on Meta (Facebook, Instagram). To learn which ads bring players, the game can send these events: opened the game, created or upgraded an account, created a room, invited a friend or opened an invite, sent a friend request, started or finished a match (with mode, result and how many matches you've finished on this device).
- The events go first to our own server (
events.hyperball.app), which passes them to Meta. No Meta script runs on our pages. - With each event, Meta receives:
- your IP address and browser identifier
- a random ID stored on your device, and your account number when you're signed in, both one-way hashed
- your country, hashed
- the page address without its query
- if you arrived from a Meta ad, the ad click ID
- We never send Meta your email, username, name, room codes or messages.
- In the EU/EEA, the UK, Switzerland, Turkey and Brazil we ask first, and nothing is sent unless you choose ALLOW. Elsewhere it's on by default. Anyone, anywhere, can switch it off below.
- We keep our own log of what was sent (event names, times, country and Meta's reply). It also holds the random visit ID that your match summaries carry, so we can see whether a visit from an ad went on to play. Without ad measurement, nothing links the two. We never keep your IP address or browser identifier in it.
- Meta's use of the data is governed by Meta's privacy policy.
Stored on your device
We don't use cookies. The game keeps these in your browser's local storage (or app storage):
- your settings, play name and controls
- your sign-in token, name and cached rating
- room passes for rooms you've joined
- your chosen goal celebrations
- a reconnect token for the current tab
- an estimate of how well you play against the AI, used only to pick your next AI opponent; it is never shown and stays on this device
- the ad-measurement IDs and your ad-measurement choice
Signing out removes your account details from the device. You can clear everything else by clearing this site's data in your browser.
3. Legal bases (EU/UK GDPR, Turkish KVKK, Brazilian LGPD)
- To provide the game and your account (performance of a contract): connecting you to matches, accounts, ladder, friends and messages.
- Our legitimate interests: keeping the game fair, secure and smooth (match recordings, performance reports, match summaries, rate limiting, preventing abuse). These records aren't tied to your name.
- Your consent for ad measurement in the regions listed above. You can withdraw it at any time with the button above.
- Legal obligations where they apply.
4. Who we share data with
We don't sell your data. We use these service providers to run Hyperball, and they process data on our behalf:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online | Main servers: the website, game server, lobby and account database, relay server | Germany |
| Gcore | Game servers in Istanbul and São Paulo. They also forward traffic to our lobby server for players who connect through them. | Turkey, Brazil |
| Cloudflare | Storage of match recordings, performance reports, match summaries and ad-event logs; the ad-event server; app downloads; possibly the connection relay | Global network, which may include the USA |
| Resend | Sending sign-in code emails | USA |
| Meta Platforms | Ad measurement, as described above | Ireland/USA |
| STUN servers for setting up P2P connections (they see your IP address) | USA |
We may also disclose data if the law requires it, or to protect players and the service from abuse.
5. International transfers
Some providers above process data outside your country, including in the USA. Where the law requires it, these transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, and the equivalent mechanisms under UK law, Turkish KVKK and Brazilian LGPD.
6. How long we keep data
- Account data, match results, friends and messages: while your account exists. When you ask us to delete your account, we delete or anonymise it. We may keep anonymised match results so other players' records stay correct.
- Match recordings, performance reports, match summaries and ad-event logs: only as long as we need them to fix and improve the game and measure our ads. They aren't linked to your name. We review and delete old records regularly.
- Data on your device: until you sign out or clear this site's data.
7. Your rights
Depending on where you live, including under the GDPR, UK GDPR, Turkish KVKK and Brazilian LGPD, you can ask to:
- see the data we hold about you, and get a copy
- correct it
- have it deleted
- object to or restrict how we use it
- withdraw consent
There isn't a delete button in the game yet. Email privacy@hyperball.app with your username, and we'll reply within one month (within 15 days where Brazilian law applies). We may need to confirm the account is yours. You can also complain to your data-protection authority, for example your EU country's authority, the UK ICO, Turkey's KVKK Authority (Kişisel Verileri Koruma Kurumu), or Brazil's ANPD (Autoridade Nacional de Proteção de Dados).
8. Children
Hyperball is not directed at children under 13. In the EU/EEA, the age is set by local law and may be up to 16. We don't knowingly collect personal data from children below these ages. If you believe a child has given us personal data, contact us and we'll delete it.
9. Security
Connections to our servers are encrypted (HTTPS/WSS). Sign-in tokens are stored on our servers only as hashes. Access to our servers and storage is limited to the people who run the game. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
10. Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll tell you in the game.
11. Contact
Kaan Bursa, Hyperball · privacy@hyperball.app