// PRIVACY POLICY

1. Who we are

The Darkpool ("we", "us", "the Service") is operated by Povilas, an individual based in Lithuania, acting as the data controller for personal data processed through the Service.

Contact for privacy matters: povilas.gmz@inbox.lt

2. What we collect

When you create an account and play, we process:

• Callsign — the username you choose. Public on the ladder and on battle logs.
• Password — stored only as a one-way bcrypt hash. We cannot read or recover your password.
• Specialty type — the program type you pick at signup, public on your operator profile.
• Game state — energy, rank points, win/loss counts, and the programs in your loadout and inventory.
• Battle logs — match outcomes, opponents, RNG seeds, and timestamps.
• Session cookie (darkpool_session) — opaque random token tying your browser to your account.
• Web-server logs — your IP address, requested URL, response code, user agent, and timestamp, kept short-term for security and debugging.

We do not collect your email, real name, address, phone number, or payment information. Account creation requires only a callsign and a password.

3. Why we collect it (lawful basis under GDPR Art. 6)

• Account & gameplay (Art. 6(1)(b) — performance of contract): callsign, password hash, session cookie, game state, and battle logs are necessary to provide and operate your account.
• Security & abuse prevention (Art. 6(1)(f) — legitimate interest): short-term web-server logs (IP, paths, timestamps) are kept to detect attacks, abuse, and bugs.

4. Cookies

We set exactly one cookie:

• darkpool_session — opaque session token. HttpOnly, SameSite=Lax, expires after 30 days. This is a "strictly necessary" cookie under Article 5(3) of the ePrivacy Directive (2002/58/EC); no consent banner is required.

We do not use analytics, advertising, or tracking cookies. If we ever introduce non-essential cookies, we will request your consent through a banner before they load.

5. Third parties

• Hosting: Hostinger International Ltd., Lithuania (EEA). Server logs reside on this hosting infrastructure.

All fonts, stylesheets, and scripts the site uses are served from our own infrastructure inside the EEA. We do not load resources from external CDNs and we do not transfer personal data outside the EEA. We do not share, sell, or rent your data to any other third party.

6. Retention

• Account data (callsign, password hash, game state, battle history): kept until you delete your account.
• Web-server logs: rotated and overwritten within 30 days.

7. Your rights (GDPR Art. 15–22)

You have the right to:

• Access — request a copy of the data we hold about you (Art. 15).
• Rectification — correct inaccurate data (Art. 16).
• Erasure — request deletion of your account and associated data (Art. 17, "right to be forgotten").
• Restriction — limit how we process your data (Art. 18).
• Portability — receive your data in a machine-readable form (Art. 20).
• Objection — object to processing based on legitimate interest (Art. 21).

To exercise any of these rights, email povilas.gmz@inbox.lt. We will respond within 30 days.

8. Right to lodge a complaint

If you believe we are mishandling your personal data, you may file a complaint with the Lithuanian data-protection authority:

9. Children

The Darkpool is not directed at children under 16. If you are under 16, please do not create an account.

10. Changes

We may update this policy. Material changes will be posted on this page with an updated "Last updated" date.