Privacy Policy
Version 2026-10-07.1. This page explains what ToyBreak keeps about you, why, and how to get it removed. Short version: an account is a username, an email and a password; we keep your match results; there are no ads, no trackers and nothing is sold.
Who is responsible
ToyBreak is run by Miguel Mourão Godinho (the "controller" under data-protection law). Contact for anything on this page: miguel@19877.tech.
What we keep
- Account — username, email address, whether you've confirmed it, when you signed up, and which version of the Terms you accepted. Your password is stored only as a salted scrypt hash; nobody can read it back.
- Profile and progress — your character and colours, skill rating, matches played, wins, XP and level.
- Match history — for each online match: the server, mode, map, time, and the scoreboard (player names, teams, kills, deaths, headshots, score, and whether you joined late or left early).
- Feedback you choose to send — the 1–5 rating and note from the results screen, with the match it was about (map, mode, character, whether you won, kills and deaths, game version and build), your computer's graphics card, driver, Windows version, screen resolution, quality setting, renderer and frame rate (so we can tell what the game runs on), and your account if you were signed in. If you delete your account the feedback stays, without the link to you.
- Match chat — what you type in a match's chat, with your username, whether it went to everyone or your team, the server and the time. Game servers pass it to us so a report of abuse can be checked against what was actually said. Kept 14 days; if you delete your account, your lines lose your name.
- Game logs you choose to send — when you press SEND LOG in the game's settings: the newest part of the game's log file from your computer (technical messages: what loaded, errors, connection events; it can include your username and the folder the game runs from), with the same hardware details as above plus the processor's name, its number of cores, the amount of memory (RAM), your system language/region setting (locale) and the game's exact build, and any note you add. Kept 30 days, deleted with your account.
- Crash reports you choose to send — when the game says "ToyBreak closed unexpectedly last time" and you press SEND: what the crashed run left behind (the build, scene and map/mode, how long it ran, the same hardware details as above, its log files and any script errors, and the nearby Windows crash/driver events from those few minutes). Kept 30 days; deleted with your account (a report sent while signed out has no account attached).
- Sign-in sessions — a random token per signed-in device. We store only a hash of it; it expires after 30 days or when you sign out.
- Email links — confirmation and password-reset links, which expire after 48 hours and 1 hour.
- IP addresses — needed to connect you to the website and game servers. They are used briefly to stop password guessing (kept in memory for one minute) and appear in the web server's and game servers' logs, which are deleted after 14 days.
- Security log — sign-ins, failed sign-ins, sign-ups, password changes and resets, and account deletions, each with the time and the IP address it came from. It lets us spot someone guessing your password and investigate cheating. These entries are deleted after 90 days.
- Moderation record — if an account is suspended or a suspension is lifted: which account, when, why, for how long, and which moderator did it. This is kept for as long as the service runs, also after the account is deleted, so a ban can't be dodged and every moderation decision can be checked later.
- Player reports — when you report someone from a match: who you reported, the reason and note you gave, which match (server, map, mode) and when, plus your username so a moderator can follow up. If you delete your account, your name is removed from reports you filed. Reports about an account are part of its moderation record. Moderators get a notice of each new report in a private staff channel on our Discord server: only the reported username, the reason, how many open reports that account has, and a link to our moderation page — never who reported it or the note you wrote.
The game keeps your sign-in token and settings on your own computer. The launcher downloads game files and checks them against our list; it doesn't send anything about you.
We don't use analytics, advertising, tracking cookies or third-party fonts or scripts on this site. The account page keeps your sign-in in the browser tab's session storage, which goes away when you close the tab.
Why (legal basis)
- To run your account and let you play online — needed to provide the service you signed up for (contract).
- To keep the game fair and safe — rate limiting (including how many accounts one network can make in a day), ban enforcement, checking match chat when someone reports abuse, investigating cheating (legitimate interest).
- To fix the game — hardware details with feedback and the logs or crash reports you choose to send (legitimate interest; sending them is always your choice).
- To email you — only about your account: confirming your address, password resets, and notices that your password changed. No newsletters unless you separately ask for them.
Who else handles it
Only providers we need to run the service, acting on our instructions:
- Hosting: Contabo, data centre in France (accounts, website, downloads, and some game servers).
- Game servers: Amazon Web Services (AWS Lightsail), data centre in Frankfurt, Germany. When you play there, it handles your IP address, your username and look from your match ticket, your in-match actions and chat, and keeps its own server logs (deleted after 14 days).
- Email delivery: Resend.
- Staff notices of new player reports (see above): Discord, in a channel only our moderators can see.
Our community Discord server is optional and separate from your game account: what you post there, and the account you use, fall under Discord's own privacy policy. If you open a support ticket there, staff keep the ticket for up to 90 days after it's closed, then delete it.
Other players see your username, character, colours, level, in-match scores and what you say in match chat. The website has a public player page for every account: your username, character and colours, level, XP, matches, wins, the month you joined and your latest online matches (map, mode, result, kills, deaths, score). Your skill rating and rank are added, and you appear on the public leaderboard, once you've played five online matches. You can switch all of that off on My account. We don't sell or share your data with anyone else unless the law requires it.
How long we keep it
Your account stays until you delete it. If you delete it, your account, email, password hash, sessions and links are erased at once; past match scoreboards keep the numbers but your name is replaced with "(deleted)". Web and game server logs and match chat go after 14 days, game logs and crash reports you sent after 30 days, security-log entries after 90 days; moderation records stay (see above). Backups, including encrypted copies kept off the server, roll over within 30 days.
Your rights
You can see your data and delete your account yourself on My account. You can also ask us to give you a copy of your data, correct it, restrict or object to how we use it — write to miguel@19877.tech and we'll answer within a month. If you think we've got it wrong, you can complain to your local data-protection authority.
Age
You need to be at least 13 to make an account. In some countries you need a parent's consent until 16. If you think a child under 13 has made an account, tell us and we'll delete it.
Changes
If this policy changes in a way that matters, we'll say so on this site and in the game before it applies.