Privacy policy
PotatoStrike is a browser game. This page says plainly what it stores about you. Short version: no ads, no trackers, no cookies, and you can delete your account at any time.
What we store
- If you play as a guest: the display name you type, only while you are connected. Guests have no saved progress.
- If you make an account: your username, a salted scrypt hash of your password (we never store or see the password itself), when the account was created and last used, your level, XP, statistics, unlocked and equipped cosmetics, match history (map, mode, result, your kills and deaths) and the maps you create and publish. We do not ask for your real name.
- An email address, only if you choose to add one: it is optional and used for nothing except the emails you ask for (confirming the address, resetting a forgotten password) and a warning when your password or that address changes. It is stored encrypted, is never shown to other players or to administrators, and is not used for marketing. To deliver those emails we pass the address, and nothing else, to our email delivery service (Resend) at the moment an email is sent. A reset link works once and for 30 minutes; a confirmation link works once and for 24 hours. Without an email on the account, a forgotten password cannot be recovered.
- Reports you send: if you report a player or a map, we store who reported, who or what was reported, the reason and any note you typed, so an administrator can look into it. Only administrators see reports. Reports you sent are removed if you delete your account.
- Chat: in-game text messages are passed to the other players in the match and are not stored. They are checked by a language filter and a rate limit as they pass, and chat is only for logged-in players. You can hide chat or mute players in the game, and report a player.
- Login records: each login keeps a hashed session token, its expiry (30 days) and the IP address it came from. At most 10 logins are kept per account.
- Server logs: IP addresses and request details for security and fixing bugs, and anonymous browser error reports (the error text, the page path without any invite link, the game version and your browser type).
- In your browser: settings, key bindings, practice options, an unsaved map draft and your login token are kept in your browser's local storage so the game remembers you. We set no cookies and use no analytics or advertising.
Why
To run the game: log you in, show your progress and leaderboards, keep matches fair, block abuse and fix problems. We do not sell or share your data and we do not show ads.
Who can see what
Other players see your username, level, statistics, equipped cosmetics, match history and published maps (your profile is public). Your email address is not visible to anyone in the game, including administrators. Only the site operator's server can decrypt it, and only to send you the emails above. Nobody except the site operator can see IP addresses or password hashes.
How long we keep it
Account data, including a recovery email if you added one, is kept until you delete your account or remove the address. Unused reset and confirmation links expire within hours. Login records expire after 30 days. Server logs and database backups are kept for a short, rolling period (days to weeks) and then removed.
Your choices
- Delete your account at any time: open your profile, then Account settings, then Delete account. Your level, statistics, unlocks and maps are removed and your name is blanked in other players' match history. Backups made earlier disappear as they expire.
- Add, change or remove your email address (Profile, Account settings, Recovery email). Removing it deletes it at once.
- Download a copy of your data (Profile, Account settings, Download my data): a file with your profile, stats and maps.
- Log out everywhere and change your password from the same place.
- Clear your browser's site data to remove everything stored in your browser.
Children
PotatoStrike is meant for people aged 13 and over. Do not create an account if you are younger.
Security
Connections use HTTPS. Passwords are hashed with a memory-hard function, login tokens are stored only as hashes, and repeated wrong passwords lock the account for a while. No system is perfectly safe, so use a password you do not use anywhere else. Reset links are single-use and short-lived, and we send a warning to your email whenever your password or recovery address changes.
Contact
Questions or requests about your data: enragemz@gmail.com. We may update this page; the date below changes when we do.
Last updated: 18 October 2026