Privacy Policy

Last updated: 2026-01-01

Reflex Slayer is anonymous by design. You do not create an account, and we do not ask for any personal information to play the game.

1. Who we are

Data controller: Reflex Slayer (operating reflexslayer.vibesok.com).
Contact: srpatel980@gmail.com.

2. Personal data we collect

• An anonymous player ID — a random 24-character cookie (rs_player_id) we set the first time you visit, so we can attribute your runs to a consistent identity on this browser. It is not linked to your name, email, or any other system.
• Your display name, if you choose to enter one. This is free-form text and may be your real name, a nickname, or anything else. Please don't put personal information in it.
• Your game runs — timestamps, reaction-time milliseconds, score, rank, mode, combos, finishers. Stored against the anonymous player ID.
• Share IDs — short random codes for the result pages you choose to share.

We do not store your IP address in the application. Our web server (Apache) writes access logs that include IPs for security purposes; these rotate every 14 days.

3. Cookies & similar technologies

See the Cookie Policy for the complete list. In short:

• Essential — the player-ID cookie and your consent preferences. Set without consent (legitimate interest).
• Analytics — Google Analytics 4 if you opt in. Off by default.
• Advertising — reserved for future Google AdSense. Off by default. Nothing is currently loaded.

4. Legal bases (GDPR Art. 6)

• Legitimate interest for the essential player-ID cookie and basic server logging.
• Consent for analytics and advertising cookies.
• Performance of a contract — none, because there is no contract.

5. How long we keep it

We keep your runs and unlocks until you reset progress (see Settings). Web-server access logs rotate every 14 days. Consent records last 13 months and we re-prompt you after that.

6. Who we share it with

• Cloudflare — content delivery, bot protection, and aggregated web analytics (cookieless). Privacy notice: cloudflare.com/privacypolicy.
• Google — only if you consent to Analytics; in future, also for advertising if you consent. Privacy notice: policies.google.com/privacy.
• Let's Encrypt — issues our TLS certificate, no personal data shared.

Some of these providers process data in the United States. Transfers rely on the EU Standard Contractual Clauses and the providers' Data Processing Addenda.

7. Your rights (GDPR Art. 15–22)

• Access & portability: download a JSON dump of everything attached to your browser.
• Rectification: change your display name on the Settings page.
• Erasure ("right to be forgotten"): use Reset on the Settings page. This deletes all your runs, unlocks, and shared links.
• Restriction / objection: reject analytics & advertising cookies via the banner or the cookie preferences link in the footer.
• Complaint: you may complain to your local data-protection authority. For the EU, see edpb.europa.eu.

8. Children

Reflex Slayer is not directed at children under 13 and we do not knowingly collect data from them. There is nothing personal to collect anyway — the game is anonymous.

9. Security

Traffic is encrypted with TLS. Strong content security and frame-options headers are set. Game taps are signed server-side with an HMAC nonce to prevent cheating; the secret never leaves the server.

10. Changes

We may update this policy. The "Last updated" date at the top will reflect the latest version. Material changes will be flagged in the cookie banner.