Privacy

The short version: no ads, no tracking cookies, and no third-party scripts. We use limited, self-hosted, cookie-free public-page and selected CTA intent counts on public website pages. Fonts and images are served from this site.

When you browse

Like almost every web server, ours keeps access logs: your IP address, the page you asked for, the time and your browser’s user-agent string. We use them only to keep the site running and to block attacks. They are rotated automatically and never shared or sold.

Basic website analytics

We run our own Umami analytics to understand aggregate traffic to public website pages. The browser sends the site’s hostname, the public page path (without query strings or fragments), the referring site’s origin (without its path or query), and a fixed event name for the selected CTA intents described below. The service also derives broad browser, device and country statistics from the request; it does not store raw IP addresses. Daily IP- and browser-derived identifiers estimate visitor and session counts; they are not account identities or cross-site profiles. Analytics records have a daily 90-day retention cutoff. Restricted, server-local backups can retain removed records for up to seven further days.

We do not collect names, email addresses, form contents, searches, game activity, automatic click capture, free-text event properties or session recordings. The feedback and contact areas, private or authenticated areas, searches, the privacy page, and the game builds at /play/ and /beta/ are not tracked. Visits with any query string or fragment are skipped entirely. A homepage page count does not include Android waitlist entries or any other form interactions.

On eligible public marketing pages only, we count a fixed set of link intents: play, game information, art gallery, blog and press. Only the fixed event name is added to the public-page payload; link text and target URL values are not sent. Each event kind counts at most once per full navigation. A play link click is intent only: it does not show whether the game loaded or was played. We do not track game builds, feedback, email links or Android waitlist interactions. Goals and funnels summarize these same bounded public-page and CTA counts.

Do Not Track and Global Privacy Control automatically disable analytics. You can also use the control below to disable it in this browser. That choice saves only an opt-out preference in local storage, not a visitor identifier. If the preference cannot be checked, analytics stays off. Analytics is never shared with advertisers or sold.

When you send feedback

The feedback form stores what you type: the kind of message, the subject and the message itself, plus the time it arrived. It also stores anything optional you fill in: your name, your email, and for bug reports, reproduction steps and your browser and device details. That last field is pre-filled with your browser’s user-agent string, which you can edit or clear before sending. We use all of it to fix bugs, plan features and reply to you if you asked us to.

To stop spam, the form also stores a keyed hash of your IP address combined with the date. It only matches other messages from the same connection on the same day, and we never store the address itself. It exists only to limit how many messages one connection can send.

Each message is also emailed to us: to contact@cogwarsgame.com, or security@cogwarsgame.com for security reports. Our domain registrar (Namecheap) forwards those addresses to the inbox we read, so that email passes through their mail service and our email provider. If you gave an email address, we reply from our own inbox.

We keep messages only as long as they’re useful for making the game, and we delete them on request.

The spam check itself runs in your browser: a short proof-of-work calculation. It doesn’t use a captcha service, set cookies or fingerprint you.

When you join the Android waitlist

The homepage lets you leave an email address to hear when Cog Wars comes to Android. We store that address, that you asked for Android, the time you signed up, and that you confirmed you’re 13 or older. The waitlist is for players aged 13 and over. We send you no email when you sign up. We’ll send one message when the Android version is out, then delete the list. It’s never shared or sold, and it uses the same spam protection and keyed IP hash as the feedback form. To come off the list earlier, email contact@cogwarsgame.com from that address.

The homepage’s “Share link”, “Copy link” and “Email it to myself” buttons run entirely on your device. They send nothing to us.

Your data

Want your feedback deleted, or a copy of what we hold? Email contact@cogwarsgame.com with your feedback reference (it looks like CW-1A2B3C) and we’ll take care of it.

The game

The game at /play/ runs in your browser. The current build doesn’t save progress yet. It stores only that you’ve acknowledged the photosensitivity notice, and your browser caches the game files so it loads faster next time. When saves arrive, they will stay in your browser’s local storage, on your device. Nothing about your play is sent to us.

Online leaderboards are planned. Before they go live, this page will say exactly what they store.