Security
The safest data is the data we never collect. Here is what that means in practice, and what we actually do verify.
What does not exist here
No accounts and no passwords
There is no sign-up, no sign-in and no password anywhere in this product. There is no credential store to breach and no reset flow to hijack.
No payment data
The game is free and ad-supported. We do not take card numbers, do not use a payment processor, and have no billing records.
No personal profile
We hold no names, no addresses and no player identities. The only personal data we ever receive is an email you choose to send us.
No third-party script until you say so
Analytics is not loaded until you accept cookies, and the map on the feedback page is not requested until you press the button. Rejecting keeps them off rather than merely hiding them.
The game build is content-addressed
The single largest thing this site hands you is roughly fifty megabytes of compiled WebAssembly. So it is worth being precise about what you are being handed.
- Every release is published under an id that is a hash of its own contents — the current one is
e9304a5003e022e6. A release URL therefore cannot ever serve different bytes than it did the first time, which is also why those files are marked permanently cacheable. - Each release ships a manifest listing a SHA-256 digest and a byte count for all four build files.
- That manifest is re-verified against the files on disk before the site is allowed to compile. If a single byte disagrees, the build fails rather than deploying.
- The download size quoted on the game page is summed from the same manifest, so it cannot drift away from what you actually fetch.
What that buys: a corrupted or swapped build cannot ship quietly. What it does not buy: it is an integrity check on our own pipeline, not a signature you can verify independently, and it says nothing about the security of your browser or network.
What runs on your device
The game runs sandboxed in your browser tab, with the same restrictions any web page has. It cannot read your files, install anything, or persist outside the origin's own storage. What it does keep — cached build files and your settings — stays on your device and can be cleared from the game page or by clearing site data in your browser.
The site is served over HTTPS, and the pages hold no scripts from anyone except us and — after you consent — Google Analytics.
Reporting a problem
Email striker@novusstreamsolutions.com with “security” in the subject line. Useful things to include: what you did, what happened, the URL, your browser and operating system, and the release id if the game itself is involved.
What we will do: read it, reply, and fix what needs fixing. What we will not do is pretend to be bigger than we are — there is no bug bounty, no reward programme and no guaranteed response time. We are a small studio and a report is read by a person, not a triage queue.
Please do not run automated scans, load tests or denial-of-service attempts against the site, and please do not attempt to reach data belonging to anyone else — there is none, and looking for it costs us hosting we would rather spend on the game.
Scope
In scope: this website and the game files it serves. Out of scope: our hosting provider's own infrastructure, the browser you are using, and the advertising and analytics vendors named on the privacy page — report issues in those to their owners, who can actually fix them.
Source code
The source of both the game and this site is private, and all rights are reserved. That is a business decision rather than a security measure, and we would not describe a closed repository as one — the guarantees above hold because of what the product does not collect, not because of what you cannot read.