Privacy and storage - Asset Acrobatics

In short

Asset Acrobatics ("we") runs this website and the game page (see Who is responsible).

This website, www.assetacrobatics.com, runs no analytics, sets no cookies and has no script that sends data anywhere.
The game page, city.assetacrobatics.com, sets no cookies either, and in normal use its own code sends nothing about you; Cloudflare, which serves it, asks your browser to report failed requests (see What the hosts log). The page does keep the game and its settings in your browser, so that the game can run and start fast next time, and the engine adds a few small files of its own. Four kinds of item are not needed to play: the graphics test result and three kinds of engine file (a random install id, the crash-report settings and an empty file that stops the engine sending crash reports by itself). The page writes them without asking you (see Consent). Everything it keeps is listed below, with how to delete it.
Our two hosts, Vercel for this website and Cloudflare for the game, receive every request and may log it, as web hosts do.
If you e-mail us, your message passes through Cloudflare to our mailbox, and we use it to answer you (see If you e-mail us).
We do not sell personal information. We share it only with the services this page describes: our two hosts, Cloudflare's e-mail forwarding and the provider of our mailbox. Apart from them, we share it only if the law requires it, or if we need it to establish or defend a legal claim (see If you e-mail us). There are no ads, accounts, forms or mailing lists.

Who is responsible

Asset Acrobatics, a private, non-commercial project, runs this website and the game page at city.assetacrobatics.com and decides how data is handled on both (the controller). Contact: site-contact@assetacrobatics.com (e-mail). There is no data protection officer.

This website

It runs no analytics and sets no cookies. It uses neither Vercel Web Analytics nor Cloudflare Web Analytics.
Every file comes from this website itself: no fonts, scripts, images or embeds from other hosts.
The browser check on the home page runs only in your browser. It asks the browser what it supports (for example WebAssembly, WebGPU and the limits of your graphics chip) and shows the result. It sends nothing and stores nothing.
Your browser keeps the data of www.assetacrobatics.com and city.assetacrobatics.com apart: neither can read the other's.

The game page

It sets no cookies and loads nothing from other hosts. Its own code sends nothing about you, except when you type one of the developer switches described below into the address; the reports of failed requests that Cloudflare's answers ask for are described under What the hosts log.
The page is cross-origin isolated: the browser blocks any script, image or frame from another origin, this website included, unless that file sends headers that allow it (CORP or CORS).
Apart from links back to this website, its only link is "Get Chrome" (www.google.com/chrome), on the card it shows when a browser cannot run the game. It opens only if you click it.
Crash reports are off. If they are ever switched on, the page will ask you before it sends one, and this page will say what a report holds.
The engine's HTTP module is switched off, and the game opens no other connection: it reads only its own files from city.assetacrobatics.com.
If the game stops with an error card, its "Download the log" button saves a text file to your device: the page's own log lines, the error, your browser's user-agent string and the page's address without its query. Nothing is sent.

What the game page keeps in your browser

Everything below stays in your browser and is not sent anywhere. None of it names you or follows you to other sites. One item, the engine's install id, is a random number that tells this browser's copy of the game apart from others.

The game's files (Cache Storage `ue-data-v2:/`)

What it holds: The files the game downloaded, its program and its data, and a few small records of the data cache: the file list, and which version each open tab runs. It is the whole game, so it is large.
When: The first time you open the game page, and again when the game changes.
Why: So that a later visit starts in seconds instead of downloading the game again.
Basis: Strictly necessary for the game you asked to play.
Kept: Until you delete it, or until the browser does, for example when disk space runs low.

The data cache's worker (service worker `sw.js`)

What it is: A script the browser keeps for city.assetacrobatics.com. It fills the cache above and hands the game its files from it.
When: The first time you open the game page.
Why: So that the game's files come from the cache.
Basis: Strictly necessary, like the cache.
Kept: Until you delete it, or until we switch it off on the site: then it deletes its cache and removes itself on your next visit.

Settings, saves and the engine's own files (the site's private file area, OPFS)

What it holds

The game's folder /WebCity/Saved:

its settings, for example the graphics quality and the window size, in a file the engine writes at the first start and then keeps up to date;
saved progress, if the game ever keeps any (it keeps none today);
the engine's install id: a random number that the engine makes on its first start and keeps (Settings/Epic Games/KeyValueStore.ini). It holds nothing about you;
the engine's crash-report settings for each start, a small file in a folder named with a random id for that start (Config/CrashReportClient/UECC-Wasm-<id>);
an empty file that tells the engine not to send crash reports by itself.

The public build writes no log files here; only development builds do.

When

While the game runs. The install id is made on the first start.

Why

The settings, so that they stay as you left them. The install id, the crash-report settings and the empty file come from the engine's crash-report code, which runs at every start; the game does not use them, and crash reports are off.

Basis

Settings and saves: kept for the game you asked to play, so that it starts as you left it. The install id, the crash-report settings and the empty file: not needed to play (see "Consent" below).

Kept

Until you delete them. At a later start, the engine is set to delete the crash-report folders that are more than two days old.

The graphics test result (localStorage `ue.WebCity.gpucheck`)

What it holds: The result of a short graphics test: a starting resolution in percent, the test's time in milliseconds, and when it ran. No identifier.
When: On your first visit with a computer, when the test gives a result. The test does not run on phones or tablets.
Why: So that later visits pick the same renderer without running the test again.
Basis: It saves time on later visits. It is not something you asked for, so we list it here, and the steps below delete it.
Kept: Until you delete it. A later visit may update it.

Markers for one tab (sessionStorage)

What they hold

ue.WebCity.gpuFallback: after a graphics failure, this tab runs the simpler renderer (what failed, and when).
ue.WebCity.gpuRestart: why the page restarted, for a short notice after the restart; deleted once read.
ue.sw.unregistered: one reload after the data cache's worker was switched off.

When

Only after a graphics failure, or when the worker is switched off.

Why

So that the page recovers instead of failing again in a loop.

Basis

Strictly necessary for that recovery, and only for the life of the tab.

Kept

The browser deletes them when you close the tab.

A request to keep this data (persistent storage)

Once the game is ready, the page asks the browser not to delete the game's data when disk space runs low. Firefox asks you; Chrome, Edge and Safari decide by themselves. If you say no, the game still runs; it may just have to download again later.

The page can write a few more keys, but only in setups this game does not use: ue.WebCity.primed (cache priming), ue-prewarm:<format>:<stamp> (a graphics prewarm pack), ue.isolation.reload (isolation through the worker), ue.WebCity.deviceLostAt (an automatic reload after a lost graphics device) and ue.WebCity.memLast (a memory recorder that runs only with ?memory=1 in a development build). It also reads ue.WebCity.renderer, a renderer choice that a game menu could save; nothing writes it today.

Developer switches typed into the address can do more. ?prewarm=capture writes an extra diagnostic file to the same file area. ?ue-session=1 makes the page post its console lines, which include what it found about your browser and graphics chip, to the game's own host. The game's Worker script on Cloudflare (see What the hosts log) refuses these posts, and Cloudflare may log them like any other request. Nothing on this site links to these switches.

Like any site, the page and the files it loads can also sit in your browser's ordinary web cache. The data cache's worker fetches the game's files past that cache, with one exception: on your first return visit it puts one more copy of the game's program there, so that the browser can reuse the code it compiled.

Under the EU's ePrivacy rules, storing data in your browser counts as storage whatever its size, and a site may store it without asking when it is strictly needed for a service you explicitly asked for. We think that holds for the game's files, its worker, your settings and saves, and the tab markers: you open the game page to play, and the game needs them to run, to start quickly and to recover.

Four kinds of item are not needed to play: the graphics test result (written on computers only), which only saves time on later visits, and three kinds of small file that the engine writes by itself: its install id, its crash-report settings (a new small file at each start) and the empty file that tells it not to send crash reports. The page writes them without asking. None of them leaves your browser, and the steps below delete them all.

How to delete it

Open city.assetacrobatics.com/clear.html. It lists what the game keeps in this browser and deletes it: the downloaded files, the whole file area (settings, saves, the install id and the engine's other files), the worker, the graphics test result and the tab markers (sessionStorage only for its own tab). Close the game's other tabs first.
Or use your browser's own control for site data, and delete the data of city.assetacrobatics.com. To remove the copy in the browser's ordinary web cache too, also clear its cached images and files: clear.html cannot reach that cache.

What the hosts log

Vercel hosts this website. Cloudflare serves the game, from its R2 storage through a Worker script, runs the domain's DNS, and passes on e-mail sent to site-contact@assetacrobatics.com.
To deliver a page or a file, a host receives your IP address and the usual request details: the address asked for, the time, your browser's user-agent string and the page you came from. Each host may keep logs of these for running and securing its service.
The game's Worker script (Epic's worker.js) keeps no log of its own.
Cloudflare's answers ask your browser to report failed requests to Cloudflare (network error logging): for 7 days after a visit to the game, a request to the game that fails is reported to Cloudflare with its address, the page that asked for it, the kind of error and your browser's user-agent string, and the report reaches Cloudflare from your IP address. Successful requests are not reported.
We look only at the hosts' totals, such as the number of requests and the data served. We do not combine them with other data, and we do not try to identify visitors.
Legal basis: our legitimate interest in running the site and keeping it secure (GDPR Art. 6(1)(f)).
Both hosts may process this data outside your country, including in the United States.

If you e-mail us

Mail to site-contact@assetacrobatics.com is received by Cloudflare Email Routing (Cloudflare, Inc., United States). It works for us as a processor and passes each message on to our private mailbox at an e-mail provider. We do not publish that mailbox's address.
Cloudflare keeps a record of each message: the sender's and the recipient's address, the subject, the message ID, the time, and the delivery and authentication results. Its analytics hold these records for 31 days.
We use your address and your message only to read and answer your message, or to establish or defend a legal claim if one arises. Legal basis: our legitimate interest in answering messages sent to us, and in establishing or defending legal claims (GDPR Art. 6(1)(f)).
Writing to us is up to you. We need your e-mail address to reply.
Cloudflare may process the message in the United States. Its data processing addendum says it complies with the EU-U.S. Data Privacy Framework, and it applies the European Commission's standard contractual clauses and the UK addendum to the transfers that need them. Our mailbox provider may also process it outside your country.
We delete a conversation 12 months after its last message, unless we need it to establish or defend a legal claim. Messages we recognise as spam are deleted without an answer.

How long data is kept

In your browser: until you delete it, or the browser does. The tab markers end with the tab.
At the hosts: as long as each host keeps its logs for running and securing its service. We do not keep copies of those logs.
With us: we keep no visitor data of our own. If you e-mail us, we keep the conversation for at most 12 months after its last message, unless we need it to establish or defend a legal claim, and Cloudflare's record of each message is kept for 31 days (see If you e-mail us).

Your rights

If the GDPR applies to you, you can ask us for access to your personal data, and for its correction or deletion. You can also ask us to restrict its use, object to it, or get a copy in a portable form. Write to site-contact@assetacrobatics.com.

You have the right to complain to a data protection authority.

Nothing on this site asks for your consent, so there is no consent to withdraw. You do not have to give us any data: the hosts' logs come with loading the site, the game's storage stays in your browser, and writing to us is up to you. No decision about you is made by automated means.

Changes

If we ever add analytics, crash reports or anything else that sends data, this page will say so first, in the same update that switches it on. The date at the top shows the last change.

Contact

E-mail: site-contact@assetacrobatics.com