Privacy policy

Who is responsible for the data and how to reach them?

The data controller is Oleksandr Serhiiovych Kravchenko, the developer of Chyste Nebo, a private person. For any question about your data, or to see, correct or delete it, write to sashko1391@gmail.com. You get an answer within 30 days.

What does the game keep on your device?

The game keeps data in your browser's storage (localStorage, sessionStorage and the app cache) on your device. The game itself sets no cookies (Cloudflare's bot check on the sign-in form may set its own technical cookies — see «Where is the data kept»). Without signing in, the game sends none of this anywhere except the anonymous counters (see «What does the game count anonymously»); as with any website, the address you opened the game with lands in the hosting's technical logs (see «How long is the data kept»).

• campaign progress, stars, medals and settings (sound and volume, effects, auto-waves, tracer looks, the interface language — if you chose it by a link or the «English (beta)» button); your own endless-defense records; the threat-guide cards you opened, the first-game hints, the in-battle lessons and the tips already shown;
• a saved run for «Continue the shift» (for a star-leaderboard battle, also the account the battle was started for: the win goes to that account's rating);
• gift codes you entered — so the commander opens on this device;
• a thank-you code you entered — so the thank-you maps open on this device — and your stars on those maps, which stay on the device and never sync with an account;
• if you signed in: the id of the account your progress is synced with, the time of the last sync and a mark whether some results are not synced yet; a star-leaderboard win that could not be sent for lack of connection (up to six hours); a backup of the game's data on the device (progress, settings, entered codes) if you chose «Лише прогрес акаунта» (only the account's progress);
• if you signed in: the id of the account that signed in last, a mark whether its profile was created before 1 November 2026, and when the device first saw that — for the account medals «Позивний» and «Перший прорив». These medals stay on the device: they never go into the account's copy of your progress or a move link;
• endless-defense results (the weekly challenge and the free shift) not sent yet: played before signing in or offline — the game sends them once you sign in;
• if you signed in: your sign-in session;
• until the tab is closed: a friend's code from an invitation link (until you answer whether to add them), technical data of a Google sign-in (to return to the «Рейтинг і друзі» screen, Leaderboard & friends) and a mark that the game has already restarted itself once after a failed load;
• during a sign-in (with Google or by the link in an email): a technical key confirming the sign-in — gone as soon as the sign-in completes;
• for the anonymous counters: the date of the first start, the label you came with (for example from the link ?s=tiktok), the day of the last signal, which first steps were already counted and your choice in «Anonymous statistics» — with no number or identifier of any kind; after 13 months the dates and the label are erased. A separate record in the first week: how far you got in the first mission (up to two losses, a new battle after them, a win) and what of that was already sent; after a week or with the statistics off this record is erased;
• the game's files, so it works offline, and the pictures of thank-you maps you already opened.

Moving to the new address. The game moved from chyste-nebo-ten.vercel.app to chystenebo.top, and the data on a device belongs to the site's address. The «Move my progress» button at the old address opens the new one with your progress, medals, entered gift codes, the thank-you code and the tips already shown in the link — in the part after «#», which the browser never sends to a server. The new address removes them from the address bar at once and adds them to the progress on the device only after you agree; if you are signed in there, what was moved syncs with the account by the rules above, and gift commanders not yet bound to another profile are bound to yours — as after entering a code. The link is not encrypted: never forward it to anyone. Like any opened link, it may stay in this device's browser history.

What is kept on the server if you sign in?

The server keeps only what sign-in, the leaderboards, friends and progress on all your devices need. Of your runs, the server gets the endless-defense runs — the weekly challenge and the free shift, including those you played before signing in — and campaign and operation battles started after signing in, for the star leaderboard; from the campaign also a copy of your progress, and nothing from the thank-you maps (below). Without an email and a nickname no online profile is created, and the whole game works without one.

• Sign-in: email, the dates of sign-up and the last sign-in. If you sign in with Google — also the Google account id, name and profile photo that Google passes to the sign-in service. The game neither shows nor uses them.
• Profile: nickname and the date of its last change, friend code, a random public profile id, the date of creation. Of that date, the server tells only you whether your profile was created before 1 November 2026 (the medal «Перший прорив»); the game never gets the date itself.
• Friends: the list of friends and the date you were linked. A friend is added when someone enters your friend code or opens your invitation link; the friendship appears for both of you, and either of you can remove it.
• Failed attempts to add a friend: how many times within an hour you entered a code that does not exist — only the number, so friend codes cannot be guessed; erased at the daily cleanup once it is a day old.
• Reports: if you reported a nickname — whom, when, which of their nicknames (by the date of change) and whether a moderator has decided.
• Moderation: whether a moderator reset your nickname (the game then asks you for another) or kept it although it matched the list of words banned in nicknames. Moderators are a separate list of accounts. The list of banned words is kept on the server and holds no player data. The server accepts no more than 20 reports a day from one player.
• Campaign progress: a copy of stars, medals, counters, records, missions, operations and map challenges completed, the guide cards opened and a mark that the tutorial is done; the copy's version number, the time of the last write and the number of writes in the last hour (to limit how often). No device settings, gift codes or saved run. Only you see the copy.
• Star-leaderboard battles: when you start a campaign mission or an operation signed in and online, the server gives the battle a token and a wave variant; after a win — the commander, stars, the battle's action log (kept only until it is checked), the times of start and submission, the verdict and how many stars counted. Tokens of battles without a win are deleted after 7 days.
• Play time: for each day — how many minutes you actively played (the game on screen and not paused) and how many runs, plus technical numbers of runs already counted, so none counts twice. Kept 90 days. The developer sees only totals (players a day, average time), not individual players; other players never see it.
• How progress reaches the account: on a device already synced with this account, the progress simply joins. A device never synced with anyone moves its progress (also what was played before signing in) into the account without asking if the account has no progress yet or the device adds nothing new; otherwise the game asks first. A device synced with another account is never joined without asking.
• Online runs: map, mode, week, wave-variant number, game version, commander, result (waves and the state in the last wave), the action log (which commands you gave and at which step of the game), the time sent, the status and time of the check, the reason for a rejection, and for a counted run the number of the endless-defense rules it was checked by (it decides the season of the weekly leaderboard).
• Gift commanders: when you are signed in, the game sends the gift code you entered to the server to bind the commander to your profile. What is kept: which commander is bound and when. The code itself is not kept — only its hash, a one-way fingerprint the code cannot be recovered from.

What does the game count anonymously?

To see where new players get lost and whether they come back, the game adds one to shared counters. The server gets only the event's name, the source label and, for a new device, the date of its first start with the number of the day. It keeps only sums, for example «of the devices that first opened the game on 20 October with the label tiktok, 12 opened the briefing».

• Events: the game opened and the title shown; the title's main button pressed; «How to play» or the guide opened; the first mission's briefing opened and «To battle» pressed, the first defense built, the first and the third wave started, the first mission won; in the first week, until the first mission is won — it lost for the first or the second time, a new battle started after a loss, won after two losses; the game installed or opened as an app; a result shared; a challenge sent or opened; the game failed to start (and a rough reason from a list: network or graphics — no error text), started (on every opening) or started on the fallback graphics; during play a crash happened or the browser took the graphics away (once per opening, no error text).
• Source label — a short word from the link (?s=tiktok), only from a list of known channels, sometimes with a post's number from 1 to 9 (?s=tiktok2) to tell posts apart — a number is never given to one person. Any other word is replaced with «other» already on the device. After reading it, the game removes the label from the address bar.
• Returns: in its first 30 days a new device reports once a day the date of its first start and how many days have passed. That shows what share came back, without any identifier.
• What is not there: no device or session id, cookies, email, nickname, account, friends, settings, game moves, gift codes or free text. The game adds neither the language, the device model nor the browser to the request; only sums reach the tables.
• How to turn it off: the «Anonymous statistics» switch at the bottom of the title screen or in the pause menu (works at once in all tabs). If your browser sends Global Privacy Control or Do Not Track, the game counts nothing.
• The request's way: the counter goes to the game's own address, served by Vercel, and from there to the Supabase database. Like any request, it passes the providers' technical logs (IP address, time, request address, browser — up to 7 days). The game's function keeps the IP address only in memory to limit how often requests come (up to 30 a minute) and writes it nowhere: the memory is cleared with the first request of the next minute or with the function itself. The database counts only the total number of calls a minute.
• The counters are approximate: cleared storage, another browser or the installed app on an iPhone count as a new device.

Who sees your data?

Other players see only your nickname and results. Their game also gets a random public id of your profile (to remove a friend or file a report) but never shows it. Your email, Google profile, run logs and reports are never shown to other players.

• Signed-in players: the weekly leaderboard and the star leaderboard — nicknames and results (all-time stars, per city and in total); your friends — also the friends' table.
• The developer and moderators: for support, handling reports and the game's safety. A moderator sees, in the game, the nicknames that were reported (how many players reported, not who) and nicknames that match the list of banned words. They can reset a nickname to a neutral name (the player then chooses another at once) or keep it.
• Providers that process data on the developer's behalf (see «Where is the data kept»). Data is never sold and never passed on for advertising, to AI models or for AI training.

Why is the data needed and on what legal basis?

The data is needed for the online features you switch on by signing in, and to keep the leaderboards fair. Without an email the online part does not work, but the game itself works fully, also offline.

• Sign-in, profile, leaderboards, friends, gift commanders, progress on all devices — to provide what you ask for when you sign in: performance of a contract (Art. 11 of the Law of Ukraine «On Personal Data Protection»; Art. 6(1)(b) GDPR).
• Emails about a thank-you code — to send the code for a contribution and, if you lose it, to send it again: performance of a contract (Art. 6(1)(b) GDPR).
• Bot protection at sign-in (Cloudflare Turnstile) — legitimate interest: to stop bots from sending code emails to other people's addresses en masse (Art. 6(1)(f) GDPR).
• Checking runs and battles, reports, rate limits, technical logs — legitimate interest: a fair leaderboard, protection against cheating and abuse, the service's security (Art. 6(1)(f) GDPR).
• The daily play-time total — legitimate interest: to understand how much time the game takes and to improve it (totals only, 90 days; Art. 6(1)(f) GDPR).
• The feedback form (Tally) — legitimate interest: to learn from players how the game plays and to improve it. Only you open the form, no question is required, and it asks for no name or contacts (Art. 6(1)(f) GDPR).
• Anonymous counters — legitimate interest: to measure the game's audience for its developer only, in aggregate numbers without identifiers, with a way to opt out (the switch in the pause menu, GPC/DNT); the record on the device serves only this and lives no longer than 13 months (Art. 6(1)(f) GDPR).

Where is the data kept and who processes it?

The main storage is in the EU, in Ireland: the database, sign-in and their backups. Six providers process data on the developer's behalf, each only within its own task.

• Supabase — database and sign-in; the data is stored in Ireland.
• Vercel — serves the game's files from the server nearest to you, checks online runs and takes the anonymous counters on a server in Dublin.
• Resend — sends the email with the sign-in code: it sees your address and the email.
• Cloudflare (Turnstile) — only on the email sign-in form: checks that a person, not a bot sending emails to other people's addresses, asks for the code. For this Cloudflare processes the IP address, browser data (including the User-Agent and a technical fingerprint of the connection), the site's address, and may set its own technical cookies. The game gets only a one-time token and passes it to Supabase, which checks it with Cloudflare together with your IP address. Cloudflare's terms apply (Turnstile Privacy Addendum). Signing in with Google has no such check.
• Google — only if you choose «Увійти через Google» (sign in with Google) or write to the author about a thank-you code (the author's mail is Gmail). During a sign-in Google may use its own cookies; Google's terms apply.
• Tally — the feedback form, only if you open it yourself: the «Share feedback» button after a won mission or the link on the «Про гру» page, in a new tab. The form asks for no name, age or email, and the game passes nothing to it — not even the address of the page you came from. Tally keeps your answers and, like any website, processes the IP address and browser data; the company is in Belgium, the data is stored in the EU.

The «Support the game» button opens the transfer page of Privat24 (PrivatBank) in a new tab. The game passes nothing to it — not even the address of the page you came from — and learns nothing about the transfer. What you enter on the bank's page is processed by the bank under its own rules. «Copy» puts the card number of the envelope into your device's clipboard only.

Thank-you code. After a contribution of 50 ₴ or more the author sends a code for the thank-you maps by email. For this you write to sashko1391@gmail.com: the author's mail (Gmail, Google) keeps your address and the email — to send the code and, if you lose it, to send it again. The game checks the code itself on the device and sends it nowhere.

Supabase, Vercel, Resend, Cloudflare and Google are US companies. They and their subprocessors may process data outside the EU too, for example for support and security, under their data processing agreements with the EU Standard Contractual Clauses. Where to read these agreements and clauses, the developer tells on request by email.

How long is the data kept?

Server data is kept as long as your profile exists. After the profile is deleted, the data leaves the database at once and its backups within 7 days. Emails and technical logs go in their own time (below).

• A rejected run's log is erased right after the check; a counted run's log at the daily cleanup once 30 days have passed since the check (to check the run again if the check itself turns out wrong). The result on the leaderboard stays.
• A report — until the moderator's decision and 30 days after it; a report on a nickname the player has changed since — 30 days after the change.
• Anonymous counters — daily sums — 400 days (over a year, to compare seasons); the record for them on the device — up to 13 months.
• Sign-in code emails are kept at Resend for up to 30 days.
• Emails with the author about a thank-you code — up to 12 months after the last email, so the code can be sent again; deleted earlier on request.
• Feedback form answers — up to 6 months: the developer reads them, deletes them in Tally and empties Tally's bin at once; they leave Tally's backups within 90 days.
• The providers' technical logs (IP address, time and address of a request, and for run checks the player's and the run's ids and the verdict) — up to 7 days. A request's address may carry a friend's code from an invitation link, a technical sign-in code or a gift code from an old link of the kind ?gift=. New gift links carry the code after #, so it never reaches a request's address (the game sends it to the server only after you sign in — to bind the commander). The run-checking function, like the counters, keeps the IP address only in memory to limit how often requests come (up to 30 a minute) and writes it nowhere: the memory is cleared with the first request of the next minute or with the function itself.
• Data on the device — until you delete it. The technical data (session, unsent results, saved run, invitation code) the game removes by itself when no longer needed.
• After a profile is deleted, a gift code can be bound to a new profile again. The database keeps only the code's hash and the time of its first use, with no link to you.

How to delete your data?

The profile is deleted in the game itself, the data on the device in the browser's settings. These are two separate steps: deleting the profile does not erase the progress on the device.

1. Open «Рейтинг і друзі» (Leaderboard & friends) → the «Профіль» tab (profile) → «Видалити профіль» (delete profile) and press again to confirm. The profile, results, battles and leaderboard stars, play time, friends, reports, commander bindings and the copy of the campaign progress are gone. You can also write to the email — for example to get a copy of your data.
2. To erase the progress, its backup, the saved run, entered codes, unsent results and the record for the anonymous counters on the device, clear the site's data in the browser's settings. Uninstalling the installed game may not erase the data: in Chrome, tick «Also delete data» when uninstalling.

A feedback form answer is anonymous: to delete it earlier, write to the email when you sent it and roughly what it said — the developer will find and delete it. The anonymous counters are linked to no one, so finding and deleting «yours» among them is impossible — there is nothing of yours. For the game to count nothing at all, turn off «Anonymous statistics» on the title screen or in the pause menu.

How does the game protect children's privacy?

Children play the game too, so its online part is careful: other players see only a nickname and results, there is no chat, no private messages and no player search, friends are added only by code, nicknames are checked against a list of banned words, and a nickname can be reported.

• Do not put your real name in your nickname.
• Signing in by email passes no name or photo to the game, unlike signing in with Google.
• The anonymous counters hold no name, email, account or any identifier of a child; they can be turned off on the title screen or in the pause menu.
• The feedback form asks for no name, age or contacts — do not write them in your answers.
• The game's rule: if you are under 16 years old, sign up only with the permission and help of a parent or guardian.
• Parents can write to sashko1391@gmail.com to learn what data there is or to delete a child's profile.

What are your rights?

You can learn what data about you there is and control it. For most rights, writing to the email is enough; the nickname and deleting the profile are available right in the game.

• to get information about your data and a copy of it, also in a machine-readable form;
• to correct your data: the nickname in the profile, the rest by email;
• to delete your data;
• to restrict processing or object to processing based on legitimate interest;
• to complain: in Ukraine — to the Ukrainian Parliament Commissioner for Human Rights; in EU countries where the GDPR applies — to the local data protection authority.

How to learn about changes?

If the game starts keeping new data, this page and the Ukrainian one are updated before the change goes live. The date of the last update is at the top of the page.