Privacy policy

Who we are

The AECE Studio makes PROTEST, a shooter you play in a web browser at protest.theaecestudio.com. This policy covers the game, its online services and this website. Contact us at theaece@theaecestudio.com (primary) or theacemcquid@gmail.com (backup).

Offline play

Matches against AI run entirely in your browser. They send nothing to us and need no account.

Your account

The first time you play online, the game creates a guest account with a display name (the name you chose in settings, or "Guest" and a number) and a random friend code. If you later register, you add a username and a password. We never ask for your email address or real name.

• Your password is stored only as a salted scrypt hash. We cannot read it.
• Signing in gives your browser a session token that lasts 30 days. We store only a hash of it, and delete expired sessions every hour.
• Your progress is kept with your account: level and experience, match counts, kills and wins, weapon stats, achievements, challenges, season track progress, cosmetics you have unlocked, ranked rating, and a history of your last 30 matches (mode, map, result, kills, deaths, damage and experience).
• We also keep a hidden skill rating for casual matchmaking, updated after each completed match, so the game can put you in fair matches.
• Your friends list and friend requests are stored so they persist. Friends can see whether you are online and which match you are in. Online status and parties exist only in our server's memory and are not stored.
• Leaderboards are public: they show your display name, level and the ranked value being listed.

Online play and matchmaking

When you look for a match, we place you in a queue with your display name, account ID, ratings and equipped cosmetics, so the match server can seat you correctly. We use your IP address to pick a match server close to you; it is sent to our match-hosting provider for that purpose and removed from the queue once your match starts or you leave. Completed queue records are kept for 24 hours to handle reconnections.

We record each match result against your account, and keep anonymous matchmaking records (team strengths, wait times and rating spread, with no account IDs or names) to tune match quality.

Our servers use your IP address to limit request rates and stop abuse. These counters are kept in memory only.

Voice chat and reports

Team voice is optional push-to-talk, and your microphone starts muted. Audio goes directly between teammates' browsers. When a direct connection is not possible it may pass through our relay server, which forwards it without storing it. We do not record, transcribe or analyse voice. When you connect directly, a teammate's browser can see your network address, as with any direct browser call.

If you report a player, we store your name and account ID, theirs, the match, the reason you chose, any details you typed (up to 500 characters) and the time. Reports never include audio. We review reports to keep matches safe.

Private matches you host

When you host a private match, your browser runs the match and your friends connect to it directly. Our server only helps the browsers find each other. Like voice chat, a direct connection lets each player's browser see the other's network address. To set up these connections the game may contact a public Google STUN server, which sees your IP address.

Stored on your device

Your browser keeps your session token and account details, your settings (including your player name), and offline progress in local storage. If you install the game, its service worker caches game files so it starts faster; it never caches your account data. You can remove all of this by clearing the site's data in your browser.

PROTEST sets no cookies. Cloudflare, which delivers the game and this website, may set essential security cookies, and adds its Web Analytics script, which measures page visits and loading performance without cookies and without identifying you.

Who we share information with

We do not sell your information or share it for advertising. These providers process it on our behalf:

• Cloudflare delivers the game, this website and the connection to our servers, and provides cookieless Web Analytics on these pages.
• Edgegap runs online match servers. It receives the IP addresses of players in a match for placement, and the match server receives the players' names, account IDs, ratings and cosmetics.
• Our own server, a rented virtual private server, runs the game's services and database.
• Encrypted backups of the database are uploaded to cloud storage. They are encrypted and signed before they leave our server.
• Google operates the STUN server mentioned above.

We may disclose information if the law requires it, or to protect players and our services from serious harm.

Retention and security

• Sessions: 30 days, then deleted.
• Queue data: removed when your match starts, with completed records kept for 24 hours.
• Your account, progress, match results and friends: kept until you ask us to delete them.
• Reports: kept while we review them and for as long as needed to deal with repeated abuse. We delete them on request where we can do so safely.
• Backups: deleted information can remain in encrypted backups until those backups are removed.

Connections to our services are encrypted, passwords and session tokens are stored only as hashes, and the database is reachable only from our server.

Your choices

• See your profile, progress and match history in the game.
• Sign out on any device to end that session.
• Ask us for a copy of your data, a correction, or deletion. See account and data deletion.
• Leave voice chat off, mute any teammate, or play offline only.

Younger players

PROTEST is a shooter with gunfire and combat, and it is not meant for children under 13. We do not knowingly collect information from them. If you believe a child under 13 has an account, email us and we will delete it.

Contact and updates

We will update this policy when the game changes, for example before any shop opens, and change the effective date above. For questions or requests, email theaece@theaecestudio.com or theacemcquid@gmail.com.