Privacy Policy
- We collect what LeetKO needs to run: your email, username, sign-in details, match results, and friends.
- We do not sell your information, and we do not show ads today.
- You can download your data or delete your account at any time from your profile.
Who we are
LeetKO is a browser game run by Jake Lee, an individual based in Singapore ("we", "us"). We are responsible for the personal information described here. Contact us at support@leetko.com. For Singapore's Personal Data Protection Act, Jake Lee is our data protection officer and can be reached at the same address.
What we collect
Information you give us
- Account details: your email address, your password (we store only a salted hash, never the password itself), and the username you choose.
- Google or Microsoft sign-in: if you use or connect one, we receive your name, email address, profile picture link, and the ID that provider uses for you. We also receive sign-in tokens from the provider; we store them encrypted and do not use them to access anything else in your account.
- Code you type in online matches: each edit is sent to our server so it can score attacks fairly. Your opponent sees your attacks, not your code.
- Messages to us: anything you include when you email us.
Information created when you play
- Match results: the date and time, the challenge, the outcome (win, loss, or draw), and which account you played against.
- Profile and social: your armor color, your friends, friend requests you send or receive, and the last time the game was open while you were signed in.
- Private rooms: a scrambled (hashed) copy of each room code you create.
Information collected automatically
- Sign-in sessions: for each device you sign in on, we store your IP address, your browser's user-agent string, and when the session started and expires.
- Network data: our hosting provider, Cloudflare, processes IP addresses and request details to deliver the site and protect it from attacks.
- Visit statistics: Cloudflare Web Analytics counts page views, where visits come from (country and referring site), and how fast pages load. It does not use cookies or track you across other websites.
How we use it
- To create and run your account, sign you in, and keep you signed in.
- To email you links that confirm your email address or reset your password. We do not send marketing email.
- To run matches: matchmaking, scoring attacks, and recording results.
- To show your profile, battle history, friends, and "Online recently" status.
- To keep LeetKO secure and fair: preventing abuse, investigating cheating, and fixing bugs.
- To reply when you contact us, and to meet legal obligations.
If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are: performing our contract with you (running the game you signed up for), our legitimate interests (security, fairness, and improving LeetKO), your consent (for anything we ask permission for, such as advertising cookies if we add them), and legal obligations.
What other players can see
- Your opponents see your username, armor color, and the match as it happens. They do not see your code or your email.
- Anyone signed in who enters your exact username can see your username and whether you were online recently. Your friends see the same in their friends list.
- We never show your email address to other players.
Who we share it with
We do not sell your personal information. We share it only with services that help us run LeetKO:
- Cloudflare, Inc. hosts the game, its database, and its network. Your information is stored on Cloudflare's infrastructure. When you sign up, sign in with a password, or ask for an email link, Cloudflare Turnstile checks that a person is making the request; it receives your IP address and information about your browser and device for that check only.
- Resend, Inc. sends our account emails. It receives your email address and the email itself, which contains a one-time link, and keeps delivery records for up to 30 days.
- Google and Microsoft, only if you choose to sign in with them. They handle that sign-in under their own privacy policies.
- jsDelivr, a public content delivery network. Your browser downloads the Python runtime from it, so it receives your IP address and browser details.
We may also disclose information if the law requires it, to protect players or LeetKO from harm, or as part of a transfer if LeetKO changes ownership. We would tell you before your information became subject to a different privacy policy.
Advertising
LeetKO does not show ads today. We plan to add them in the future using Google AdSense. Before ads go live we will update this policy and, where the law requires it, ask for your consent first.
When ads are on, third-party vendors, including Google, will use cookies to serve ads based on your prior visits to LeetKO and other websites. Google's use of advertising cookies lets it and its partners serve ads based on your visits to LeetKO and other sites. You will be able to opt out of personalized advertising at Google Ads Settings and learn more at How Google uses information from sites that use its services. A "Privacy choices" option in your profile will let you change your consent at any time.
Cookies and storage on your device
- Session cookie: keeps you signed in. It is strictly necessary, so it does not need your consent.
- Sign-in security cookie: set briefly while you sign in with Google or Microsoft to prevent forged sign-ins.
- Browser storage: your sound, music, and screen-shake settings and your latest Training recording. These stay on your device and are never sent to us.
We do not use analytics or advertising cookies today. Our visit statistics (above) work without cookies.
How long we keep it
- Account, profile, match results, and friends: until you delete your account.
- Sign-in sessions (including IP address): a session expires about 7 days after you last use it, and we delete expired sessions every day. Signing out deletes that session immediately.
- Live match data, including your code: deleted automatically about 24 hours after the match's last activity. Your result stays with your account.
- Private room codes: expire after 30 minutes and are deleted within a day.
- Email links: a link to confirm your email expires after 24 hours and a password-reset link after 1 hour. Expired links are deleted within a day.
- Backups: our database provider keeps recovery copies for up to 30 days, so deleted information can remain there until it ages out.
Your choices and rights
- Download your data: Profile, then Download my data.
- Delete your account: Profile, then Delete account. This removes your account, profile, match history, friends, and sign-in methods. Opponents keep their own results, with your account ID removed.
- Everything else: email us to correct information, object to or restrict how we use it, or withdraw consent.
Depending on where you live, you may have rights to access, correct, delete, or move your information, and to object to certain uses. We will answer within one month and may need to confirm your identity first. You can also complain to your local data protection authority; in Singapore, that is the Personal Data Protection Commission.
If you live in California or another US state with a privacy law: we do not sell your personal information, and we do not currently share it for cross-context behavioral advertising. If we add personalized ads, we will give you a way to opt out.
Children
You must be at least 13 years old to create a LeetKO account. If you are under the age of digital consent where you live (for example, 16 in some European countries), you need permission from a parent or guardian. If we learn that we collected information from a child under 13, we will delete it. Parents can contact us at support@leetko.com.
Security
We use HTTPS everywhere, store passwords only as salted hashes, encrypt provider sign-in tokens, and limit who can access the database. When you choose a password, we check it against the Have I Been Pwned list of leaked passwords. Only the first five characters of a one-way hash of the password leave our server, so the service never learns your password or who you are. No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.
International transfers
Cloudflare operates worldwide and Resend is based in the United States, so your information may be processed outside your country, including in the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission's standard contractual clauses in each provider's data processing terms.
Changes to this policy
If we change this policy, we will update the date at the top. For significant changes, such as turning on ads, we will tell you in the game before the change takes effect.
Contact
Questions or requests: support@leetko.com. See also our Terms of Service.