Version of 2026-09-30
This notice explains what personal data Colossal Dungeon processes when you visit this site and play, why, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP, revDSG) and, where it applies to you, the EU General Data Protection Regulation (GDPR).
The operator of Colossal Dungeon is the controller:
When you load the site, Cloudflare delivers its pages; when you play, your device connects through Cloudflare to the game server. Your IP address and technical details of each request (time, requested address, browser type) are processed for this and may be recorded in the logs of Cloudflare and of the tunnel and proxy that connect Cloudflare to the game server. The game server also keeps your IP address in memory to limit how many connections and requests one address can make (rate limiting). It is not written into the gameplay records and is gone when the server restarts.
Purpose: to deliver the game, keep it secure and stop abuse. Legal basis under the GDPR: legitimate interests (Art. 6(1)(f)).
While you play, the server records anonymous gameplay events, for example that a character of a certain class joined or left, its level, fights and deaths, with the time. A character appears only as an in-game number that changes with every death. No IP addresses, names, accounts or device identifiers are recorded. The records are used to balance and improve the game, and deleted after 90 days. They are kept outside the operator's routine backups.
Legal basis under the GDPR: legitimate interests (Art. 6(1)(f)).
The game keeps three small settings in your browser's local storage: that you confirmed you are 18 or older, that you have seen the first-time hint, and whether the sound is off. They never leave your device; clearing this site's data in your browser deletes them.
While a tab plays, its session storage keeps your class, the floor your character is on and a random code the server gave that character; while you go down to the next floor, the code is a one-time pass for it instead. Whenever this tab enters the dungeon again with the same class, for example after a reload, it sends the code to the game server, so a character of yours still standing there becomes yours again instead of a new one. The server keeps the code in memory only while that character remains, at most until it restarts. A one-time pass is valid for 30 seconds; the server deletes it when it is used, at the next descent of any player after it expired, or at the latest when it restarts. The code means nothing outside the game. The browser deletes it with the tab's session; a tab the browser restores can bring it back.
The game sets no cookies. Cloudflare may set a strictly necessary security cookie (such as
__cf_bm) to tell people from bots.
There are no accounts, no chat, no payments, no advertising, no analytics or tracking tools and no profiling, and no data is sold. The game is for adults (18+) only.
The game server runs on the operator's own computer. Cloudflare, Inc. (USA) hosts the web pages, connects the game server to the internet and protects both (network, encryption, protection against attacks), and processes connection data for the operator as a processor. Your data may therefore be processed in the United States and other countries where Cloudflare operates. For transfers to the United States Cloudflare is certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and the UK Extension; for other countries its data processing addendum uses the EU Standard Contractual Clauses. See Cloudflare's privacy policy. Nobody else receives your data unless the law requires it.
You can ask for access to your data, its correction or deletion, restriction of or objection to its processing, and a copy of data you provided. Because there are no accounts, the operator can often only find data about you if you say roughly when you played and from which IP address. You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU or EEA, to the data protection authority of your country.
Contact: the operator's e-mail above.
This version covers the early-access launch. Before the game adds accounts, chat, payments or ads, this notice will be updated.