Privacy

This is a plain-language summary, written so it can be read in a minute. The formal privacy notice is the authoritative document and is the one that applies; this summary has no legal effect of its own. Where the two differ, the formal notice governs.

The short version

You can play this game without giving us anything. Press PLAY NOW and you get a guest account with a made-up name; we never ask for your email address and you never choose a password.

If you do make an account, or if you arrive through a game portal, we store a bit more — and the anti-cheat system stores your IP address and a characteristic of your browser, because a game where cheating cannot be traced stops being fun for everyone else.

We do not sell anything to anyone, we run no advertising network of our own, and there are no trackers on this site.

Who is responsible

Cosmic Survivor is made by RN Games (Ruben and Nathan) and runs on cosmicsurvivor.nl. For anything in this document, including a request to see or delete your data, write to support@cosmicsurvivor.nl.

What we store

If you play as a guest

• A username we generate for you, such as Guest-RRCYFG.
• Your progress: starcoins, ship upgrades, zones, score.
• A session in your browser, so a refresh does not throw you out.

No email address and no password. A guest account lives in your browser: clear your browser data and it is gone, and we cannot get it back for you. The Clear guest session button in the game deletes it on purpose.

If you make an account

• Your username and your email address.
• Your password, stored as a hash — we never see the password itself and cannot recover it.
• When you signed up and when you last logged in.
• If you switch on two-factor: the secret your authenticator app needs, and your backup codes.
• If you tick “stay logged in”: a token in your browser that identifies that device.

If you arrive through a game portal

When you play on CrazyGames and you are logged in there, we receive a signed token from them containing your CrazyGames user id, your username and the link to your avatar. We create an account with that, so your progress follows you between devices. We do not get your email address from them, and we do not store anything on their side.

On cosmicsurvivor.nl itself no request whatsoever goes to CrazyGames. Their script only loads inside their own frame.

While you play

• Your progress, your ship, the zones you hold, your team and your daily missions.
• Chat messages, with the zone and the time, and which word was blocked if the filter caught one.
• Reports you make with /report, and reports other players make about you: who reported whom, the reason typed, the chat lines around that moment and a recording of the zone. The player you report is never told who reported them.
• Recordings of what happened around your ship, for the anti-cheat system.

Anti-cheat (RN-Guard)

This is the part that stores the most, and it is the part that keeps the game playable.

• Your IP address, so a banned player cannot simply come back.
• A characteristic of your browser — a value computed in your own browser from things like your screen and your font list. It is not a name and not an identity; it only says “this is probably the same device as before”.
• Recordings of gameplay, so a moderator can watch back what actually happened instead of taking someone's word for it.
• Signals from the automatic detection, penalties handed out, and appeals against them.

Some of that detection runs by itself. If it is ever set to act on its own, a penalty can be applied without a person looking first. You can always get a person to look: write to support@cosmicsurvivor.nl with the case number on your screen. The appeal button in the game appears for every automatic ban, and for a moderator's ban over 14 days or a permanent one. It does not appear on a warning or a five-minute removal, because a formal procedure on those is a queue nobody gets through. See clauses 6.3 and 6.4 of the formal notice.

How long we keep it

These are the values the code actually runs on. A moderator can change some of them; if that happens, this page is updated with them.

Who else sees something

Four, and no more than four.

What we deliberately do not do

• No advertising network of our own, no sponsor banners, no tracking pixels.
• No advertising profile. ByteBrew above counts how the game is played so we can see where people get stuck; it is not linked to your account, your name or your email address, and it is never used to target you with anything.
• We do not store anything on the CrazyGames side. Your progress is ours and stays in our database.
• We do not sell or hand over data. The only exception would be a legal obligation.

Cookies

Only the ones the game cannot work without: a session cookie, and — if you tick it yourself — a “stay logged in” token. No cookie on this site exists to follow you around.

Inside a game portal that cookie does not work, because a browser does not send it to a page inside someone else's frame. There the session travels in a request header instead. Same purpose, same lifetime.

Your rights

You can ask to see what we have about you, to correct it, or to delete it. Write to support@cosmicsurvivor.nl from the address on the account, or mention your username.

Two honest caveats. If you are blocked, we keep the evidence for that block for as long as the table above says, even if you ask us to delete your account — otherwise a ban would be erased by asking. And a guest account has nothing we can identify you by, so we cannot look it up for you; the Clear guest session button in the game is the way to delete it.

If you think we are getting this wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Age

Cosmic Survivor is meant for players of 13 and older. There is no age check; chat and usernames go through a word filter and a moderator can act on what gets through.

Changes

If we start storing something else, this page changes with it and the date at the top moves. There is no mailing list for that.

Privacy notice

Cosmic Survivor · version 1.0 · in force from 19 September 2026

1. Status of this notice

1.1 This notice is the authoritative statement of how RN Games processes personal data in connection with the game Cosmic Survivor.

1.2 A plain-language summary of this notice is published on the same page for convenience. That summary has no independent legal effect. Where the summary and this notice differ, or where the summary is silent, this notice governs.

1.3 This notice can be referred to directly at https://cosmicsurvivor.nl/privacy.html?legal. Printing this page produces this notice and not the summary.

2. Controller and contact

2.1 The controller is RN Games, operator of the website cosmicsurvivor.nl and of the game Cosmic Survivor.

2.2 All requests and questions under this notice, including requests under clause 10, should be sent to support@cosmicsurvivor.nl.

2.3 No data protection officer has been appointed; the controller is not required to appoint one.

3. Scope

3.1 This notice applies to the game as offered on cosmicsurvivor.nl and to the same game where it is embedded in a third-party games portal.

3.2 Where the game is embedded in such a portal, the operator of that portal is a separate and independent controller in respect of its own processing of your visit. That processing is governed by that operator's own privacy notice and is outside the scope of this one.

4. Categories of personal data

5. Purposes and legal bases

5.1 Providing the game, creating and maintaining your account and retaining your progress — performance of a contract with you, Article 6(1)(b) GDPR.

5.2 Authentication, two-factor verification and rate limiting of login attempts — legitimate interests, Article 6(1)(f) GDPR, namely protecting user accounts against unauthorised access.

5.3 Detecting, investigating and acting on cheating, abuse and circumvention of restrictions — legitimate interests, Article 6(1)(f) GDPR, namely keeping the game fair and playable for its users. In balancing that interest against your rights, the controller has limited the categories of data used, applies the retention periods in clause 9, and provides review by a natural person under clause 6.3.

5.4 Moderating chat, including automatic word filtering and the retention of blocked messages for review — legitimate interests, Article 6(1)(f) GDPR, namely protecting users from abusive content, and Article 6(1)(b) GDPR.

5.5 Sending you notifications by email about zones you hold — legitimate interests, Article 6(1)(f) GDPR. Every such message contains an unsubscribe link that requires no login, and the setting can also be switched off in the game.

5.6 Sending transactional email, in particular email address verification — performance of a contract, Article 6(1)(b) GDPR.

6. Automated processing

6.1 Gameplay recordings are analysed automatically for indications of cheating.

6.2 That analysis operates at one of three levels per detector: recording only; recording and referral to a human moderator; or recording, referral and the automatic imposition of a restriction. Where the third level is in effect for a given detector, a restriction may be imposed without prior human intervention.

6.3 In respect of any restriction, including one imposed under clause 6.2, you may obtain intervention by a natural person by contacting the address in clause 2.2 and quoting the case number shown to you. That person reviews the case, including the recording of the period concerned. You may express your point of view and contest the decision.

6.4 In addition to clause 6.3, a formal appeal procedure is offered within the game, at the point where the restriction is shown. That procedure is available for permanent restrictions; for restrictions imposed by a moderator exceeding 14 days; and for any automatically imposed restriction exceeding 1 day, which in practice means every automatic ban. For restrictions below those thresholds, and for warnings and removals from a session, review is obtained under clause 6.3 rather than through that procedure.

6.5 No personal data is used for profiling for marketing purposes, and no automated decision is taken that produces legal effects concerning you.

7. Recipients

7.1 Google (Google Fonts, fonts.googleapis.com and fonts.gstatic.com) — delivery of two typefaces used by the game page. Google receives your IP address and the technical metadata of that request whenever the game page is opened. Other pages of the website, including this one, do not make that request.

7.2 Resend (smtp.resend.com) — delivery of email on behalf of the controller. Receives your email address and the content of the message.

7.3 The controller's hosting provider, in its capacity as processor for the operation of the servers.

7.4 Where the game is embedded in a games portal, the software development kit of that portal is loaded from that operator (at present CrazyGames, sdk.crazygames.com) and the operator processes your visit as an independent controller; see clause 3.2. That kit is not loaded when the game is played on cosmicsurvivor.nl.

7.5 ByteBrew (web-platform.bytebrew.io) — product analytics, as processor. Receives a pseudonymous identifier generated by that kit and stored in your browser, a session identifier, the game version, the platform (“Web”), your screen size, and the names of the in-game events listed in assets/js3d/analytics.js. It does not receive your username, your email address, your account identifier or the content of any message. Processing may be prevented in its entirety by the controller through the feature flag analytics, in which case the kit is not loaded at all.

7.6 Personal data is not sold, rented or made available for advertising purposes. Disclosure to any other party occurs only where required by law.

8. Transfers outside the EEA

8.1 The recipients named in clauses 7.1, 7.2 and 7.5 may process personal data outside the European Economic Area. Such transfers take place on the basis of the transfer mechanism offered by the recipient concerned, being an adequacy decision of the European Commission or the European Commission's standard contractual clauses.

9. Retention

9.1 Personal data is retained for no longer than is necessary for the purposes set out in clause 5, and in any event for no longer than the periods below.

9.2 The periods in the table above correspond to the values applied by the software. Where an administrator changes a configurable period, this notice is updated accordingly.

10. Your rights

10.1 You have the right to request access to your personal data, and its rectification or erasure; to request restriction of processing; to object to processing carried out on the basis of legitimate interests; and to receive the data you provided in a structured, commonly used and machine-readable format.

10.2 Requests are made to the address in clause 2.2. To prevent disclosure to the wrong person, the controller may ask you to make the request from the email address registered to the account, or to identify the account in another way.

10.3 A guest account is created without any identifying data. The controller is therefore unable to identify such an account on request and, under Article 11(2) GDPR, the rights in clause 10.1 do not apply to it. A guest account can be deleted by the user by means of the function provided in the game.

10.4 Where a restriction has been imposed, the enforcement records and the associated recording are retained for the period in clause 9 notwithstanding a request for erasure, on the basis of Article 17(3)(e) GDPR and the legitimate interest in clause 5.3. Erasure on request would otherwise remove the record of the restriction itself.

10.5 You have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.

11. Cookies and local storage

11.1 A session cookie is set as strictly necessary for the operation of the game. It contains no information beyond a session identifier.

11.2 A persistent login token is set only where you select that option yourself.

11.3 Local storage in your browser is used for preferences such as the graphics level. That data is not transmitted to the controller.

11.4 Where the game runs inside a third-party frame, the session cookie is not transmitted by the browser and the session identifier is carried in a request header instead. The purpose and lifetime are unchanged.

11.5 No cookie or comparable technique is used for advertising, analytics or cross-site tracking.

12. Children

12.1 The game is intended for users aged 13 and over. No age verification is carried out.

12.2 If you believe that a person below that age holds an account, contact the address in clause 2.2 and the account will be deleted.

13. Amendment

13.1 This notice may be amended. The version number and the date of entry into force at the head of this notice indicate the applicable version.

13.2 Where an amendment materially changes the categories of data processed or the purposes of processing, it is announced within the game.