Streets of Clubbing

Streets of Clubbing, by Sky Elemental

Privacy policy

Last updated

We collect as little as we can. You can play on your own without giving us anything at all. Online play needs an email address, a nickname and your phone's model name, and other players and the public leaderboards see your nickname and your scores; the details are below. There are no ads, no analytics and no tracking in the game, on this website or in our emails, and we don't sell your data or share it with anyone except the companies that run our services for us.

Who we are

Streets of Clubbing is made by SKY ELEMENTAL LIMITED ("Sky Elemental", "we"), a private limited company registered in England with company number 15710186. Our registered office is Suite 8 Stonebridge House, Main Road, Hockley, Essex, England, SS5 4JH. We are the data controller for the game, its online service at play.streetsofclubbing.com and this website. For anything about your data, email privacy@skyelemental.com.

Playing solo or local co-op

Solo play runs entirely on your phone. It needs no account and no connection, and it sends us nothing, so solo runs never go on the leaderboards.

Local co-op runs between phones on the same Wi-Fi or one phone's hotspot. The host's phone runs the game and the others connect to it directly, finding it by the room code; nothing goes to our server or anyone else, nobody signs in, and players are known only by their place in the game (P1, P2 and so on). Like solo, local co-op records nothing.

The game keeps your settings on your phone: the music volume, the sound effects volume, the size of the touch controls, left-handed mode, whether blood is shown, haptics, screen shake, the character you last picked and whether you've seen How to play. They never leave the device.

The app asks Android for 4 permissions and no others: internet access, for online play; vibration, for haptics; network state, to find the Wi-Fi or hotspot local co-op can use; Wi-Fi broadcasts, so phones in a local co-op game can find each other. It contains no advertising, analytics or crash-reporting code.

Playing online

Online play needs an email address to sign in with; there are no passwords. (Solo play needs none.)

Your email address

We email you a sign-in link and a 6-digit code, and we use your address to recognise your account next time. It's stored in our database in lower case, because we need it to send you those emails. It is never shown to other players and never used for marketing: the only emails we send are sign-in emails, when someone asks to sign in with your address, and deletion links, when someone asks on the web to delete the account with your address.

Your device's name

When you sign in, the app sends your phone's maker and model as Android reports them, for example "ONEPLUS A6013" or "Google Pixel 6". It appears in the sign-in email and on the approval page, so you can tell which device is asking, and it's stored with each sign-in.

Your nickname

You choose a nickname of 3 to 12 characters. Other players see it in rooms and on the public leaderboards. You can change it any time from Account → Change nickname.

Your sign-in

Signing in gives your phone a random sign-in token, which it keeps in the app's private storage (left out of Android backups). Our server keeps only a keyed, one-way hash of it, the device name, when it was created and last used, and a keyed hash of the network it came from (see Logs, limits and security). A sign-in lasts 60 days from when you last used the online features, and never more than 180 days. Signing out ends it straight away, if the app can reach our server.

While a sign-in is waiting to be approved, we hold your email address, the device name, the match phrase the app shows you, keyed hashes of the link, the code and the app's polling secret, and how many codes have been tried.

What happens in a room

In an online room, your phone sends the server your controller inputs (stick direction and buttons) and the server runs the game. Other players in the room see your nickname, your character and how you're doing. Inputs aren't stored once the game has used them.

Scores and leaderboards

When an online room finishes a stage, or the whole room is knocked out on one, the server records the run: the stage, how many players took part, whether the stage was cleared, and when the run started and ended. For each signed-in player who took part it records the account, the character they played and their score. Rooms with friendly fire turned on are never recorded.

The leaderboards are public: anyone can see them, in the game or through our online service. Each entry shows the player's nickname, character and score, the size of the room, whether the stage was cleared, and the date and time the run ended. Only your best run for each stage and room size (1, 2–4, 5–8 or 9–16 players) is shown.

Logs, limits and security

Our server logs each request by its type, its result and how long it took. Its logs refer to accounts, sign-ins and sign-in requests by their random identifiers, and to an email address only by a keyed pseudonym, which can't be turned back into the address without our secret key. They never contain email addresses, IP addresses, web addresses (sign-in links contain secrets), sign-in codes or tokens. Logs are rotated by size, not by age: the oldest are deleted as new ones fill the space set aside for them, so how long an entry lasts depends on how busy the server is.

To stop anyone using the sign-in or deletion forms to flood inboxes or lock people out, we count sign-in and deletion requests per email address and per network. These sign-in and deletion-request counters are stored under keyed hashes, not the addresses themselves, and are deleted when their window ends, within 24 hours. Each sign-in also stores a keyed hash of the network it came from (your IP address, or the first part of an IPv6 address), used only to recognise a network you've signed in from before, so that the limits can't lock you out of your own account. That hash is pseudonymous: it can't be turned back into your address without our key. Your IP address itself is held briefly in the server's memory for rate limiting, and is never written to disk.

Everything between the app and our server is encrypted (HTTPS and secure WebSockets). Stored secrets are hashed with a key that is not stored in the database.

Who else handles your data

These companies process data for us, under contract, only on our instructions and only to provide these services:

  • IONOS hosts our server and database, where the data on this page is stored.
  • SMTP2GO sends our emails. It handles your email address and the email's content (the link, the code and your device's name), and keeps each email's headers (who it went to, and its subject) for 35 days. Open and click tracking are turned off for our emails. Our account is in SMTP2GO's EU region: our emails go out through its European servers and it stores their data in the EU. It runs its service on Google Cloud and Amazon Web Services.
  • Fasthosts hosts the mailbox your emails to privacy@skyelemental.com arrive in.

We don't sell your data, share it with advertisers, or use it to profile you.

Outside the UK and the EU

SMTP2GO is a New Zealand company, and New Zealand has an adequacy decision from both the UK and the EU, which recognises its data protection as equivalent to theirs. If SMTP2GO or its providers (Google Cloud and Amazon Web Services) process your email address or our emails to you outside the UK and the European Economic Area, they do so under the safeguards in SMTP2GO's data processing agreement with us. Our other processors handle your data in the UK or the EU.

Why we're allowed to

We rely on our legitimate interests for everything on this page, and weigh them against yours like this:

  • Running your account and the games you play online (your email address, device name, nickname, sign-ins, room inputs and scores): this is the service you asked for by signing in. We use no more than it needs, never for marketing, and you can delete your account whenever you like.
  • The public leaderboards (your nickname, characters and scores): they're part of the game every online player takes part in. You choose the nickname they show, and deleting your account takes your name off them.
  • Security and preventing abuse (the sign-in counters, network hashes and logs): stopping the sign-in form being used to flood inboxes or lock people out protects you as much as us. These hold pseudonyms, not addresses, and are kept only as long as they're useful.
  • Backups: being able to recover from a failure protects your account and your scores. Backups are kept for the shortest time that still lets us recover, as set out below.

You can object to any of this; see Your rights.

How long we keep it

Our server clears out whatever has outlived the times below every 5 minutes, so each thing goes within 5 minutes of its time.

  • Your account (email address and nickname): until you delete it.
  • Sign-ins: deleted when they expire, when you sign out, or when you delete your account.
  • Sign-in requests: a request expires 15 minutes after it's made, and is deleted 60 minutes after that.
  • Sign-in and deletion-request counters: deleted when their window ends, within 24 hours.
  • Deletion links: a link works for 30 minutes. We keep only a keyed hash of it and whether it was used, and delete that 60 minutes after the link is used or expires.
  • The deletion ledger: when an account is deleted, we note its random id and when it was deleted (never its email address or nickname) for 60 days, longer than any backup is kept. If we ever had to restore a backup, we would delete every account in the ledger again before the game came back, so a restore can't bring a deleted account back.
  • Leaderboard entries: kept for as long as the leaderboards run. If you delete your account, your entries stay on the boards, shown without your name and no longer tied to an account.
  • Logs: rotated by size, as above.
  • Email headers at SMTP2GO: 35 days.
  • Backups: we back the database up every night. Each backup is deleted once it's 14 days old, at the next night's backup, so anything deleted from the database is gone from every backup within 15 days. The copies we take off the server for safekeeping are kept for the same time.
  • Emails about your data: if you write to us about your data, we keep the emails about your request for 12 months after it's closed, then delete them.

Your rights

Under data protection law (the UK GDPR and the EU GDPR) you have the right to see the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive a copy of it in a portable form. Email privacy@skyelemental.com and we'll respond within one month; writing from the address on your account is quickest. You can change your nickname and delete your account yourself, without asking us.

If you want your account deleted but can't get into its email inbox any more, email us too. We'll ask for details only the account's owner is likely to know, such as its nickname and roughly when and on which phone you last played, and we reply to the address you write from. We keep the emails about any request for 12 months after it's closed, then delete them.

If you're unhappy with how we've handled your data, you can complain to your data protection authority. In the UK that's the Information Commissioner's Office, at ico.org.uk.

Deleting your account

In the game, go to Account → Delete account and confirm with Delete forever. If you no longer have the game, go to play.streetsofclubbing.com/account/delete, enter your account's email address, and confirm on the page through the single-use link we email to that address. Either way, your account, your nickname and every sign-in are erased at once. What we keep afterwards, and for how long, is listed above. Step-by-step instructions are on the delete-your-account page.

Adults only

Streets of Clubbing is for adults aged 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has an account, email us and we'll delete it.

This website

This website is a set of plain pages. It sets no cookies, stores nothing in your browser, runs no scripts, has no analytics or advertising, and loads nothing from anyone else's servers: even the fonts come from us. As with any website, our server sees your IP address when your browser asks it for a page; it keeps no record of your visit. The same goes for downloading the Android app from this site: our web server keeps no access log, so it records nothing about who downloaded it.

Changes and contact

If we change how we handle your data, we'll update this page and the date at the top. Questions, requests or complaints: privacy@skyelemental.com, or write to us at our registered office.