Privacy policy
Salt & Cannon and Salt & Cannon mobile · last updated 20 October 2026 · if translations differ, the English version applies
Salt & Cannon is a free browser game. This page explains what personal data the game processes, why, for how long, and what you can do about it. Questions or requests: [email protected].
Who is responsible
The controller is the operator of the game named in the legal notice, who can be reached at [email protected]. The game runs on rented virtual servers (the main one, and for some seas others), each operated by a hosting company that processes the data only to run that server, on our instructions. The servers stand in the European Union and may also stand in other countries, such as the USA; more may be added. The list of seas shows which server each sea runs on. Your captain is kept on the main server; a sea's server holds what happens in that sea (your ship there and a chest buried there) while you play. When you sail in a sea that runs on another server, your game connects to that server directly while you play there; like the main server, it keeps no access logs. A server outside the EU and the EEA is rented only in a country the EU recognises as protecting personal data adequately, or from a hosting company certified under the EU–US Data Privacy Framework or bound by the EU standard contractual clauses.
What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Your account id, name and e-mail address (when you sign in with Google or with a link sent to your e-mail; there is no password) | To recognise you and keep your captain between visits; the e-mail lets the administrator help you with your account | Providing the game you asked for (Art. 6(1)(b) GDPR) |
| Your captain: chosen name, flag and lantern, ship, upgrades, gold and supplies, buried chest position, kills and deaths, rank and experience, trade cargo, your fleet in Salt & Cannon mobile (ships, voyages, silver), number of sessions, play time, first and last visit | To run the game and keep your progress; the leaderboard shows your captain's name, gold and kills to other players | Providing the game (Art. 6(1)(b) GDPR) |
| Messages you write in the game chat | Shown to the captains online at that moment; not stored | Providing the game (Art. 6(1)(b) GDPR) |
| Usage statistics through Google Analytics (only if you allow it) | To count visits and understand how the game is played, to improve it | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| Google advertising (AdSense, H5 Games Ads) only if you allow it: a full-screen ad now and then when you set sail or while your crew rows back to port, and in Salt & Cannon mobile a video ad when you choose to watch one for a reward | To show and count advertisements, which keeps the game free | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| Sponsor banners in the game: which banners were in view and which were clicked, as plain counts | To tell advertisers how often their banner was seen and clicked; the counts are not linked to you | Our legitimate interest in financing the game (Art. 6(1)(f) GDPR) |
| Advertising requests: name, e-mail, other contact, company, the product, its website, budget and message you send through the advertising form | To answer you about a banner campaign | Steps before a contract at your request (Art. 6(1)(b) GDPR) |
| A short list of game events for the administrator (a captain joined or left, reached a rank or prestige, was renamed, banned or deleted), with the captain's name and account id | To run the server and handle abuse; kept in the server's memory only — the last 500 events, gone when the server restarts | Our legitimate interest in running the game safely (Art. 6(1)(f) GDPR) |
| Reports of illegal content or rule breaches you send us, and our decision | To handle the report (EU Digital Services Act) | Legal obligation (Art. 6(1)(c) GDPR) |
The game server keeps no access logs and does not store IP addresses. Your connection's address is used only while you are connected, to deliver the game (the advertising form and the administrator sign-in keep it for up to an hour, in memory only, to stop spam and guessing). Instead of a captcha, the browser of a new captain solves a short puzzle (a proof of work, about a second); it involves no third party and nothing about you. Your data is never sold.
Cookies and browser storage
| Name | What it is for | Kept | Type |
|---|---|---|---|
sof (local storage) | Your captain's name, flag and lantern, and a random id when Google sign-in is not used | Until you delete it | Necessary |
sof_consent (local storage) | Your choice in the cookie dialog | Until you delete it | Necessary |
sof_google (local storage) | Remembers that you signed in, so the sign-in is restored | Until you sign out | Necessary |
sof_lang, sof_settings (local storage) | Your language and game settings (volume, mouse, graphics) | Until you delete it | Necessary |
sof_tutorial, sof_tips, sof_spots (local storage) | Which introductions and tips you have seen, and places you searched for treasure | Until you delete it | Necessary |
firebaseLocalStorageDb (IndexedDB) | Your sign-in session (Firebase Authentication) | Until you sign out | Necessary, only after you sign in |
__cf_bm (cookie, Cloudflare) | Tells people from automated traffic, to protect the game | 30 minutes | Necessary |
cf_clearance (cookie, Cloudflare) | Remembers that you passed a security check, when one was shown | Up to a day | Necessary |
_ga, _ga_* (cookies) | Google Analytics: tell visits apart and count them | Up to 2 years | Analytics, only with consent |
Google advertising cookies (e.g. __gads, __gpi, IDE) | Google AdSense: choose, limit and count the ads | Up to 13 months | Advertising, only with consent |
Choose “Your privacy choices” on the game's start screen to change your choice; withdrawing consent stops Google Analytics and removes its cookies.
Other services
- Cloudflare (Cloudflare, Inc., USA) delivers the game's website and its connection through its network and protects them from attacks and automated abuse. To do that it processes the data of each connection — your IP address, the requests and their technical details — as our processor, only on our instructions, and may set the security cookies listed above. When you set sail or open the harbour, Cloudflare may first run a short security check in your browser (Turnstile): its code loads from Cloudflare only then, reads technical details of the browser and the device to tell people from bots, and is not used for advertising. Legal basis: our legitimate interest in keeping the game available and safe (Art. 6(1)(f) GDPR). Data may be transferred to the USA; Cloudflare is certified under the EU–US Data Privacy Framework and also relies on standard contractual clauses. See Cloudflare's privacy policy.
- Google Firebase Authentication (Google Ireland Ltd. / Google LLC) handles the sign-in with your Google account or with a sign-in link sent to your e-mail (it sends those e-mails). Its code is downloaded from Google only when you start signing in. Data may be transferred to the USA; Google relies on the EU–US Data Privacy Framework and standard contractual clauses. See Google's privacy policy.
- Google Cloud Firestore (Google Ireland Ltd. / Google LLC) keeps a nightly backup copy of the game data — your captain, fleet and perks, and the e-mail address of a captain who signed in with one — compressed, so the game can be restored after a failure. Only the server writes and reads it; the last seven nightly copies are kept and older ones are deleted. Data may be transferred to the USA; Google relies on the EU–US Data Privacy Framework and standard contractual clauses.
- Google Analytics 4 (Google Ireland Ltd. / Google LLC), only if you allow it. Google signals and advertising features are turned off. Data may be transferred to the USA; Google relies on the EU–US Data Privacy Framework and standard contractual clauses.
- Google AdSense (Google Ireland Ltd. / Google LLC), only if you allow advertising: its code loads when an ad may be due. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites; Google's advertising cookies let it and its partners serve ads to you based on those visits. You can opt out of personalised advertising in Google's Ads Settings (or, for other vendors, at aboutads.info), and withdraw your consent at any time (“Your privacy choices” at the bottom of the start page). Ads are shown to every player; only with your consent are they personalised. Without it Google is asked for non-personalised ads with restricted data processing, and in the EEA, the UK and Switzerland Google shows limited ads, which use no cookies for advertising. A Global Privacy Control signal from your browser is honoured as an opt-out. US residents (California and other states with such laws): personalised ads count as “sharing” of personal information; to opt out of the sale or sharing of your personal information, open “Your privacy choices” and leave personalised ads off, or turn on Global Privacy Control. Where the game uses Google's consent platform (a certified IAB TCF consent message), Google asks players in the EEA, the UK and Switzerland whether ads and statistics may use cookies and whether ads may be personalised (the game's own cookie dialog is not shown then; Google Analytics starts only if you agree there); those who decline may still see limited ads, which use no cookies for advertising. That choice can be changed at any time under “Ad choices” at the bottom of the start page. See how Google uses data from sites that use its services.
Nothing else is loaded from third parties: the game's code, graphics, sounds and sponsor banners come from the game server itself. A click on a sponsor banner opens the advertiser's website in a new tab; from then on that website's own privacy policy applies.
How long data is kept
Your captain stays on the server while you play. You can delete it yourself at any time (see below); profiles that have not been used for two years may be removed. The nightly backup copies are kept for seven days, so data you delete is gone from them a week later at the latest. The log of your fleet in Salt & Cannon mobile (voyages and builds) keeps seven days. Google Analytics data is kept for the period set in Analytics (14 months). Advertising requests are deleted once handled, at the latest after 12 months.
Your rights
You may ask for access to your data, its correction or deletion, restriction of processing, a copy of your data (portability), and you may object to processing or withdraw consent at any time — write to [email protected]. You can also do it yourself, in either game: start screen → “Your privacy choices” → “Download my data” gives you a copy of everything stored about you (a JSON file), and “Delete my game data” deletes your captain, fleet and perks on the server and your sign-in account. We answer requests within one month. You have the right to complain to a data protection supervisory authority, in particular in the EU country where you live; the authority for the operator is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se).
Age
The game is intended for players aged 16 and over.
Changes
If this policy changes, the date at the top changes too; for significant changes the game asks for your choice again.