Privacy and your data
Draft — not yet reviewed by a lawyer. This page describes how the game service currently handles player data. It will change after legal review and must not be relied on as a final legal notice.
Who we are and how to reach us
Lumiora Studio runs the games at play.funplaylab.com and each game's own funplaylab.com address. For privacy questions or requests that the controls below cannot handle (for example a suspended account), use the operator's published contact: [email protected]
What we collect
Jobring, Confetti Pop and Tickdown do not use server accounts. Hueless and Leakproof can be played locally; their online scores/replays need a login. Dawnblade requires an account. The collection uses GitHub or LINUX DO. When you sign in we store:
- Your identity at the provider: the provider name, your numeric account ID there, your username, display name, avatar link and, for LINUX DO, your trust level. We do not ask for or store your password or email address. The provider access token is used for profile lookup and is not retained.
- Login sessions: a scrambled (hashed) copy of your login cookie and its expiry date. One login works on every game because the cookie belongs to funplaylab.com, so your browser also sends it to other funplaylab.com sites; they do not use it.
- Game data: your SOF save (units, equipment, currency, progress), in-game mail, market listings and purchases, a log of currency changes, arena rank and recent PvP results, battle records, and your Leakproof and Hueless scores and replays.
- Technical data: your IP address is used briefly in memory to limit request rates, and appears in the web server's access log. The access log does not record query strings.
Chat messages sent during a PvP match are passed to your opponent and are not stored. Some games also keep settings or unsent results in your own browser's storage; that stays on your device and you can clear it with your browser.
Why we use it
To sign you in, keep your progress, run fair rankings and leaderboards (we re-check scores on the server), operate the in-game market and mail, prevent abuse, and keep the service running and recoverable.
What other players can see
Your username, display name and avatar are shown next to your leaderboard entries, market listings and to your PvP opponents. Leaderboard replays can be viewed by other players.
How long we keep it
| Data | Kept for |
|---|---|
| Account and game data | Until you delete your account |
| Login sessions | Until logout, suspension or expiry; default 30 days, configurable by the operator |
| Login attempts in progress | 10 minutes |
| IP addresses for rate limiting | About 10 minutes, in memory only |
| Server and access logs | Limited period set by the server's log rotation (to be confirmed) |
| Backups | Default local rotation keeps daily copies for 30 days. The newest verified copy is retained even if older. Actual off-host retention must be published by the operator |
| Deletion ledger | Internal account ID, SHA-256 of provider/subject and deletion time are retained permanently to prevent restoration of deleted accounts. This is pseudonymous, not anonymous |
Your choices: export and delete
While signed in you can download everything we store about your account as a JSON file, and you can permanently delete your account.
Deleting your account removes your save, mail, market listings that have not sold, currency log, arena profile, battle records, scores and replays, and signs you out everywhere. A few records are shared with other players: a market sale (the buyer's purchase) and PvP matches (your opponent's result). Those are kept without your name, avatar or provider identity so the other player's history stays correct; your name in their match history is replaced by "deleted player". If you sign in again later, you start a new, empty account.
Backup copies are not edited. With continuing successful backups, old local copies normally age out within the default 30-day window; the newest verified backup is never automatically discarded, so a backup failure can extend that period. Off-host copies and logs need separate operator reconciliation. Restoring an older snapshot requires the current deletion ledger before service resumes; if that ledger is lost, outstanding requests must be reconciled before restoring service.
Your account
You are not signed in. Sign in to export or delete your data.
Signed in as .
Changes
We will update this page when our practices change and show the date of the last change here. Last updated: draft, October 2026.