Coldfront — Privacy Policy
Effective date: 30 July 2026 Last updated: 30 July 2026 Who is responsible for your data (the "controller"): Gurpreet Heer, the sole developer of Coldfront. If you need a postal address — to send a formal notice, for example — email us and we will give you one. Contact: support@playcoldfront.com
1. The short version
Coldfront is a strategy game made by one person. It contains no analytics, no advertising, no tracking, and no third-party SDKs of any kind — that is not a promise about intent, it is a property of the build. There is no account, no sign-in and no password, and the Game never reads a device identifier, your location, your contacts, your photos, your microphone or your camera.
Nothing you do in single-player or the campaign ever leaves your device, and neither do your saves, your replays or the maps you draw — with one exception, which you control: if you host an online match on a map you drew, that map is sent to the players who join you, because their device has to draw the same battlefield. That is the only way anything from the editor leaves your device.
Online play is the only part of the Game that sends anything anywhere, and it sends the minimum needed to run a match between people who already have each other's room code.
We do not sell your data, we do not share it with advertisers, and we do not build profiles.
2. What stays on your device
The Game stores the following in its own app sandbox. None of it is uploaded to us automatically. The rows marked † also travel to the other players in your room when you play online — see §3.
| What | Why |
|---|---|
| Your display name † and the relay address you connect to | So you don't retype them |
| Music and sound-effect levels, and the "seen the intro" and "seen the editor hint" flags | Your preferences |
| Which campaign missions you have completed | So the campaign remembers where you got to |
| Custom maps you draw † | The map editor itself |
| Saved games and replays | The features themselves |
| Your blocked-player list — for each block, that player's display name, the room code you met them in, and the date | So blocks survive a restart |
| A copy of every report you submit — the reported player's display name, their slot, the room code, your own display name, the app and build number, the date, and for a map report that map's name, its id and every row of its painted terrain | So you keep your own record of what you sent |
Replays and saves can contain someone else's map. The Game records a replay of every match automatically, online matches included, and you can save a match in progress. When a match is played on a custom map rather than a built-in one, a copy of that map is written into the replay file and into the saved game, so that it can still be opened later. If you join a room and the host has chosen a map they drew, your device therefore keeps a copy of their map inside your replay of that match, until you delete that replay.
Submitting a report also uses your clipboard. When you tap SEND REPORT, the Game puts the full report text on your device's clipboard as well as saving it, so you can paste it in if your mail app drops it. The clipboard is shared across the whole device: whatever app you paste into next receives it, and if you have Handoff switched on, iOS copies it to your other Apple devices. That text contains another player's display name and, for a map report, the map they drew — so copy something else afterwards if you would rather not leave it sitting there. The Game itself reads your clipboard only when you tap PASTE on the join screen, and takes nothing from it but a room code.
Deleting things. Every saved game and every replay has a DELETE control in its own browser, every custom map has one in the editor, and Settings › Blocked Players lets you review and undo any block. Deleting a replay or a saved game also deletes the copy of any custom map that match was played on. In this version there is no in-Game control for deleting a saved report copy: removing those means deleting the app, which removes everything at once.
Like every iOS app, Coldfront's data is included in your iCloud or computer backups. So a backup made before you deleted the app can still hold a copy — of your block list, or of a report you filed. That backup is held by you and by Apple, not by us; we never see it, and it goes when the backup is replaced or removed.
We cannot read anything on your device. The only way any of it reaches us is if you choose to send us a report, which is §3(e).
3. What online play sends, and to whom
Online matches run through a small relay server we operate (see §4). When you host or join a room, this is what is processed:
a. Your display name. Sent to the relay and shown to the other players in your room. The relay keeps it in memory for as long as that room exists, sends it to everyone in the room whenever the roster changes, and holds it briefly after you disconnect so you can rejoin the same slot. When the room empties or the server restarts, it is gone.
Two copies can outlive the room, and they sit on other people's devices rather than ours. If another player blocks you, your display name, the room code and the date are saved to a block list on their device until they unblock you. If another player reports you, your display name is written into a copy of the report kept on their device, and is sent to us inside that report. Neither is something we control or can undo for you.
It is a self-chosen handle. If you put your real name in it, that is what other people see and store — please don't.
b. Custom maps, if you host and choose one. The whole map file is relayed to everyone who joins your room: its name, the terrain you painted (that is, arbitrary imagery you drew), its size and biome, its starting positions and control points, and the id it was saved under. It is sent twice — once so joiners can see a preview in the lobby, and again when the match starts.
On a joiner's device the map is loaded into memory for the match and dropped when they return to the main menu; it is never added to their saved map library. But the replay their device records of that match keeps a copy of it, and so does any game they save — see §2. Those files are on their device, not ours, and we cannot delete them. If you would rather not hand a map you drew to the people in your room, do not host a match with it.
c. Gameplay commands. The moves and orders every player makes, relayed so that everyone's copy of the match stays in step, along with a short numeric fingerprint of the game state used to detect when two copies have drifted apart. They are about the game — where you sent a tank, what you chose to build — not about you or your device. They do travel through the same room as your display name and are tagged with your slot, so treat them as part of what the other players in that room can see. We do not store them: they pass through the relay and are gone.
d. Connection metadata. Like any internet service, the relay has to see the network address a connection arrives from — that is how a connection works.
The relay writes one line to its host's log stream for each connection event: connect, room created, joined, rejoined, slot freed, dropped, reconnect grace expired, room removed, disconnect. Those lines carry the room code, the slot number and the network address the socket reports. They never carry a display name, and they never carry anything that was relayed — no map, no command, no message contents. Our relay sits behind our hosting provider's proxy, so the address in those lines is often the provider's own internal address rather than yours; we do not rely on that, and you should read this section as though your IP address were in them.
Those lines go to our hosting provider's log stream and nowhere else. We keep no copy of them, and there is no database. The provider deletes them on its own automatic cycle, currently about seven days. We use them to diagnose faults in the relay. We do not use them for advertising, and because no line contains a display name, we cannot connect an address to a player.
e. If you send us a report or an email. The Game does not email us for you. Tapping SEND REPORT writes a copy of the report to your own device, puts the same text on your clipboard, and opens your own email app with the message ready — nothing leaves your device until you tap Send there. If your email app does not open, the report is still on your clipboard and saved on your device, and you can send it to us any way you like.
When you do send it, we receive what your mail app sends: your email address, the text of the report, the display name of the player you are reporting, the room code, your own display name, and for a report about a map, that map's name and its painted terrain. Your email provider carries it, and a copy stays in your Sent folder. We use it only to look into the report and to enforce our Terms, and we reply from the same address.
There is no account system. No password, no sign-in, no Game Center identity, no contact list, no location, no device advertising identifier, no photos, no microphone or camera access. The Game never asks for those permissions and never reads them.
4. Where the relay runs, and who else touches the data
The relay we operate is hosted on Fly.io, in the United States (region iad, US East). Fly.io acts as our hosting provider and processes this data only on our instructions; it is contractually required to protect it to the same standard this policy sets out.
Room state — who is in the room, their display names, the host's chosen map — lives in the memory of the relay process and nowhere else. There is no database and nothing is written to disk. When a room empties, or the server restarts, that state is gone. Nothing about your matches is archived by us.
We use no other sub-processors: no analytics vendor, no crash reporter, no advertising network, no content delivery network for user data. The Game is distributed by Apple through the App Store, and anything Apple collects in the course of that is covered by Apple's own privacy policy, not by this one. We do not sell or share personal information as those terms are defined under California law, and we have not done so in the preceding twelve months.
If you are in the UK or the EEA. The relay runs in the United States, so when you play online your display name, any map you host and your gameplay commands leave your country. We rely on the standard contractual clauses in Fly.io's data processing agreement to protect that transfer.
If you change the relay address. Settings lets you point the Game at a relay server other than ours. Two things change if you do. Your display name, any map you host and your gameplay commands go to whoever runs that server instead of to us — we have no visibility of it, and this policy does not cover it. And the Game does not check what you type: if the address you enter begins ws:// rather than wss://, that connection is not encrypted, and anyone on the network in between could read what crosses it. Leave this setting alone unless you know who is running the server at the other end.
5. Why we process it (legal bases)
Where the GDPR or similar law applies, we rely on:
- performance of a contract (our Terms of Use) to relay your display name, your custom maps and your gameplay commands — without them, online play cannot function;
- legitimate interests to keep short-lived connection logs so we can diagnose faults in the relay, and to read and act on reports about objectionable content, including replying to you about a report you sent;
- compliance with a legal obligation where we must retain something in order to answer a lawful request.
Do you have to give us a display name? No law requires it and no contract compels it. It is simply needed for online play, because the other people in your room have to see something. Everything else in the Game works without one.
Automated filtering. The Game checks display names and custom-map titles against a list of objectionable words and refuses ones that match. That check runs entirely on your own device, on the text you type, and again on your device on every name that arrives from another player before it is drawn — nothing is sent anywhere to perform it, and we never see a name that was refused. It can refuse a name or a map title and tell you why. It makes no other decision about you, and it is not automated decision-making that produces legal or similarly significant effects.
6. How long we keep things
- Room state (names, the host's map, match sync): in memory only, deleted when the room ends or the relay process restarts. Never written to disk by us.
- Connection logs: held by our hosting provider on its own retention cycle, currently about seven days, then deleted automatically. We keep no copy.
- Reports you send us by email: kept while we look into them and for as long as we need them to enforce our Terms against a repeat offender — no more than 12 months — then deleted.
- Everything on your device: until you delete it, or delete the app. That includes replays and saved games, which keep a copy of any custom map the match was played on, and the copies of reports you have filed, which in this version go only when the app does.
7. What we declare to the App Store
Apple asks every developer to declare what their app collects. Our declaration for Coldfront is:
- Identifiers — User ID: your display name. Linked to you. Used for app functionality only. Not used for tracking.
- User Content — Gameplay Content: the custom maps you choose to share when you host. Linked to you. Used for app functionality only. Not used for tracking.
- Contact Info — Email Address: only if you email us or send us a report. Linked to you. Used for app functionality and customer support only. Not used for tracking.
- Diagnostics — Other Diagnostic Data: the connection metadata in §3(d). Not linked to you. Used for app functionality and to diagnose faults. Not used for tracking.
- No tracking. The Game contains no tracking technology, and no data is shared with data brokers or advertisers.
8. Children
Coldfront is not directed at children. Our Terms set a minimum age of 13, or 16 where local law requires — but the Game has no account system and never asks your age, so that minimum is self-declared and we cannot check it. We do not knowingly collect personal information from children under those ages.
If you believe a child is using the Game and has sent us something, email support@playcoldfront.com. In practice there is very little that could exist: a display name held in a server's memory for the length of one match, and any report email. We will delete whatever we hold and stop processing it.
9. Your rights, and what you can do without asking us
Depending on where you live you may have the right to access, correct, delete, restrict or port your personal data, and to object to processing. You can also complain to the data protection authority of the country where you live or work — in the United Kingdom that is the Information Commissioner's Office, ico.org.uk.
Most of it you can do yourself, immediately, without writing to anyone. To stop everything described in §3, stop playing online: nothing else in the Game sends anything anywhere. Inside the Game, every saved game, replay and custom map has a DELETE control, and Settings › Blocked Players lets you review and undo any block. Deleting the app removes everything held on your device at once.
To ask us to delete something we hold — in practice, a report you or someone else sent us — email support@playcoldfront.com. We will respond without undue delay and in any event within one month of receiving your request; if the request is complicated we may take up to two further months, and we will tell you inside the first month if that happens.
There is very little else to exercise these rights against. We hold no account, no profile and no database. Your display name and any map you share exist only for the life of a room. Connection logs are held by our hosting provider on its own cycle and age out by themselves; we cannot delete an individual line from them, and since no line contains a display name we could not identify which line was yours in any case.
10. Security
Traffic between your device and the relay we operate is encrypted in transit (TLS, wss://). There are no passwords or credentials to protect, because the Game has none. If you replace the relay address in Settings, see the warning in §4.
The larger risk in online play is social rather than technical, and it is worth knowing exactly how a room works. A room is protected by its five-character code and by nothing else. Anyone holding that code joins straight away — there is no approval step and no invite list — and codes are short enough that one could be guessed. The moment someone joins, they are shown the display names of everyone already in the room, and if you have chosen a custom map they receive that map, its name and the terrain you drew, before the match even starts. Once someone is in, the host cannot remove them: to get rid of an unwanted joiner you leave and host again, which gives you a fresh code.
So treat anything you put in your display name, or draw into a map you host, as visible to whoever ends up in that room — and share codes privately. You can block a player at any time: their name and their map disappear from your screen immediately, and nothing they send reaches your game after that.
11. Changes
We will post changes on this page with a new "Last updated" date. This page is linked from the Game's Settings › Legal screen and opens in your browser, so you can check it whenever you like — and it is worth a look before you play online after an update.
12. Severability, and how this fits with our Terms
If any part of this policy is found to be unenforceable, the rest of it still applies. Where this policy and our Terms of Use say different things about how we handle your data, this policy governs.
13. Contact
support@playcoldfront.com Support page: https://playcoldfront.com/support