Privacy policy

Last updated: 2026-11-15

This policy explains what data Orbonk: Cursed Forest ("Orbonk", "the game") and this website handle, why, for how long, and what you can do about it. It describes what the game does today. If that changes, we update this page and the date above.

Who is responsible

The game and this website are run by the Orbonk developer. Contact for any privacy question or request: office@orbonk.com.

In short

No account, no email address, no login. The game identifies your device with a random anonymous ID.
The nickname you choose is public on leaderboards and league tables.
Your progress is backed up to our server so it survives a reinstall.
We keep a short-lived hash of your IP address to stop abuse, then delete it.
Push notifications are optional and you can switch them off at any time.
No analytics, no trackers, no third-party scripts in the game or on this website.

What we collect and why

Anonymous player ID

On first launch the game creates a random identifier (a UUID) and stores it on your device. It is sent with requests to our server so we can link your scores, league entries and cloud save to the same player. It is not linked to your name, email, phone number or any other account. Why: to provide online features you use (legal basis: performance of the service you request, and our legitimate interest in running it).

Nickname

You can choose a nickname (2 to 16 characters) or play as "Guest". The nickname is stored with your player ID and is shown publicly on the leaderboards (overall, daily and weekly challenges) and in weekly league tables. In co-op it is also shown to the other players in your room. Offensive nicknames are rejected.

Scores and leaderboards

When you tap Save on the end-of-run screen, the game sends the run's result: map, Threat level, class, nickname, time survived, kills, level reached, your build (weapons and passives) and the game version. Daily and weekly challenges keep your best entry and number of tries.

Weekly leagues

Finished runs above a minimum length are sent automatically to count toward your weekly league: points, number of runs, your group, tier, final place, promotion or relegation, and rewards and whether you claimed them.

Cloud save

The game automatically backs up your game progress (unlocks, achievements, currencies and similar) to our server, linked to your player ID, so you can keep playing after reinstalling. Your settings and local scores stay on your device.

IP address

To protect the online features from abuse, our server keeps a one-way hash of your IP address together with a timestamp to limit how often requests can be made. These entries are deleted after about one hour. Your plain IP address is held only in memory for a few seconds and is never written to storage.

Push notifications (optional)

If you allow notifications, we store your browser's or device's push subscription (an address of the push service and two encryption keys) with your player ID, and the reminders waiting to be sent. We send two kinds of reminders: when an expedition returns, and when a daily reward is waiting. We do not send them at night (22:00 to 09:00 your time). Switching notifications off in the game's Settings deletes your subscription and pending reminders from our server. Subscriptions are also deleted when the push service reports them as gone, or after 60 days without contact. Notifications are delivered through your platform's push service (for example Google, Apple, Mozilla or Microsoft).

Co-op multiplayer

Co-op connects up to 4 players directly to each other (peer-to-peer, WebRTC). To set up the connection, players exchange network addresses, so other players in your room can see your IP address. Connection setup messages pass through our server, which does not store them; if a direct connection fails, game data is relayed through our server or a relay service. To find a route between players, the game contacts STUN servers run by Cloudflare and by Google, which see your IP address.

The game may offer optional rewarded ads (watch an ad, get a reward). Today these are placeholders: no ad network is integrated, no advertising ID is read and no ad data is shared. Before real ads are added, this policy will be updated to name the ad provider (for example Google AdMob), the data it uses (such as the advertising ID) and how you can give or refuse consent, including the consent required in the European Economic Area, the UK and Switzerland.

This website

This website sets no cookies, runs no analytics and loads nothing from other domains. Our hosting provider processes standard request data (such as IP address and browser type) to deliver pages and protect the site.

Who processes the data

Cloudflare: hosting of the game server, database, co-op rooms, connection relays and this website; server logs.
Google: a STUN server used to set up co-op connections.
Your platform's push service: delivery of notifications you opted into.

We do not sell your data and do not share it with anyone else.

How long we keep it

IP address hashes: about one hour.
Daily challenge entries: 90 days.
Push subscriptions: until you switch notifications off, or 60 days without contact.
Player record (ID and nickname), scores, weekly challenge entries, league records and cloud save: kept while the game runs its online features, or until you ask us to delete them.

Your rights

Depending on where you live (for example under the GDPR in the EU), you can ask for access to, correction of, or deletion of your data, object to processing, or ask for a copy. Write to office@orbonk.com. Because we do not know who you are, include the player ID shown in the game so we can find your data; see Delete your data. You can also complain to your local data protection authority.

Children

The game is not directed at children under 13 and does not knowingly collect data from them. If you believe a child has sent us data, contact us and we will delete it.

Security

All connections to our server are encrypted (HTTPS). Data is stored with our hosting provider in its secured infrastructure.