Accounts and payments: what we keep

No analytics, no tracking

This site loads no analytics, tracking or advertising scripts. Every font, image and script comes from account.magneticlabs.games itself. You can check: open your browser's developer tools and watch the Network tab while you use the account page.

It sets cookies only when you sign in, and only for that: one that lasts 15 minutes while you wait for the email link, and your session, which lasts 30 days or until you sign out. Another remembers, for six months, that this browser has signed in to your address before, so it can still get you a sign-in link while someone floods the site with requests. It holds a code made from your address, not the address, and can't sign anyone in, so signing out leaves it. When a game's iOS or Android app opens these pages, one more says so, and only that ("ios" or "android"), so the pages leave out what only the website offers; it goes two hours after the last page you open here. All of them are HttpOnly (page scripts can't read them) and sent only to this site. Each game keeps its own sign-in cookie on its own site, so one game can't read another's.

What an account holds

Signing in is by a link we email you. There are no passwords. Your account is:

• your email address, an account id (the same in every game, so each game can keep your progress under it) and when the account was made,
• sign-in links, stored only as one-way hashes. Each works once, expires after 15 minutes and is deleted within the hour,
• sessions, one for this site and one for each game you sign in to, stored only as hashes, for 30 days,
• the one-time codes that hand a sign-in from here to a game, as hashes, for 60 seconds,
• what you own in each game: the item, where it came from (a card payment, the App Store, Google Play, a code, a gift, or an old licence you claimed), whether it's active, and when it ends or renews.

Games get your account id and email address over a private connection between our own servers, so they can say “Signed in as …”. They're asked not to store the email address, and they never see anything about how you paid.

Payments

On the web, payments go through Stripe, on Stripe's own checkout page. Your card details go to Stripe and never reach our servers. Stripe gets your email address, payment details and billing country, and handles them under its own privacy policy. We get back what you bought, Stripe's ids for it (customer, subscription, payment and invoice), Stripe's fee, the country of your billing address, and whether you ticked the box at checkout saying you want it now and understand you lose your 14-day right to cancel once it's delivered. Nothing else about your card.

In a game's iOS or Android app, purchases go through Apple or Google, and reach us through RevenueCat, which the apps use to handle store purchases. Before you sign in in an app, RevenueCat knows you only by a random id. Once you sign in, it also knows your account id, so a purchase lands on your account. We get the product, the store's transaction id, and when it renews or ends.

Prices are in each game's own currency: Australian dollars for The Cabal, US dollars for Driller and MLG Test.

Records we keep to run payments

• A payments ledger: for each payment, the account id, the game and item, the amount and currency, any discount and the code it came from, Stripe's ids, whether it was a test payment, and any refund. For a purchase on the web it also keeps the record of your choice at checkout: that you ticked the box, the exact words beside it, when, that the purchase was delivered straight away, and when we emailed you its confirmation (not the email itself, or the address it went to). It's a business record, kept for seven years (Australian tax law asks for five), and it stays after an account is deleted, with no email address in it.
• Refunds you've made yourself from your account page: which payment and when, so the two-a-year count works. If the account is deleted, each stays against the address hash below until it stops counting, 12 months after the refund, so deleting the account and signing up again doesn't start the count over.
• Chargebacks and fraud warnings on your payments: the dispute id, the payment it's about, the bank's reason, the money it moved and how it ended. Like the ledger, it stays after an account is deleted, with no email address in it, and the note that the account had a chargeback stays against the address hash below for two years. While we answer a chargeback we also keep the evidence we send Stripe for it, which can include your email address and the sign-ins and game use below; that goes when the account is deleted.
• A pause on buying, if we've stopped an account buying after a chargeback or fraud (or one comes after the account was deleted, which pauses its address by itself): who set it, when and why. You're never shown the reason. Until it's lifted. If the account is deleted, it stays against the address hash below for two years, and a new account with that address is paused too.
• A hash of your address, to prevent fraud: a one-way hash, made with a secret key, of your address in its plainest form, without any +tag (and, for Gmail, without dots). It's how the three things above, and once-per-account codes below, follow the inbox rather than the account: alice+games@gmail.com and a.lice@gmail.com share one refund count and one pause with alice@gmail.com. Each spelling is still its own account, and the hash is never used to sign in or to join accounts. It stays only while one of them does, except one thing: if an account that paid by card is deleted, the hash stays against its account id for 18 months after its last card payment, the longest a bank can take to raise a chargeback, so a chargeback that comes after the deletion still gets its note and a pause on buying, as above.
• Payment events already handled, as Stripe's and RevenueCat's event ids, for 90 days, so none is applied twice. Refunds and chargebacks that arrive before the purchase they're about wait as ids for up to 90 days.
• Codes you've used: which code and when, until the account is deleted. Codes themselves are stored as hashes. A code that works once per account works once per inbox: other spellings of your address (a +tag, Gmail dots) count as already having used it, and after the account is deleted the address hash above stays against that code until the code expires, so deleting and signing up again doesn't use it twice.
• Purchases from a game's old store, if a game moved here from its own checkout: kept against a one-way hash of the address used to buy, and added to your account the first time you sign in with that address. We never make an account from one.
• Sign-ins and game use: for each day, whether you signed in (by email link, or to a game) and whether a game used your sign-in (to check it, read what you own, or get a licence), with the first and last time and how many times. Not your network address, your device or what you did in the game. We keep it for two years, or until the account is deleted, and use it for one thing: if a payment is disputed with your bank, it's our evidence that the account that paid used what it bought, and the part about that payment goes to Stripe for the bank.
• An audit log, for a year: what the people who run the service change in admin, such as granting or revoking an item, with the reason given.

Licences

Games that run in your browser or offline can ask for a licence: a signed list of what your account owns in that game, kept on your device. It names your account id, not your email address. It works for up to 90 days without the game checking in (a week while you can still refund a purchase in it yourself), and the game refreshes it whenever it's online, which is also when a refund takes effect there.

Network addresses

To stop someone flooding an inbox or guessing codes, sign-in emails, code attempts and trips to the payment page are counted per network (an IPv4 address, or a block of IPv6 addresses) and per account or email address. Those counts are kept as one-way hashes, never the addresses themselves, and deleted after two days. Our logs record errors, never addresses, emails or sign-in links.

Cloudflare hosts the service. Like any host it processes your IP address to deliver the pages. Our data is in Cloudflare's D1 database.

Email

We send you two kinds of email, and nothing else: no newsletters, no marketing.

• Sign-in links, when you ask for one.
• Purchase confirmations, once after each purchase on this site (a plan's first payment, not its renewals): what you bought, for which game, the price you paid, the date, our order reference and Stripe's payment reference, and the record that you asked for it straight away and agreed you lose your 14-day right to cancel once it's delivered, with when it was delivered. EU and UK law asks us to confirm that in writing. App Store and Google Play purchases and free code unlocks don't get one: the store sends its own receipt, and a free unlock has nothing to confirm.

Both go out through Cloudflare's email sending service, from signin@magneticlabs.games. Each shows one image, the Magnetic Labs wordmark, from account.magneticlabs.games; there's no tracking in it, and nothing tells us whether you opened an email. We keep a record that a purchase confirmation was sent and when, as above, but not a copy.

Deleting your account

The Delete account button on your account page removes the account from every game at once: your email address, sessions, what you own, your sign-ins and game use, and your Stripe customer records, which cancels any plan paid by card first so nothing charges again. App Store and Google Play subscriptions are the store's, and only you can cancel them there; the account page lists any still running, with the store's link, before and after you delete, and we keep a note in our audit log that it did. Each game is told within a day, through the list of deleted accounts we keep for 90 days, and deletes its own data for you. What stays: the ledger, the chargeback records and the hashed address against once-per-account codes, as above, with no email address; to prevent fraud, against the address hash, the refunds you made in the last 12 months until each stops counting, any chargeback note or pause on buying for two years, and, if you paid by card, the hash itself against the account id for 18 months after your last card payment, in case a chargeback comes later; and the payment records Stripe, Apple and Google keep under their own policies.

Asking about your data

Email privacy@magneticlabs.games from the address on your account and we'll tell you what we hold, correct it or delete it. Magnetic Labs Inc, 1930 Village Center Circle #3-6537, Las Vegas, NV 89134, United States.

Changes

If what we store changes, this page changes first, with a new date at the top. Adding analytics, or anything else that collects more, would be written here before it happened.