Shapefront — Privacy Policy

Effective date: June 17, 2026 Last updated: October 5, 2026 Version: 2.2

The short version

This policy explains the details.

1. Who we are

Shapefront ("the Game") is operated by Bitlitic LLC ("we", "us", the "Developer"), the data controller for the account and gameplay data described below. Contact: support@bitlitic.com. We have not appointed a Data Protection Officer or an EU/UK representative; please direct any privacy request to the contact email above.

2. Data we process

2.1 If you do NOT sign in (single-player)

The Game saves your progress, authored strategies, and settings locally in your own browser (IndexedDB / local storage). This data does not leave your device, is not accessible to us, and is deleted when you clear your browser's site data. We do not operate accounts for players who never sign in. The only data we receive from them is the anonymous usage statistics and error reports described in §2.4.

2.2 If you sign in (multiplayer / cloud save)

Signing in is an affirmative act that creates an account. Once you sign in, we collect and store:

We do not ask for or store payment information; the Game is free.

2.3 Technical and operational data

Our hosting provider and our server may log standard technical data — IP address, request timestamps, and user-agent — for security, abuse prevention, and operating the service. We keep an internal audit log of security-relevant account events (e.g., sign-in, save, reward grants) for the same purposes.

2.4 Usage statistics and error reports

To see how the Game is played and where it breaks, it sends events to Bitlitic Ops, our own analytics system: a self-hosted copy of Umami at analytics.ops.bitlitic.com, which Bitlitic runs itself on a virtual server rented from Hostinger in Boston, USA. It receives:

It sets no cookies and stores nothing on your device. It does not store your IP address — visits are grouped using a hash that changes every month — and it receives no account id, no email, no display name and nothing you type.

If the Game hits an unexpected error, it sends an error report to our own error-reporting server (otel.ops.bitlitic.com, on the same Hostinger server in Boston): the error message and technical trace, and the Game version. Emails, sign-in tokens and web-address parameters are removed before it is sent.

Bitlitic Ops data is not sold or shared with third parties, and is not used for advertising or to follow you across other sites.

3. How we use data, and our lawful basis

Purpose Data used Lawful basis (GDPR / UK GDPR)
Create and operate your account email, uid, auth metadata Performance of a contract (Art. 6(1)(b))
Cloud-save and sync your progress game data Performance of a contract (Art. 6(1)(b))
Matchmaking, leaderboards, multiplayer loadout, MMR, display name Performance of a contract (Art. 6(1)(b))
Security, anti-cheat, abuse prevention technical data, audit log Legitimate interests (Art. 6(1)(f))
Understand how the Game is played and fix errors usage statistics, error reports (§2.4) Legitimate interests (Art. 6(1)(f))
Show and validate ads see §5 Consent (Art. 6(1)(a)) / legitimate interests
Comply with law as required Legal obligation (Art. 6(1)(c))

We do not sell your account or game data, and we do not use it to build advertising profiles. Advertising data is handled by the ad network as described in §5.

4. Processors and third parties we share data with

We disclose data to others only where required by law or to protect the rights, safety, or security of users and the service.

International transfers. Account and game data, and the usage statistics and error reports in §2.4, are stored and processed on servers located in the United States. If you access the Game from the EU, the UK, or another region, your personal data is transferred to and processed in the United States; where such a transfer requires a safeguard, we rely on an appropriate mechanism such as the Standard Contractual Clauses.

5. Advertising and your ad choices

The Game and our website show ads to keep the Game free. Ads are served through Google AdSense (including Google's H5 Games Ads for ads shown between battles), the ad network. We may also show optional rewarded video ads.

The ad network is an independent controller of the advertising data it collects; see the Google Privacy & Terms and How Google uses information from sites or apps that use our services.

6. Retention and your right to erasure

7. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, to withdraw consent (e.g., for ads), and — under CCPA/CPRA — to opt out of sale/sharing and to non-discrimination for exercising these rights.

8. Children's privacy (COPPA and similar)

The Game is not directed to children under 13 (or the minimum age in your jurisdiction, e.g., 16 in parts of the EU), and we do not knowingly create accounts for, or collect personal information from, children under that age. Account creation, multiplayer, and ads are intended for users old enough to consent under applicable law. If you believe a child has created an account or provided us personal information, contact support@bitlitic.com and we will delete it. Where required, we apply measures such as restricting personalized ads for users we know to be children.

9. Data security

Account and game data are transmitted over encrypted connections and stored on our hosting provider under access controls. Authentication is handled by Google Firebase. No system is perfectly secure; please keep your browser and sign-in account secure on your end.

10. Changes to this policy

If we materially change how we handle data, we will update this policy, change the "Last updated" date and version, archive the prior version in legal/archive/, and re-open the in-app consent gate so you can review and re-accept.

11. Contact

Privacy questions and rights requests: support@bitlitic.com

© Bitlitic LLC

← Back to the game