Privacy Policy
Version 2.12 · Effective September 25, 2026
This notice explains how SubTrench Games (the Operator) handles personal data in connection with SubTrench on subtrench.io and supported third-party game portals (the Service). A person who uses the Service is a User. Guest play requires no account or registration. Optional accounts use an email address and password through Supabase Auth to save progress across devices. Passwords are sent to Supabase Auth, not to the game server. If a User emails the Operator, the Operator receives the email address, message, and any information the User includes.
1. Data stored on the User's device
1.1 When browser local storage is available, the game writes the following keys to it. If storage is unavailable, the game keeps the same values in page memory until the page closes. The first-party game sets no cookies. Optional advertising providers may use cookies or similar technologies as described in section 3.
| Key | Contents |
|---|---|
| st_auth_v1, st_auth_v1-code-verifier | Optional account sign-in session and temporary confirmation verifier. Sign out removes the saved session. |
| st_name | Callsign, for prefilling the menu |
| st_best | Greatest depth reached |
| st_mode, st_adv, st_barvals, st_minimap, st_shake, st_cosmeticEffects, st_sfx, st_sfxvol, st_ambience, st_ambiencevol, st_music, st_musicvol | Game mode, minimap, display, cosmetic effect, and audio preferences |
1.2 When a User joins a room, the game sends the current Callsign and selected game mode to the server. Guests use the default appearance. Quests, achievements, Scrap, and cosmetics require an account. For signed-in players, the browser sends an access token to the game server. The server verifies account identity and stores quest progress, discoveries, puzzle progress, achievements, score records, greatest depth, Scrap, owned cosmetics, and cosmetic selections in Supabase under that account. It loads the selected hull finish, pattern, sticker, sticker placement, trail, and sonar style from the saved profile for display in the game. Minimap, display, and audio preferences stay on the device.
1.3 Device preferences and the guest depth record do not transfer automatically to another browser or device. Account progress is loaded after sign-in on another device. Clearing browser data signs the User out but does not delete account data. Earlier versions may have left st_scrap, st_run_wallet_v1, st_skins, st_skin, st_stickers, st_sticker, st_sticker_pos, and st_achievements_v1 in browser storage. The current game does not use or update these old guest progression saves and does not import them into an account. Clearing this site's data removes those old values, the saved Callsign, depth record, game mode, minimap, display, and audio settings from that browser. On CrazyGames, its Automatic Progress Save may back up browser storage and sync it for an authenticated User. Clearing one browser may not delete a portal backup or a copy on another device.
2. Data processed by the game server and service providers
Optional accounts use Supabase for authentication and database storage. Supabase processes the account email address, authentication requests, and the saved progress listed in section 1.2. Account data remains until the account is deleted or the Operator removes it under the Terms. Users can request account access or deletion through the contact in section 9. Deleting the authentication account also deletes its saved gameplay profile. Authentication tokens and email addresses are not shown to other players.
2.1 Operating a real-time multiplayer session necessarily involves the following.
| Category | Purpose | Retention |
|---|---|---|
| IP address and connection metadata | Serving pages, measuring latency, routing game traffic, selecting a room and mode, and enforcing per-network connection limits | Connection and any brief reconnect grace, plus the accepted-session record below; provider records, if any, follow provider terms |
| Callsign | Showing it in the room, leaderboard, kill feed, and wreck-salvage message | Connection and any reconnect grace, plus up to 1 second in the leaderboard, 8 seconds in the kill feed, 40 seconds in a wreck record, and the accepted-session record below |
| Selected hull finish, pattern, sticker, placement, trail, and sonar style | Showing the chosen cosmetics on the submarine | Connection and any reconnect grace |
| Session state (server-assigned ID, position, level, Haul, Parts, modules, Hull, pressure clearance, and team) | Running the simulation and restoring it after a brief accidental interruption | Connection plus up to 15 seconds of reconnect grace, except kill-feed IDs and teams may remain for up to 8 seconds, and a death wreck may retain the death position and part of the Haul for up to 40 seconds |
| Random reconnect token and per-IP pending/active connection counters | Allowing the same page to reclaim an interrupted session and limiting excessive simultaneous connections | Process and page memory only; the token lasts for the connection and at most 15 seconds after an interruption, is replaced after a successful resume, and is not written to browser storage or the accepted-session record; counters last while relevant connections or reservations exist |
| Accepted-session record: full client IP address, sanitized Callsign, random per-session record ID, room and mode, connection origin, browser user-agent string, join, first-recorded-activity, last-recorded-activity, and disconnect times, counts of recognized input and action messages, and successful reconnect count | Operating and securing the Service, distinguishing ordinary browser play from likely automation, reviewing abuse, diagnosing session or connection problems, and planning capacity | While connected and for up to 30 days after disconnect; at most 10,000 completed rows are kept, so a row may be removed sooner |
| Application errors and system-journal entries | Security and debugging | Host's configured journal rotation; no fixed period |
| Connection and aggregate egress byte counts | Bandwidth budgeting | Per-connection byte count until disconnect; aggregate total until the month changes |
| Aggregate operations metrics: successful joins; current, recently active, and peak session counts; disconnect counts; summed and longest completed-session duration; room and mode totals; refused joins; and connections that send no join message before the join-grace period expires | Measuring use, planning capacity, diagnosing join failures, and operating the Service | Live session timing is held in memory until disconnect or restart; UTC daily totals for up to 90 days; lifetime aggregate totals until the Operator deletes the metrics file |
| Short-lived authorization-failure and polling counters for the private operator API | Limiting repeated unauthorized attempts and excessive authenticated polling | Process memory for up to 10 minutes after a failed attempt or 1 minute after an authenticated request; the request and counters are not logged or persisted by the game application |
2.2 The accepted-session history is stored separately from the aggregate metrics file. It uses a new random record ID for each accepted session and does not create an account, stable player or device identifier, or gameplay profile. It retains the connection's user-agent string and summary counts of recognized input messages, action messages, and successful reconnects, but does not retain positions, loadouts, message contents, action types, communications, reconnect tokens, or a per-action gameplay event stream. A successful resume within the reconnect grace continues the same accepted-session row, including when a signed-in User reopens the game and recovers a disconnected dive on the same server. This account recovery uses verified account identity and does not require the old reconnect token. An active connection blocks another tab from joining that account. A fresh dive after the grace expires or the User returns to the main menu creates another row. Callsigns, IP addresses, user-agent strings, and origins may be shared, reused, changed, or imitated, and the records do not establish how many unique or “real” people played.
2.3 File permissions restrict the session history to the server service account and host administrators. It is available to the Operator through a token-authenticated API that accepts loopback requests. The Operator reaches it through an SSH tunnel and a native monitor; the monitor uses an ephemeral network session, does not intentionally save the returned rows to local storage, and clears them on disconnect or quit. Infrastructure and network providers necessarily process connection data to deliver traffic and may have operational access or records under their own terms.
2.4 A Callsign is user-supplied free text sent to other Users in the room and displayed publicly. It may remain in another User's page memory until newer entries replace it or that page closes; the game does not write other Users' Callsigns to browser storage. Users must not enter personal data into a Callsign.
2.5 If a User emails the Operator, the email address and message are used to answer the request and, where relevant, address security, abuse, or legal issues. Correspondence is kept in the Operator's mailbox for as long as reasonably needed for those purposes; no fixed deletion period is currently set. A User may request deletion under section 9, subject to records the Operator must retain by law.
2.6 The site's pages include Cloudflare's browser beacon for real user monitoring (RUM), which measures page performance. Where enabled for a visit, it sends timing measurements, page and referrer URLs, and a per-page identifier to Cloudflare. Cloudflare states that its beacon does not read or write cookies or other browser storage, and that its RUM service discards request IP addresses at its nearest data center. See Cloudflare's RUM data and privacy information.
3. Advertising
3.1 The game and Bestiary pages on subtrench.io load the Google AdSense tag for site verification. As of the effective date above, the site is awaiting AdSense approval and does not serve live AdSense advertisements. If Google approves the site and the Operator enables an eligible format, Google may use the same tag to serve and measure advertisements. The direct-site build does not currently enable the separate Google H5 Games Ad Placement API. Development builds may also contain a simulated ad provider; the simulation itself makes no third-party ad request and sets no advertising cookie.
3.2 On supported third-party game portals, including CrazyGames and 1001Juegos domains, the game may load the CrazyGames SDK. The portal or SDK provider may process IP addresses, device and browser information, advertising identifiers, ad interactions, gameplay start and stop events, and backups of browser storage under its own privacy policy. The game sends gameplay start and stop events and receives status messages such as whether an ad started or finished so that it can pause, resume, or grant an offered reward. CrazyGames states that usage data it shares with a game developer is anonymized. See the CrazyGames Privacy Policy.
3.3 When the AdSense tag loads, the User's browser may send Google the page URL, IP address, browser and device information, and identifiers associated with cookies or similar technologies. If an ad is served, Google and its advertising partners may also process ad requests, impressions, interactions, approximate location derived from the IP address, and information used to prevent fraud, measure performance, select ads, and, where permitted, personalize ads. If advertising is enabled, third-party vendors, including Google and its advertising partners, may place and read advertising cookies. Google's advertising cookies allow it and its partners to serve personalized ads based on a User's prior visits to subtrench.io and other websites, where permitted. A page may contact Google even when no visible ad is ultimately shown. Google describes this processing in How Google uses information from sites or apps that use our services.
To opt out of Google's personalized advertising on partner sites, Users can turn off personalized ads in Google's Partner Ad Settings. The control's availability and scope depend on the browser and sign-in state, as explained in Google's guide to personalized ads.
3.4 Where consent or a privacy choice is required, the site may use Google's certified consent-management message to request or record that choice before eligible advertising storage or personalized advertising is used. Depending on the User's region and choice, Google may serve personalized ads, non-personalized or limited ads, or no ad. Users can manage cookies in their browser and can use the controls presented by Google. Blocking or deleting cookies may affect advertising; clearing this site's local storage or site data deletes the game preferences and progress described in section 1.
3.5 A third-party portal's privacy policy applies to the portal and its advertising in addition to this notice. Requests about a portal's or provider's processing may be directed to that party; requests about the Operator's role may be sent under section 9.
4. Minors
4.1 The Service is not for children under 13, and the Operator does not knowingly collect personal data from them. A child under 13 must not use the Service. If a parent or guardian believes a child has provided personal data controlled by the Operator, they may contact the Operator under section 9. The Operator will investigate and take the action required by applicable law. A portal or advertising provider handles requests about data it controls.
5. California residents (CCPA / CPRA)
5.1 To the extent the CCPA / CPRA applies, the categories the Operator directly handles are identifiers (IP address, a User-supplied Callsign, and an email address and account ID for optional accounts) and internet or network activity (connection, room, mode, and session data). The selected hull finish, pattern, sticker, sticker placement, trail, and sonar style are also displayed during the connection.
5.2 The Operator does not directly collect government identifiers, financial information, precise geolocation, or biometric data through the game.
5.3 The Operator does not sell personal information for money. When AdSense is active, information may be disclosed to Google and its advertising partners as described in section 3. Depending on applicable law and the advertising settings or consent selected by a User, some of that processing may be treated as sharing for cross-context behavioral advertising or targeted advertising. Available opt-out and consent controls are presented through Google's privacy message or advertising controls. Advertising on a third-party portal is also governed by that portal's and provider's policies.
5.4 If the CCPA / CPRA applies, a California resident may have rights to know, access, correct, or delete personal information, and not to receive discriminatory treatment for exercising those rights. Requests may be sent under section 9.
5.5 Callsigns and IP addresses may be shared, changed, or reused, so the Operator may be unable to verify that a guest session row belongs to a requesting person. Optional account requests can be verified through the account email address. The Operator may ask for information reasonably necessary to verify and act on a request.
6. Other United States privacy laws
6.1 Depending on residence, the law's applicability thresholds, and the processing involved, a User may have rights to access, correct, delete, or obtain a copy of personal data, or to opt out of certain uses. Requests concerning data controlled by the Operator may be sent under section 9. Requests concerning a portal or advertising provider should be sent to that party.
6.2 If applicable law allows a User to appeal the Operator's decision on a privacy request, the User may reply to that decision with the word Appeal and the reason for the appeal.
7. Rights and legal bases in other jurisdictions
7.1 Depending on residence, a User may have rights of access, correction, deletion, restriction, objection, portability, or complaint to a local data-protection authority. A User can delete browser data by clearing this site's data and can contact the Operator under section 9 about data the Operator controls. A portal or advertising provider handles requests concerning its own processing.
7.2 Where European Economic Area or United Kingdom data-protection law applies, the Operator relies on legitimate interests to operate, secure, measure, and plan capacity for the Service, review abuse, diagnose problems, and answer correspondence, and on legal obligations where processing is required by law. The recipients of Operator-controlled data are infrastructure and network providers needed to deliver the Service and the email provider used for correspondence. Session history and aggregate operations metrics are available only to the Operator through the loopback-only, token-authenticated API and native monitor described in section 2.3, subject to necessary infrastructure-provider access. A portal or advertising provider describes its own purposes, recipients, and legal bases in its policy; responsibility for SDK-related processing also depends on the provider agreement and applicable law.
7.3 The current direct-site game server is hosted in the United States, in the US East region. A User who connects from another country sends the connection and session data in section 2 to the United States. A User may contact the Operator under section 9 for information about safeguards that apply to the Operator's providers.
8. Amendment
8.1 The Operator may amend this notice by posting a revised version and effective date on this page. Account and guest Users can review the current notice on this page.
9. Contact
SubTrench Games — [email protected]. See also the Terms of Service.