Privacy policy

This policy explains what information we ("we", "us") handle when you visit this website or play Midnight Markdown in the browser or as the PC app, and what we do with it. We keep it short because we collect very little.

Midnight Markdown is an independent game made and run by an individual under the name grailsformail. It is not a company.

1. This website

• The site has no contact forms, newsletter or ads, and loads no analytics, tracking or other third-party scripts. Game accounts are optional (below).
• We do not set cookies of our own, except the login cookie described below if you log in to a game account.
• The game stores your best score and best wave in your browser's local storage under the keys sds-lps-best-score and sds-lps-best-wave, the shoes you have found and the one you have equipped under sds-lps-index, your knife skin under sds-lps-knife, and your ten best runs (points, wave, kills, mode and the day) under sds-lps-scores, the best score for each game mode under sds-lps-mode-best, the same two for the Neon Shore map under sds-lps-scores-vice and sds-lps-mode-best-vice, for Whiteout Pass under sds-lps-scores-ice and sds-lps-mode-best-ice, for Ward Nine under sds-lps-scores-ward and sds-lps-mode-best-ward, for Hotel Insole under sds-lps-scores-hotel and sds-lps-mode-best-hotel, and for Grind Yard under sds-lps-scores-park and sds-lps-mode-best-park, and your game settings (the map you picked, mouse sensitivity, field of view, volume, music level, the performance overlay, the lighting look and its strength, the sky and weather you picked, whether the map intro plays, whether auto-sprint is on, key bindings, the controller layout, stick sensitivity, deadzone and invert Y, and the graphics settings: preset, shadows, render scale, anti-aliasing, view distance, textures, bloom, motion blur and frame cap) under sds-lps-settings, your player's clothes and skin tone under sds-lps-outfit, and which one-time touch screen tips you have closed under sds-lps-hints, and your kills and headshots per weapon with the camos you have earned and equipped under sds-lps-camos, the start kit you picked under sds-lps-kit, your level, XP, cases, case items and gun attachments under sds-lps-progress, and the name you last typed for the online board under sds-lps-board-name, your choice on posting runs to the online board (on or off, its version and when you chose) under sds-lps-data-consent, and whether the diagnostics overlay is on under sds-lps-debug (its log stays in memory and is only copied if you press Copy diagnostics), and, only while you host a co-op lobby, its host token in this tab's session storage under sds-lps-host- plus the lobby code (gone when the tab closes), and, if you log in to a game account, your account name and an anti-forgery code under sds-acct-session (the short-lived login token stays in page memory only, and the game server keeps you logged in across reloads with its HttpOnly cookie __Host-lps_rt, 30 days, deleted when you log out; see the cookies page). They never leave your device, except a Cloud save you make and the name and run you choose to post to the online board (below). Posting to the board is off until you tick its box after a run, and you can turn it off again in Settings, Data choices; with it off, no run is sent. You can clear them all with Delete my data in the game's Settings tab (it also deletes a cloud save if you type its code), or by clearing this site's data in your browser. Board entries cannot be deleted from the game yet: ask us at the address below and we will remove yours. They also drop off when pushed out of the top 100, and Daily boards are deleted after 7 days.
• The game's online parts (the lobby list and the online board) talk to our game server, which runs on Cloudflare Workers. It stores only what you send it: for the board, the name you type, your score, wave, kills, run length, map, mode, the Daily date and when you posted (only the top 100 per board are kept, and Daily boards for 7 days); for lobbies, the lobby name, map, mode, player counts, public or private, and when it was created and last used (deleted 5 minutes after the last activity). If you use Cloud save, it stores a copy of the game data listed above (not the board name) under a random code with created and updated times, deleted after 180 days without use or when you delete it with the code. It stores no payment details, device ids or IP addresses. Cloudflare, as the network operator, sees your IP address and request headers on every request; the server reads the IP only to apply rate limits in memory, and its request logs are turned off. The game only contacts the server when you open the Online tab, post a run, use Cloud save, or join a co-op match.
• Game accounts (optional, 13 and up, shown in the Online tab once our server turns them on; until then it says accounts are coming soon and nothing is sent). If you sign up, the server stores your username, your email address and whether you confirmed it, a salted hash of a key made from your password in your browser (your password itself never leaves your device), a hash of your recovery key (the key is shown to you once and not kept), your saved game data if you save to the account, and when the account was made. Each login creates a session that expires after 30 days; the server keeps only a hash of it. We use your email only to confirm it and to send a password reset link you ask for, through an email service named here once one is set up (none is today, so no email is sent). Failed logins are counted for a short time to stop password guessing. You can log out, log out everywhere, change your password or email, and delete the account with everything in it from the Online tab.
• In a co-op match, the server passes messages between the players in your lobby and keeps none of them: your name, your outfit, where you stand and look, your health, points and held weapon, and your shots. The other players in the lobby see these while the match runs. The host's game also sends the shoes, waves and doors. Nothing from a match is saved on the server or posted to the board.
• The site is hosted on Cloudflare Pages, and the game server runs on Cloudflare Workers. Like any web host, Cloudflare processes technical data such as your IP address, browser type and the pages you request in order to deliver the site and protect it from abuse, under the Cloudflare privacy policy. The network may set a strictly necessary security cookie (for example __cf_bm) to tell people apart from bots. We have not turned on Cloudflare's Web Analytics for this site, and we add no tracking of our own. See cookies and storage.

2. How we use information

• To run the game's online features you ask for: lobbies, co-op, the board, cloud saves and accounts.
• To answer your questions and handle support requests.
• To enforce our terms and to prevent cheating, fraud or abuse.
• To comply with the law.

We do not sell or rent personal information, and we do not use it for advertising.

3. Sharing

We share information only with the services that run the game (Cloudflare for hosting and the game server), when the law requires it, or to protect our rights or the safety of others. Your board name and runs you post are public, and other players in your lobby see what the co-op section above lists.

4. How long we keep it

As listed above: board entries while they stay in the top 100 (Daily boards 7 days), lobbies 5 minutes after the last activity, cloud saves 180 days without use, and account data until you delete the account.

5. Your choices

You can delete your local data and cloud save from the game's Settings, delete your account from the Online tab, and ask us to remove a board entry or any information we hold about you, subject to records we must keep by law. Depending on where you live, you may have further rights to access, correct or delete your data.

6. Children

Midnight Markdown is for players 13 and up. This is our own guidance, not an ESRB or PEGI rating. Players under 13 may not post a name to the online board, make a cloud save, create an account or use online lobbies. We do not knowingly collect information from children under 13; if you think a child posted a board name or made an account, tell us and we will remove it.

7. Changes

If we change this policy, we will update the date at the top of this page and show a notice for material changes.

8. Contact

Email: [contact email, to be added].