MACH-XPrivacy Policy
Mach-X is a game by Thomas Lehaen. It has no ads and no analytics. This page explains the little data it uses. To delete your data, see Delete your Mach-X data.
On your device
Your progress, settings and Supporter pack rewards are stored on your phone (app storage). Our servers receive only what is described below. Optional play statistics (Settings > "Share play stats") also stay on your phone; they leave it only if you export them yourself. If you use Co-op & friends, your pilot tag and secret key are stored on your phone too. If you are signed in to Google Play Games, your progress (including your pilot tag and secret key) is also saved to your own Google Play Games saved games, a hidden app folder in your Google account that we cannot read; you can delete it there (Play Games > Settings > Delete Play Games account & data, or via your Google Account).
Google Play Games sign-in (optional)
If you sign in with Google Play Games, Google gives the game your Play Games player ID and display name. The game uses them on your phone, to show that you are signed in and, where enabled, to submit your scores to Google Play Games leaderboards. It does not send your display name to our servers. Your player ID reaches our servers only through the optional Play Games link described below.
Sign-in asks Google for these permissions: your Google Play Games profile and game activity, and access to a hidden app-only folder in your Google Drive that Play Games uses for game saves. Mach-X cannot see any other files in your Google Drive, nor your email or your Google Contacts. You can manage or remove this access at any time in your Google Account (Security > Third-party apps) or in the Google Play Games app.
Mach-X's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Co-op & friends (optional)
Co-op & friends is optional. The game creates a pilot account only when you first open it. A pilot account is a random pilot tag (like K7Q2-MX4P) and a secret key. The secret key stays on your phone; our server keeps only a hash of it. There is no email, no password and no real name.
Our server (Cloudflare Workers / Durable Objects) stores this for your pilot account:
- your pilot tag and your callsign (the one you use in the World Rankings)
- your friend list, pending friend requests and blocked pilots
- co-op invites, which expire after 10 minutes
- quick-chat messages between you and your friends: preset phrases and emoji only, no free text. The last 50 per friend are kept, plus unread counts
- your best solo score, which your friends see in the friends ranking
- your online status and last-seen time, which your friends can see. Switch Show me online off (Settings > Profile) to hide it
- your push notification token, if you allow notifications
- the language the game is set to (one of seven language codes), so push notifications arrive in your language
Deleting your pilot account removes all of this at once. See "Your choices and deletion" below.
Play Games link (optional)
If you are signed in to Google Play Games, you can link your Play Games player ID to your pilot account. The game sends a one-time code, and our server exchanges it with Google for your player ID. Our server stores that ID with your pilot account. It is used to suggest Play Games friends who also play Mach-X, and to restore your pilot account on a new phone.
Mach-X reads your Play Games friends list only after you allow it in Google's own dialog. The game then sends those friends' Play Games IDs to our server. The server only checks which of them have a linked pilot, and does not keep the list. Nothing else from your Google account is used.
Push notifications (optional)
On Android, Mach-X can send push notifications through Google Firebase Cloud Messaging. They tell you when a friend invites you to co-op, when a friend beats your best score, and when someone passes you in the World Rankings top 10. You can turn them off in Settings > Profile or in Android settings. Mach-X uses no Google Analytics and no advertising SDK, and shows no ads.
Online world rankings
After a run the game sends to our rankings server: your score, wave, run time, difficulty, plane, game build number, your callsign (a name you choose, or "PILOT" plus four characters) and a random id the app created for this install. If you have a pilot account, the run may also carry your pilot tag, only so we can tell you when someone passes you in the top 10. The random id is not linked to your name, Google account, phone number or a hardware id. Your callsign and scores are shown publicly on the rankings. The server also stores a short one-way hash of your IP address to stop cheating and abuse; the IP address itself is not stored. The server also notes the country your connection comes from, as a two-letter code (like NL) that our host Cloudflare derives from your IP address. Only that code is stored with your entry, and it is shown publicly as a flag next to your callsign. No city or more precise location is used or stored. You can switch online rankings off in Settings. Daily and weekly boards delete themselves after about 9 and 23 days; all-time boards are kept until an entry is removed.
Co-op runs do not go on the solo boards. They go on a separate Co-op board, one entry per pair of pilots, shown publicly with both callsigns. That entry is stored with both pilot tags.
Online co-op
Co-op games connect the two phones directly (WebRTC), or through Cloudflare's relay when a direct connection is not possible. Our server only passes the connection details between the phones (this includes IP addresses). With a direct connection the other player's device can see your IP address, unless you turn on Relay only. The other player sees your callsign, your plane and, if you have one, your Supporter badge. Room data is deleted when the room closes. Apart from a score on the Co-op board, nothing about the session is stored after it ends.
Purchases
Downloads and in-app purchases (such as Supporter packs) are handled by Google Play under Google's privacy policy. The game receives a purchase confirmation from Google Play so it can unlock what you bought; we never receive your payment details.
This website
This website sets no cookies and uses no analytics. It is hosted on Cloudflare Pages; Cloudflare processes your IP address to deliver the pages and protect them against abuse.
YouTube and TikTok clips
We post short gameplay clips of Mach-X to our own YouTube channel and our own TikTok account with a small internal tool ("Mach-X Social Clips"). It uses the YouTube API Services and the TikTok Content Posting API only to upload our own videos to our own accounts. It does not read, store or share any data of other YouTube or TikTok users, and the game itself does not use these APIs. By watching our videos on YouTube you are subject to the YouTube Terms of Service, and YouTube's handling of data is covered by the Google Privacy Policy. The tool stores only its own access token, locally on the developer's computer; access can be revoked at any time on the Google security settings page (or in TikTok under Settings > Security > Manage app permissions), after which the token is deleted.
Service providers
Cloudflare runs our servers (Workers and Durable Objects for the rankings, pilot accounts and co-op, plus the relay for co-op games) and this website (Pages). Google provides Play Games, Firebase Cloud Messaging (push notifications) and Google Play (purchases). Data is sent encrypted (HTTPS / encrypted WebRTC). We do not sell or share data with anyone else.
Children
The game is not directed at children under 13.
Your choices and deletion
Turn off online rankings in Settings to stop sending scores. In Settings > Profile you can hide your online status and turn off push notifications.
To delete your pilot account, tap Delete pilot account in Settings > Profile. It removes the pilot account and everything stored with it at once, and your friends are told you left. Pilot accounts unused for 365 days are deleted automatically. You can also email thomas.lehaen@gmail.com with your pilot tag. To have your World Rankings entries removed, email the same address with your callsign (and roughly when you played). We answer within 30 days. The steps are also on Delete your Mach-X data.
Uninstalling the app or clearing its data deletes everything stored on your phone, but not what is stored on our servers, so delete your pilot account first. Purchases stay linked to your Google account and come back when you reinstall. Google's own data (Play Games, Play purchases) is managed in your Google Account.
Changes
If this policy changes, the new version is posted at this address with a new date.