Privacy policy

1. Controller

The game is operated by Jan Czudek, trading as DESIGAME, Czech Republic. Privacy questions can be sent to privacy@desigame.eu.

2. Guest session and device storage

The game issues an essential, random __Host-swc_session cookie. Only its cryptographic hash is stored on the server. Browser local storage under swarmcore:v1 remembers language, accessibility settings and local records. Server records hold the authoritative wallet, cosmetic ownership and mutation plan. Clearing local data does not delete an optional account, but an unregistered guest session may become unrecoverable.

3. Optional Swarm ID

If you create an account, we process the e-mail address and username you enter, salted one-way password verification data, a one-way hash of your recovery code, balances, inventory and account security events. The e-mail can be used as a sign-in identifier. E-mail verification and automated reset mail are not active in this beta. Passwords and recovery codes are never stored in readable form. A callsign used in Live Beta is visible to other players.

4. Realtime gameplay and statistics

To operate public and link-invited custom rooms, the service temporarily processes a random player identifier, room identifier and invite code, callsign, equipped cosmetic loadout, short-lived emote, control input, authoritative position, aim, swarm state, score, mutations, hits and connection timestamps. Rooms contain up to twelve live participants and clearly labelled AI fill. Custom invite links are unlisted, but anyone who receives a still-valid link may enter its lobby. Completed eligible matches store mode, arena number, placement, score, eliminations, shots, hits, chosen mutations and cosmetic-season XP so the player can view accuracy, win rate, mutation usage and season progress. Solo Lab is excluded. There is no player chat.

5. Payments

When the Prism shop is enabled, checkout is hosted by Stripe. Stripe processes payment details under its own privacy terms; Swarmcore does not receive complete card numbers. We retain checkout identifiers, price, currency, entitlement and refund or dispute status for fulfilment, support, fraud prevention and legal accounting obligations. Payment controls remain disabled until the operator's Stripe account, payout account, business disclosures, tax handling and webhook secrets are complete.

6. Hosting, flag images and security data

Hosting infrastructure necessarily receives IP address, time, requested path, browser information and security signals. Country-flag images are fetched from FlagCDN only when a flag collection or equipped flag skin is displayed; that image provider receives the ordinary technical request data needed to deliver the file. This data is used to deliver the service, rate-limit abuse and diagnose failures. Raw operational logs are retained according to hosting and legitimate security requirements.

7. What we do not use

• No ChatGPT or social-network login.
• No advertising trackers or behavioural profiling in this release.
• No location, contacts, camera or microphone access.
• No player chat or file uploads.
• No sale of personal information.

8. Legal basis and retention

Session, account, inventory and multiplayer processing is necessary to provide the features requested. Security and service-integrity processing is based on legitimate interests. Purchase records are retained for fulfilment and mandatory legal periods. Inactive guest room state may be deleted or anonymised; an account is retained until deletion is requested or the service's disclosed inactivity policy applies.

9. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and may complain to the Czech Office for Personal Data Protection. Contact privacy@desigame.eu. Include the Swarm ID username or support reference, never a password or payment card number.

10. Children and changes

The game is intended for players aged 13 and over. Real-money purchasing is restricted to adults or a transaction completed with the account holder's permission. Material changes to accounts, payments or data use will be reflected here before activation.