UMBREACH

Privacy Policy

Version 2026-10-17 · Public beta · Last updated: 17 October 2026

UMBREACH is an online tactical shooter. To run it and keep players safe we process some personal data. This page explains what we collect, why, on what legal basis, how long we keep it and what you can do about it. In short: we don’t sell data, there are no ads, no third-party analytics or tracking cookies, and voice chat is not recorded.

1. Who is responsible

Data controller: [MARCEL: legal name or company name]

Tax ID (NIF/CIF): [MARCEL: NIF/CIF]

Address: [MARCEL: full postal address, Spain]

Privacy contact: support@umbreach.com

This policy covers the browser game (play.umbreach.com), the desktop app, the website umbreach.com and the emails we send you.

2. What we process, why, and on what legal basis

DataWhyLegal basis (GDPR)How long
Account: username, email, password (we only keep a salted hash, never the password), sign-up date, last sign-in, language, whether your email is verified, role, and the version and date of the terms you accepted.To create and run your account, sign you in, verify your email and reset your password.Performance of a contract (Art. 6(1)(b)): the Terms of Use you accept.Until you delete the account. Sessions expire after 30 days.
Game and social: level, credits, operators, ranked rating and matches, history, medals, friends, requests, blocks and muted players.To save your progress and friends list.Contract (6(1)(b)).Until you delete the account.
Security log: IP address, approximate country, device and browser type (user agent), platform, game version, time and length of each connection, sign-ins, new accounts and visits to the game site.Security (attacks, fake accounts, abuse), anti-cheat and moderation (for example, spotting someone who comes back with a new account after a ban).Legitimate interest (6(1)(f)): keeping the service safe and fair.90 days; then it is deleted automatically or the IP is cut so it no longer identifies you.
Text chat in rooms and lobbies (text, room, name and account; no IP).To review reports and enforce the rules.Legitimate interest (6(1)(f)).90 days. If you delete your account, your messages are deleted too.
Reports and sanctions: who reported whom, reason, text, room and map; warnings, mutes and bans with reason and length. For bans, the IPs the account used in the last 7 days.Moderation, stopping ban evasion, handling appeals.Legitimate interest (6(1)(f)).While the account exists. Ban IPs are removed when the sanction ends or after 90 days. If you delete the account, your name is removed.
Automatic penalties for leaving matches or team-killing (penalty level and date).Fair matchmaking.Legitimate interest (6(1)(f)).The level drops by itself over time; deleted with the account.
Usage statistics: daily summary (visits, active players, platforms, versions, countries, matches, maps, modes and operators) and, per account, first and last seen, play time, sessions, matches, platform and version.To see how the game is doing and decide what to improve.Legitimate interest (6(1)(f)).Daily summaries contain no IPs or accounts (visitors are counted with a fingerprint that changes every day and is thrown away). Per-account data: until you delete the account.
Game errors: if the game crashes during a match, it sends a short technical notice (error message, map, state, room, version, browser and your username if signed in).To find and fix bugs.Legitimate interest (6(1)(f)).Size-capped file: old notices are replaced by new ones (a few weeks at most).
Performance report (optional, F9 key or Settings): frame times, memory, GPU and similar. No IP, chat or other players’ names; includes your account if signed in.To improve performance when you choose to send it.Consent (6(1)(a)): only sent if you press “Send”.The 400 most recent reports are kept; older ones are deleted.
Support email: whatever you write to support@umbreach.com.To answer you and handle your rights.Legitimate interest (6(1)(f)) and legal obligation (6(1)(c)) when you exercise your rights.As long as needed to resolve it, then up to 3 years in case of claims.
Internal staff log: which staff member viewed a full IP or email, sanctioned or deleted data, and when; also when you export or delete your account (with the IP of that request).To prove data is used properly and detect internal misuse.Legitimate interest (6(1)(f)) and accountability (Art. 5(2)).[MARCEL: set a period; suggested: 2 years]

To stop attacks and abuse, the server also counts for a few minutes or hours, in memory only, how many requests come from each IP (sign-ups, sign-ins, reports). This is not written to disk.

Country: worked out on our own server from a downloaded database (IP Geolocation by DB-IP, CC BY 4.0). Your IP is not sent to anyone for this.

Anti-bot check: when you create an account your device solves a small puzzle (ALTCHA) served by our own server. No third-party captcha, cookies or tracking.

What other players see: your username, level, rank, operator, match stats and what you type in chat. Your friends see whether you are online and which room you are in.

3. Voice chat

Voice chat is not recorded and the audio does not go through our server: it goes directly between teammates (WebRTC, peer to peer). Our server only relays the technical messages needed to connect. A public Google STUN server is used to find a route and can see your IP address, and your teammates can see your connection’s technical address (your IP). If you don’t want that, turn voice off in Settings or mute or block anyone you like.

4. Emails we send

Service emails only: verifying your email, resetting your password, confirming an email change and a welcome message after you verify. No marketing. If we ever want to send news, we will ask for your permission first.

5. Who processes data for us (processors)

Other services your browser contacts when you play at play.umbreach.com (we don’t give them data, but your browser connects to them and they see your IP):

The desktop app ships the fonts and 3D library inside, so it doesn’t connect to Google Fonts or jsDelivr.

We don’t use third-party analytics tools, ad networks or tracking pixels. We would only share data with authorities if the law requires it.

6. Transfers outside the European Economic Area

We try to keep data in the EU. Some of the services above (Google, jsDelivr and, depending on its setup, MXRoute) are companies based in, or with servers in, the United States or other countries. In those cases the transfer relies on the EU-US Data Privacy Framework where the company is certified, or on the European Commission’s standard contractual clauses. [MARCEL: confirm, provider by provider, where data is stored and which safeguard applies]

7. Minimum age

You must be at least [MARCEL: confirm] 16 years old to create an account. UMBREACH is a shooter with text and voice chat between strangers, so we ask for more than Spain’s legal minimum age of consent (14). If we learn that an account belongs to someone younger, we will close it and delete its data. If you are a parent or guardian and think your child has an account, write to support@umbreach.com.

8. Your rights

At any time you can ask for access to your data, to correct it, to erase it, to restrict its use, to object to processing based on legitimate interest, for portability (getting it in a machine-readable format), and to withdraw consent where consent is the legal basis.

9. Automated decisions

Some automatic systems affect gameplay: the chat word filter, penalties for leaving matches and anti-abuse limits. We don’t make purely automated decisions with legal effects on you. Bans are applied by a person on the team and you can ask for a review.

10. Security

Encrypted connections (HTTPS/TLS), passwords stored with a salted hash function (scrypt), session tokens stored only as hashes, role-based staff access with two-factor authentication, and a log of every lookup of sensitive data. No system is perfect: if there is a breach that affects you, we will tell you and report it to the Spanish authority as the law requires.

11. Changes

This is a beta and the game changes. If we change this policy in a significant way, we will announce it in the game or by email before it applies, and update the version and date above.

← Back to umbreach.com · support@umbreach.com