Privacy Policy
Last updated: 26 September 2026
- When you play without signing in, we make you a guest account: a random ID with no name or email, so your Scrap, items and progress are saved.
- If you sign in (email or Google), we also store your email and display name so your progress follows you to other devices.
- The leaderboard is public: it shows the name you play under and your scores.
- Payments are handled by Stripe. We never see or store your card number.
- The game can show rewarded video ads by Google, only when you click "Watch an ad". Where the law requires it (EEA, UK, Switzerland), you are asked for consent first and can change your choice at any time.
- A Cloudflare security check keeps bots from creating accounts.
- We count how the game is played (for example how long a first match lasts) with our own simple statistics: no cookies, no third-party analytics, no ad tracking.
- We never sell your data. Email us and we delete your account and everything linked to it.
Who we are
Magnet Brawl is a free browser game. This policy covers the game at magnetbrawl.io and the website and shop at magnetbrawl.com. Both sites use the same accounts and the same data, so this one policy applies to both. We are the controller of your personal data. Contact: maga.business.al@gmail.com.
What we collect
On your device
Your settings, key bindings, best scores, unlocks and challenges are saved in your browser's local storage (keys starting with
magnet.io.). Your sign-in session (guest or signed in) is also kept there (keys starting with sb-) so you stay
signed in. Clearing your browser data deletes them.
Guest accounts
When you open the game without signing in, we create a guest account for you on our servers. It holds a random ID and no name, email or password. Your Scrap, items and game progress are linked to it, so they are kept even though you have not signed up. You can turn a guest account into a full account at any time with "Save progress" (Google or email); everything stays. A guest account lives only in your browser's session: if you clear your browser data before saving your progress, we cannot tell which guest account was yours, and it cannot be recovered. Guest accounts that are never saved and not used for a long time may be deleted.
If you create an account or sign in
| Data | Why |
|---|---|
| Email address | To identify your account and let you sign in. With email sign-up, also to confirm the address. |
| Display name | Shown in game and on the leaderboard. You choose it; with Google sign-in we start from the name on your Google account. |
| Google profile basics | With "Continue with Google", Google shares your name, email address and profile picture link with us. We do not get your password or any other Google data. |
| Password | Only for email sign-up. It is stored hashed by our authentication provider; we can never see it. |
Game progress, wallet and purchases (every account, guest or not)
| Data | Why |
|---|---|
| Game progress | Best mass, kills, runs, wins, challenge points, unlocked titles and skins, and similar stats, so your progress is saved. |
| Wallet | Your Scrap and Magnets balances, and a record of every change (runs, challenges, ad rewards, purchases, shop items), so balances are correct and cheating can be spotted. |
| Items you own | The skins, trails and arenas you bought, so they work on both sites and on every device. |
| Payment records | For Magnet purchases: the pack, amount, currency, date, the Stripe payment reference and the email on your account. We need these to deliver the Magnets, help with problems and keep accounting records. |
Leaderboard
When a run ends, the game may post it to the public leaderboard: the name you played under, peak mass, crushes, game mode, core type, the date and, if you were signed in, a link to your account (shown as a tier badge, never your email). For saved (non-guest) accounts, clicking the name opens a public profile card: your name, title, the look you wear, your records and which skins, trails, arenas and titles you have. Anyone can see the leaderboard and these cards.
Online rooms
Online rooms run on our game servers (Cloudflare). While you play, your browser sends the server your game inputs and the server sees your IP address and the name, core and look you play with; the other players in the room see your name and look. If you are signed in (guest or account), your game also sends the server your sign-in token, so the server itself can save each run from that room to the leaderboard (marked ONLINE) and pay its Scrap to your account. We do not record matches or keep these connection details after you leave.
Browser-hosted rooms
Older friend rooms and Quick Join connect players directly to each other (peer-to-peer). To do that, your browser shares your IP address with the other players in the room and with public STUN servers run by Google that help set up the connection. Room codes, room names and player names you use are visible to the players in the room and, for public rooms, to people browsing Quick Join. We do not store game chat or match recordings.
Game statistics
To see what makes the game fun and where new players give up, the game and magnetbrawl.com send us small, first-party usage events: that a page was opened (with the site you came from, whether you are on a phone or a computer, and your browser language), when a match starts and ends (mode, core, time, peak mass, crushes), the first time you pull in metal or crush someone, how you were crushed, which menu tabs you open, shop views and purchases, and how long the visit lasted. Each visit gets a random ID that is forgotten when you close the page; if you are signed in (guest or account), events are linked to your account ID. We do not store your IP address, email or name with these events, we set no cookies for them, and no one outside Magnet Brawl receives them. Only our team sees the totals.
Technical logs
Like every website, the servers that deliver the pages keep short-lived technical logs (such as IP address, browser type and time of request) for security and to keep the service running.
Support tickets
When you open a ticket on the support page, we store your messages, the category and subject, and the email and name of your account, so we can answer and see your purchases and progress if needed. Tickets are kept while your account exists; ask us and we delete them.
Payments
Magnets are sold through Stripe. The payment form opens inside our page but is run by Stripe: your card number, expiry date and security code go straight to Stripe and never reach us. Stripe also uses information about your device and connection to prevent fraud, under its own privacy policy. From Stripe we only receive whether the payment succeeded and the details listed above under "Payment records".
Rewarded ads
The game at magnetbrawl.io can offer optional video ads that pay Scrap (for example "Watch an ad: +50 Scrap" or "double this run's Scrap"). An ad only plays when you click such an offer. magnetbrawl.com shows no ads.
- Ads are provided by Google (Google AdSense, H5 Games Ads). While the game is open, Google's ad code runs on the page. Google and its partners may use cookies or similar technologies, your IP address and device information to show ads, limit how often you see them, measure them and prevent fraud. See how Google uses information from sites that use its services.
- If you are in the European Economic Area, the United Kingdom or Switzerland, a consent message from a Google-certified consent tool asks you first. Without your consent, Google may only show limited, non-personalised ads. You can change your choice at any time in the game under Settings → Privacy → Ad privacy choices.
- Anywhere, you can control ad personalisation in Google's My Ad Center.
- We do not send your name, email or account details to the ad network. On our side we only record that an ad reward was paid and how much Scrap it gave (your wallet record).
Security check
To stop bots from creating guest accounts and signing in automatically, we use Cloudflare Turnstile. When a guest account is created or you sign in with email, Turnstile checks your browser in the background (and rarely asks you to tick a box). Cloudflare processes technical signals such as your IP address and browser characteristics for this check only, not for advertising. See Cloudflare's Turnstile privacy addendum.
Why we use your data (legal bases)
- To run the game and your account (our agreement with you): accounts, progress, wallet, items, purchases, leaderboard, multiplayer.
- Legitimate interests: security, bot protection, fighting cheating and fraud, technical logs, and the game statistics above (to improve the game). You can object by opening a ticket.
- Consent: personalised ads and the cookies they use, where the law requires consent. You can withdraw it at any time as described above.
- Legal obligations: keeping payment and accounting records as tax law requires.
What we do not do
- No third-party analytics, no advertising trackers and no cookies for our game statistics.
- No ads unless you choose to watch one, and no ads on magnetbrawl.com.
- We do not sell, rent or trade your personal data.
Services we use
These providers process data to run the game:
- Supabase: accounts and sign-in (including guest accounts), database (profiles, wallets, items, leaderboard, game statistics), realtime multiplayer signalling, file storage.
- Vercel: hosts magnetbrawl.io and magnetbrawl.com.
- Stripe: payments for Magnet packs.
- Google: "Continue with Google" sign-in, rewarded ads and their consent message, the Google Fonts used for text, and STUN servers for multiplayer.
- Cloudflare: the game servers for online rooms, and the Turnstile security check.
- jsDelivr: delivers the game engine and code libraries.
Some of these providers process data outside your country, including in the United States, under their own safeguards (such as the EU Standard Contractual Clauses).
How long we keep it
Account data, progress, wallet records and items are kept while your account exists. Guest accounts that were never saved may be deleted after a long time without use. Leaderboard entries are kept as a record of the game unless you ask us to remove them. Payment records are kept for as long as tax and accounting law requires, even after an account is deleted. Game statistics events are kept for up to 12 months. When you ask for deletion, we delete your account, your saved progress, wallet, items, leaderboard entries and the game statistics linked to your account within 30 days (Scrap, Magnets and items are then lost for good).
Your rights
You can ask us to show you, correct, export or delete your personal data, or object to how we use it. Open a ticket on the support page, or email maga.business.al@gmail.com from the address on your account (for a guest account, tell us your player name and roughly when you played), and we will reply within 30 days. If you live in the EU or UK you can also complain to your local data protection authority. You can remove Magnet Brawl's access to your Google account at any time in your Google Account settings under "Third-party apps and services".
Children
Magnet Brawl is not meant for children under 13, and they should not create an account or buy anything. We do not knowingly show personalised ads to children. If you believe a child has given us personal data, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top. For important changes we will also tell signed-in players in the game.