3AM Kickout

3AM Kickout, by Sky Elemental

Privacy policy

Last updated

We collect as little as we can. You can play on your own without giving us anything at all. Online play needs an email address, a nickname and your phone's model name, and other players and the public leaderboards see your nickname and your scores; the details are below. The Android game shows ads from Google's AdMob, which collects data of its own, with your consent where the law needs it: the details are below. Apart from those ads there's no analytics and no tracking in the game, on this website or in our emails, and we don't sell your data or share it with anyone except the companies that run our services for us.

Who we are

3AM Kickout is made by SKY ELEMENTAL LIMITED ("Sky Elemental", "we"), a private limited company registered in England with company number 15710186. Our registered office is Suite 8 Stonebridge House, Main Road, Hockley, Essex, England, SS5 4JH. We are the data controller for the game, its online service at play.3amkickout.com and this website. For anything about your data, email privacy@skyelemental.com.

Playing solo or local co-op

Solo play runs entirely on your phone. It needs no account and no connection, and it sends us nothing, so solo runs never go on the leaderboards. (The ads come from Google over the internet when there is a connection: see Ads.)

Local co-op runs between phones on the same Wi-Fi or one phone's hotspot. The host's phone runs the game and the others connect to it directly, finding it by the room code; nothing about the game goes to our server or anyone else, nobody signs in, and players are known only by their place in the game (P1, P2 and so on). Like solo, local co-op records nothing. (The ad after a run comes from Google, once you've left the room: see Ads.)

The game keeps your settings on your phone: the music volume, the sound effects volume, the size of the touch controls, left-handed mode, whether blood is shown, haptics, screen shake, the character you last picked, the outfit you last picked for each character, whether you've seen How to play, how many runs you've finished (the first ones show no ads) and when the last ad closed (to keep ads apart). They never leave the device.

The app asks Android for 8 permissions and no others: internet access, for online play and the ads; vibration, for haptics; network state, to find the Wi-Fi or hotspot local co-op can use (the ads check for a connection with it too); Wi-Fi broadcasts, so phones in a local co-op game can find each other; Google Play's billing, for the store; your phone's advertising ID, for the ads; keeping the phone awake for a moment, which the ads library's background work needs, and keeping the Wi-Fi radio out of its power saving while a local co-op game is on screen, so the phones' moves reach each other without delay; running a foreground service, which the ads library's background work may ask for (the game itself runs none). Besides Google Play's billing, for the store, it contains one library that sends data to anyone: Google's Mobile Ads SDK, for the ads, described under Ads (it sends Google its own diagnostics too). The game adds no analytics or crash reporting of its own.

Playing online

Online play needs an email address to sign in with; there are no passwords. (Solo play needs none.)

Your email address

We email you a sign-in link and a 6-digit code, and we use your address to recognise your account next time. It's stored in our database in lower case, because we need it to send you those emails. It is never shown to other players and never used for marketing: the only emails we send are sign-in emails, when someone asks to sign in with your address, deletion links, when someone asks on the web to delete the account with your address, and a warning before we delete an account nobody has used for 3 years (see How long we keep it).

Your device's name

When you sign in, the app sends your phone's maker and model as Android reports them, for example "ONEPLUS A6013" or "Google Pixel 6". It appears in the sign-in email and on the approval page, so you can tell which device is asking, and it's stored with each sign-in.

Your nickname

You choose a nickname of 3 to 12 characters. Other players see it in rooms and on the public leaderboards. You can change it any time from Account → Change nickname.

Your sign-in

Signing in gives your phone a random sign-in token, which it keeps in the app's private storage (left out of Android backups). Our server keeps only a keyed, one-way hash of it, the device name, when it was created and last used, and a keyed hash of the network it came from (see Logs, limits and security). A sign-in lasts 60 days from when you last used the online features, and never more than 180 days. Signing out ends it straight away, if the app can reach our server.

The app also keeps the email address you last signed in with in that private storage, only to offer it the next time you sign in. Signing out or deleting your account in the app removes it, as does clearing the app's storage or uninstalling it. It stays when a sign-in expires, or when the account is deleted on this website, until one of those happens.

While a sign-in is waiting to be approved, we hold your email address, the device name, the match phrase the app shows you, keyed hashes of the link, the code and the app's polling secret, and how many codes have been tried.

What happens in a room

In an online room, your phone sends the server your controller inputs (stick direction and buttons) and the server runs the game. Other players in the room see your nickname, your character, the outfit you're wearing and how you're doing, and the supporter's crown by your nickname if your account holds the supporter pack. Inputs aren't stored once the game has used them.

What your account owns

We keep a list of what your account owns from the game's store: which packs it holds, whether it has no ads for good, and, for a no-ads pass, when the pass runs out. The game fetches it when you sign in, and each time it starts while you're signed in, to show you the outfits you can wear and to leave out the ads you've paid to turn off. In online rooms the server checks it when you join, so nobody there wears an outfit their account doesn't own; solo and local co-op games run on your phone and don't check with us.

What you buy

You buy from the game's store through Google Play, and you need an account to buy, so what you buy comes with you to any phone. Google handles the payment under its own privacy policy, at policies.google.com/privacy: we never see your card or your Google account. When you start a purchase, the app hands Google Play a one-way hash of your account's random id (never the id, your email address or your nickname), so our server can tell the purchase was made for your account; Google keeps it with the purchase. When you buy, your phone sends our server the product and the purchase token Google Play gave the purchase, and our server asks Google whether the purchase was paid, and tells Google it was delivered.

For each purchase we keep: the order number Google gave it; what you bought; when you bought it; when we recorded it; whether it was a licence tester's purchase, bought without paying; which account it belongs to; and a one-way hash of its purchase token (never the token itself). Every few minutes our server asks Google which purchases have been refunded or charged back, takes back what they gave, and notes when; it keeps the order numbers of refunded purchases too, even ones it never recorded, so a refunded purchase can't be delivered later.

Your phone also keeps Google Play's own list of your purchases, so that outfits you bought on it can be worn offline. Restoring your purchases in the store sends the ones in that list to our server again, to add to the account you're signed in with.

Scores and leaderboards

When an online room finishes a stage, or the whole room is knocked out on one, the server records the run: the stage, how many players took part, whether the stage was cleared, and when the run started and ended. For each signed-in player who took part it records the account, the character they played and their score. Rooms with friendly fire turned on are never recorded.

The leaderboards are public: anyone can see them, in the game or through our online service. Each entry shows the player's nickname, character and score, the size of the room, whether the stage was cleared, the date and time the run ended, and the supporter's crown if the player's account holds the supporter pack. Only your best run for each stage and room size (1, 2–4, 5–8 or 9–16 players) is shown.

Ads

The Android game shows ads, which pay for it: full-screen ads after a run or between solo stages, never mid-fight and at most one every 10 minutes. After an online or local co-op run, the ad waits until you've left the room for the menus, so it never holds anyone up. There are none until you've finished 2 runs on a phone (made it home, run out of continues, or played at least 60 seconds of a run before leaving it), and none in the game for computers. Remove ads, the supporter pack and a running no-ads pass turn them all off. If you have one when the game would start Google's ads software, it doesn't start it at all; if you get one after it has started, the game fetches and shows no more ads from then on, but the software itself runs until you close the game (Android gives no way to stop it sooner). The copy of the app on this website shows ads just as the one from Google Play does.

The ads come from Google's AdMob, through Google's User Messaging Platform (its consent form) and its Mobile Ads SDK in the app. Once you've finished those first runs, each time the game starts it asks Google, when you first reach the main menu, whether you must be asked for your consent (before you've made any choice, and whether or not you have one to make): that sends Google (fundingchoicesmessages.google.com) your IP address, details of your phone and its screen, its language, and the app's name and version. Once your consent allows ads (or where none is needed), and unless you have no ads, the game starts the Mobile Ads SDK, which then talks to Google as it starts, each time the game does, and whenever the game fetches or shows an ad; its background jobs can also send what it has gathered after you've closed the game. It sends Google: your IP address (from which Google works out roughly where you are); your phone's advertising ID and app set ID; information about your phone and the app, such as the phone's model, its Android version and language and the app's version; how you interact with the ads, such as whether you watched or tapped one; and diagnostics about how the SDK is working. Google uses this to choose and show the ads, to measure them, to limit how often you see each one, and to detect fraud; with your consent, to personalise them too. It does so as a separate controller, under its own privacy policy (policies.google.com/privacy) and its policy on how it uses data from apps that use its services (policies.google.com/technologies/partner-sites). We give Google nothing of ours: never your email address, your nickname or your account. We see only AdMob's totals, of the ads shown and what they earned.

Your consent. In the UK, the EEA and Switzerland, before the game fetches any ad it shows Google's consent form, at the main menu or in a solo game's lobby between runs, where you can consent, refuse, or choose purpose by purpose; nothing is fetched until you've answered, and whenever you change your mind the ads fetched under your old choice are thrown away. If you don't consent to personalised ads, Google shows ads that aren't personalised, or, if you don't consent to it storing or reading anything on your phone, only "limited ads", which use no advertising ID. You can change your choice any time in Settings → Ad privacy. Elsewhere, Google may personalise ads unless you opt out on your phone: in Android's settings, under Privacy → Ads (or Google → Ads), you can delete your advertising ID or opt out of personalised ads. The game asks for ads suitable for mature audiences at most, and never marks you as a child: it's for adults only.

On your phone, the game keeps how many runs you've finished and when the last ad closed, with its settings, and, while you're signed in, whether your account has no ads and until when a pass runs, under a one-way hash of your sign-in, so that it knows before it can reach us. It's used only while you stay signed in with that same sign-in: signing out or deleting your account in the game removes it, and so does your sign-in ending (or your account being deleted on this website) as soon as the game hears so from our server. The SDK and the consent form keep your consent choices, and data of their own, in the app's private storage; clearing the app's storage or uninstalling it removes them.

Logs, limits and security

Our server logs each request by its type, its result and how long it took. Its logs refer to accounts, sign-ins and sign-in requests by their random identifiers, and to an email address only by a keyed pseudonym, which can't be turned back into the address without our secret key. They never contain email addresses, IP addresses, web addresses (sign-in links contain secrets), sign-in codes or tokens. Logs are rotated by size, not by age: the oldest are deleted as new ones fill the space set aside for them, so how long an entry lasts depends on how busy the server is.

To stop anyone using the sign-in or deletion forms to flood inboxes or lock people out, we count sign-in and deletion requests per email address and per network. These sign-in and deletion-request counters are stored under keyed hashes, not the addresses themselves, and are deleted when their window ends, within 24 hours. Each sign-in also stores a keyed hash of the network it came from (your IP address, or the first part of an IPv6 address), used only to recognise a network you've signed in from before, so that the limits can't lock you out of your own account. That hash is pseudonymous: it can't be turned back into your address without our key. Your IP address itself is held briefly in the server's memory for rate limiting, and is never written to disk.

So that nobody can use up what Google lets us ask it, we also count how many purchases each account asks our server to check with Google, and how many of those Google refused, and how many checks each network asks for. These store counters are kept against keyed hashes of your account's id and your network, like the sign-in counters, and are deleted when their window ends, within 24 hours.

Everything between the app and our server is encrypted (HTTPS and secure WebSockets). Stored secrets are hashed with a key that is not stored in the database.

Who else handles your data

These companies process data for us, under contract, only on our instructions and only to provide these services:

  • IONOS hosts our server and database, where the data on this page is stored.
  • SMTP2GO sends our emails. It handles your email address and the email's content (the link, the code and your device's name, or, in the warning before an unused account is deleted, its nickname), and keeps each email's headers (who it went to, and its subject) for 35 days. Open and click tracking are turned off for our emails. Our account is in SMTP2GO's EU region: our emails go out through its European servers and it stores their data in the EU. It runs its service on Google Cloud and Amazon Web Services.
  • Fasthosts hosts the mailbox your emails to privacy@skyelemental.com arrive in.

Google sells the game's store items for us through Google Play and takes the payment. It does that as a separate controller, under its own terms and privacy policy, not as our processor: we give it only a purchase's token, when we ask whether it was paid and tell it the purchase was delivered, and the hash of your account's id that the app sets on a purchase.

Google also provides the game's ads, through AdMob, as a separate controller of the data its SDK collects (see Ads), under Google's controller-to-controller data protection terms with us.

We don't sell your data or use it to profile you, and we give advertisers nothing: the only ads are Google's, and what Google collects for them is set out under Ads.

Outside the UK and the EU

SMTP2GO is a New Zealand company, and New Zealand has an adequacy decision from both the UK and the EU, which recognises its data protection as equivalent to theirs. If SMTP2GO or its providers (Google Cloud and Amazon Web Services) process your email address or our emails to you outside the UK and the European Economic Area, they do so under the safeguards in SMTP2GO's data processing agreement with us. Our other processors handle your data in the UK or the EU.

Google, for the ads and Google Play, may process data in the United States and elsewhere, under its own safeguards for transfers (such as the EU-US Data Privacy Framework and the European Commission's standard contractual clauses), as its privacy policy describes.

Why we're allowed to

We keep the records of what was bought because the law requires it (a legal obligation): a business must keep records of its sales, for tax for at least six years, which is why they outlive your account. We keep them for 8 years after each purchase, a little longer than that, in our legitimate interest in answering questions from the tax authorities, and disputes and refund claims, about sales from any year the law still covers. In the UK, the EEA and Switzerland, what the ads store on or read from your phone, and any personalisation of them, rely on your consent, given or refused in Google's consent form and changed any time in Settings → Ad privacy. For everything else on this page we rely on our legitimate interests, and weigh them against yours like this:

  • Running your account and the games you play online (your email address, device name, nickname, sign-ins, what your account owns and what you buy, room inputs and scores): this is the service you asked for by signing in. We use no more than it needs, never for marketing, and you can delete your account whenever you like.
  • The public leaderboards (your nickname, characters and scores): they're part of the game every online player takes part in. You choose the nickname they show, and deleting your account takes your name off them.
  • Security and preventing abuse (the sign-in counters, network hashes and logs, and the numbers of refunded orders, so a purchase refunded before it reached the game can't be delivered afterwards): stopping the sign-in form being used to flood inboxes or lock people out protects you as much as us. These hold pseudonyms, not addresses, and are kept only as long as they're useful.
  • Backups: being able to recover from a failure protects your account and your scores. Backups are kept for the shortest time that still lets us recover, as set out below.
  • Showing ads that aren't personalised, where the law doesn't ask for consent: they pay for the game, which is free to play. They come no more than once every 10 minutes, only at breaks, and can be turned off in the store.

You can object to any of this; see Your rights.

How long we keep it

Our server clears out whatever has outlived the times below every 5 minutes, so each thing goes within 5 minutes of its time.

  • Your account (email address and nickname): until you delete it, or until it has gone unused for 3 years and the day named in our warning email has passed (or, for an address that can't receive email, the day we treat as that; see below). Using it means signing in to the game, or playing online or using the game's other online features while signed in. When an account nears 3 years unused, we email its address, naming a day at least 30 days later; signing in to the game by the end of that day keeps it, and nothing needs doing if you're happy for it to go. After that day we delete it the same way as if you had deleted it yourself (see Deleting your account). We never delete an unused account without sending that email first: if it can't be sent, we keep the account and try again, less and less often. The one exception is an address that can't receive email at all: once its mail server has refused our warning as undeliverable every time we've tried for 90 days, we treat the account as warned, and delete it at least 30 days later unless it's used first. To know when an account was last used, we keep that date with it, and while its address refuses our warning, when that started and when it last happened.
  • Sign-ins: deleted when they expire, when you sign out, or when your account is deleted.
  • What your account owns: until your account is deleted, when it goes with it. A no-ads pass stays on the list until it runs out.
  • What the ads collect: kept by Google, under its own privacy policy, not by us.
  • What you bought: while your account exists, since restoring your purchases and taking back refunds need it. When your account is deleted, its purchases lose their link to it and their token hash at once. What's left (the order number, what was bought, when it was bought and recorded, whether it was a tester's, and any refund) is pseudonymised, not anonymous: we can no longer tell whose it was, but Google, which knows whose order each number is, could. We keep it for our accounts (see Why we're allowed to), and delete it 8 years after the purchase (at once, if your account is deleted later than that).
  • Refunded order numbers (the order number of each refunded purchase, when it was refunded and when our server noticed): deleted 8 years after the refund.
  • Sign-in requests: a request expires 15 minutes after it's made, and is deleted 60 minutes after that.
  • Sign-in and deletion-request counters: deleted when their window ends, within 24 hours.
  • Store counters (the purchase checks each account and network asked for, and the ones Google refused): deleted when their window ends, within 24 hours.
  • Deletion links: a link works for 30 minutes. We keep only a keyed hash of it and whether it was used, and delete that 60 minutes after the link is used or expires.
  • The deletion ledger: when an account is deleted, we note its random id and when it was deleted (never its email address or nickname) for 60 days, longer than any backup is kept. If we ever had to restore a backup, we would delete every account in the ledger again before the game came back, so a restore can't bring a deleted account back.
  • Leaderboard entries: kept for as long as the leaderboards run. If your account is deleted, your entries stay on the boards, shown without your name and no longer tied to an account.
  • Logs: rotated by size, as above.
  • Email headers at SMTP2GO: 35 days.
  • Backups: we back the database up every night. Each backup is deleted once it's 14 days old, at the next night's backup, so anything deleted from the database is gone from every backup within 15 days. The copies we take off the server for safekeeping are kept for the same time.
  • Emails about your data: if you write to us about your data, we keep the emails about your request for 12 months after it's closed, then delete them.

Your rights

Under data protection law (the UK GDPR and the EU GDPR) you have the right to see the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive a copy of it in a portable form. Email privacy@skyelemental.com and we'll respond within one month; writing from the address on your account is quickest. You can change your nickname and delete your account yourself, without asking us.

If you want your account deleted but can't get into its email inbox any more, email us too. We'll ask for details only the account's owner is likely to know, such as its nickname and roughly when and on which phone you last played, and we reply to the address you write from. We keep the emails about any request for 12 months after it's closed, then delete them.

If you're unhappy with how we've handled your data, you can complain to your data protection authority. In the UK that's the Information Commissioner's Office, at ico.org.uk.

Deleting your account

In the game, go to Account → Delete account and confirm with Delete forever. If you no longer have the game, go to play.3amkickout.com/account/delete, enter your account's email address, and confirm on the page through the single-use link we email to that address. Either way, your account, your nickname, every sign-in and the list of what the account owns are erased at once, and the records of what you bought are no longer tied to your account. The packs and Remove ads stay with your Google Play account, to restore to a new one; a no-ads pass can't be restored, and its days go with the account. An account nobody has used for 3 years is deleted in the same way, after a warning email, or after its address has refused our email for 90 days (see How long we keep it). What we keep afterwards, and for how long, is listed above. Step-by-step instructions are on the delete-your-account page.

Adults only

3AM Kickout is for adults aged 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has an account, email us and we'll delete it.

This website

This website is a set of plain pages. It sets no cookies, stores nothing in your browser, runs no scripts, has no analytics or advertising, and loads nothing from anyone else's servers: even the fonts come from us. As with any website, our server sees your IP address when your browser asks it for a page; it keeps no record of your visit. The same goes for downloading the Android app from this site: our web server keeps no access log, so it records nothing about who downloaded it.

Changes and contact

If we change how we handle your data, we'll update this page and the date at the top. Questions, requests or complaints: privacy@skyelemental.com, or write to us at our registered office.