Privacy Policy

Effective October 26, 2026 · Owner: Olamide Olatayo Bello

Who operates the service

Olamide Olatayo Bello operates Cellblock Cat & Mouse and is responsible for the data practices described here. This policy describes the current game implementation.

Information processed

• Account data: player name, random account identifier, salted scrypt password hash, wins, and points. The server receives a password to authenticate you but stores its hash rather than plaintext.
• Sessions: random session tokens, associated account identifiers, and expiry timestamps. Sessions last up to seven days unless revoked earlier.
• Gameplay: room codes, roles, positions, fictional inventory, facility details, scores, event messages, and search/policy records.
• Technical data: network requests and source IP addresses for security and temporary rate limits. The Nginx gateway and hosting infrastructure may keep access/error logs, including IP addresses, requested URLs, times, and browser details.
• Contact requests: the category, message, optional reply email, optional signed-in account identifier, submission identifier, status, and timestamp.

Why information is used

Information is used to create accounts, authenticate players, operate multiplayer rounds, show leaderboards, protect against misuse, diagnose failures, maintain backups, and handle owner requests. Where applicable law requires a legal basis, these purposes include providing the requested service, legitimate security/operational interests, and compliance with legal obligations. This game does not use an advertising or behavioral analytics SDK, and does not sell personal information through its implemented features.

What other people can see

Player names, wins, and points appear on the public leaderboard. Room participants can see room codes, roles, positions, submitted facility details, scores, and event messages. Other players’ bag contents, concealment state, and scanner state are redacted. Search audit entries are filtered to the involved player or actor. Operators with server access can access stored information. Do not use a real name or private residential address if you do not want it displayed.

Browser storage and outside services

The browser stores your login token in local storage under cellblock-token. Signing out removes the local token and revokes that session. Clearing browser storage removes the local copy but does not delete your account or immediately revoke the server session. Fonts may load from Google Fonts, causing your browser to contact Google and disclose network/request information under Google’s own policies. Hosting and certificate infrastructure also process information needed to deliver the website. No third-party advertising cookies are deliberately set by the game.

Mobile clients and offline shell

The Android client uses Android System WebView with separate app storage for sessions. It requests internet access, not contacts, location, camera, or microphone permissions. Removing app data removes locally stored sessions but does not delete the server account. Browser-installed editions may cache public website files for the app shell; API responses and game account data are not deliberately cached by the service worker. Multiplayer still requires internet access.

Retention and security

Accounts, scores, and contact requests persist in SQLite until the operator deletes them. There is currently no automatic account/contact-request retention schedule. Expired sessions are removed during subsequent authentication activity. Rooms expire after two idle hours, and active rounds and search records are not durable across server restarts; round records reset for new rounds. Server logs and backup archives have no automatic deletion schedule configured by this project. Backups may retain older information until the operator removes or replaces them. Password hashing, session expiry, access controls, and HTTPS reduce risk; no system guarantees absolute security.

Requests and choices

You may request access, correction, deletion, or other applicable privacy rights through the owner contact form. Requests are stored for manual review, not automatically completed. Sign in before submitting an account request when possible, or provide a reply email so ownership can be verified. Never send your password. Responses depend on review and identity verification; applicable legal obligations and rights control. Complaints may also be directed to the data-protection authority available in your jurisdiction.

Adults and sensitive information

The service is intended for adults aged 18 or older and does not implement age verification. Do not submit medical details, real incarceration records, identification documents, or real abuse allegations through game fields. Notify the operator if an underage account or inappropriate collection is suspected. This service is not a real-world PREA reporting system.

Changes

Updates will appear here with a revised effective date. Material changes will receive additional notice when required. The owner contact form is not an emergency channel.

← Back to the game