Insane City is a free browser game. There are no accounts, no advertising, no analytics or tracking pixels, and no third-party marketing. We do not sell, rent or share personal information. This policy explains the little data that does move, so you can decide for yourself.
If you set a display name, it is saved in your browser's localStorage under a single key so the game can greet you the same way next time. It never leaves your device except as described in section 3, it is not readable by other websites, and clearing your browser storage removes it permanently.
Everyone who opens the site joins one shared world. While connected, our realtime server receives and relays to other players in that world:
This information is held only in the server's memory for the length of your session and is never written to a database. When you close the tab it is deleted. Please do not type anything into the display-name field that you would not want other players to see - treat it as public.
Our hosting providers record standard technical logs when your browser connects, which include your IP address, the time of the request, and your browser's user-agent string. These are generated automatically by the infrastructure, are used only to operate and secure the service (for example to detect abuse), and are retained for a short period by those providers before being discarded. We do not use them to build a profile of you.
The site is served by Vercel and the multiplayer server runs on Fly.io. Their privacy policies govern that processing.
To keep the download small, the page loads its 3D engine from the jsDelivr CDN and its typefaces from Google Fonts. Requesting those files necessarily discloses your IP address to those providers. We do not send them any other information about you. If this concerns you, a content blocker will stop those requests; the game will still run, with fallback fonts.
Insane City is not directed at children under 13, and we do not knowingly collect personal information from them. Because there are no accounts, we have no way to identify a user's age. If you believe a child has shared personal information through the display-name field, contact us and we will clear it.
Because we hold no account records, there is generally nothing to export or delete: your name is on your device and your session data disappears when you close the tab. If you are in the EEA, UK, or a US state with a comprehensive privacy law, you retain your rights of access, correction, deletion, portability and objection over any data we do hold, and you may lodge a complaint with your local supervisory authority. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not engage in targeted advertising.
The site is served only over HTTPS. Player input arriving at the multiplayer server is validated and length-limited before it is relayed. No system is perfectly secure, and we cannot guarantee absolute security, but we hold no sensitive data that would be valuable to an attacker.
If this policy changes materially we will update the date at the top of this page. Continuing to play after a change means you accept the updated policy.
Questions about this policy, or a request relating to your data, can be sent to the site operator via the repository at github.com/sanket-kogekar/meridian2050.