This page explains what data QPang Online handles, why, and the choices you have.
Who we are
QPang Online is run by CraftiGames Studios FZCO ("we", "us"). We decide how the data described here is used. If you have a question about your data, email support@qpangonline.com.
This policy covers this website, including the Cash shop, the browser game client and the game server. Tebex's checkout has its own policy: see Buying Cash.
What the game server keeps
The game asks for a username and password. It doesn't ask for your email address, real name, date of birth or payment details. It keeps the following for each account:
| Data | What it is |
|---|---|
| Account | Your username, an account number and the date the account was created. |
| Password | Stored only as a salted bcrypt hash, never in plain text and never in logs. |
| Progress | Character, rank, level, experience, kills, deaths, matches played and wins. Match rewards are added to these totals and to your wallet. |
| Wallet | Your balances of the in-game currencies don, cash and coins. |
| Items | Items you own and when you got them, your saved weapon loadout and the clothes you have equipped. |
| Friends | Who you have invited or accepted, who sent the invite, and when. |
| Bans | The reason for a ban, when it began and when it ends. |
Other players can see your username, and may see game details such as your rank and match results.
Buying Cash is separate from the game and involves more data: see Buying Cash.
Chat
Chat messages go to the players in the same square, room or match. The server doesn't save them to its database or write them to its normal logs. Other players can still read them and keep copies, so don't share personal details in chat.
Buying Cash
You can buy Cash at our shop. You choose a bundle and enter a username, then pay on a checkout page run by Tebex Limited ("Tebex"), the merchant of record.
We create an order record when you go to checkout, so one also exists if you don't finish paying. It is stored in Cloudflare D1 and holds:
| Data | What it is |
|---|---|
| Order | An order number, the username you entered, the bundle, the Cash amount, the price and the currency. |
| Status | Where the order stands, such as pending, paid, refunded or disputed, and the dates it was created and updated. |
| Tebex references | The Tebex checkout reference and transaction ID. |
| Tebex event | A short record of the latest message Tebex sends us when a payment completes, is refunded or is disputed: its ID, type and date, the transaction ID and the amounts. The full message also includes buyer details such as name, email address, IP address, country and postal code. We use it only to match the payment to your order and don't store those details. |
What Tebex handles
Tebex runs the checkout and deals with payment, tax and receipts. It collects the details it needs for that directly from you and is responsible for them under its own privacy policy. We don't see your full card details.
IP addresses and logs
The game server sees your IP address when you connect. It uses it to limit how many connections and login attempts can come from one address, which helps stop abuse. Those counts are kept in memory and aren't saved to the database.
The server also writes logs, which we use to run the game, fix faults and deal with abuse. They record:
- Sessions and logins, including your IP address, the username used and the reason for any failed login.
- Game events linked to your username and account number, such as joining a room, starting a match and kills in a match.
Passwords are never logged.
Storage in your browser
The game client saves these items in your browser's local storage, on your own device, so the game remembers you and your settings:
| Key | What it holds |
|---|---|
tinbolt.name | The username you last used. |
tinbolt.char, tinbolt.body | Your chosen character and body type. |
tinbolt.loadout | Your weapon slots. |
tinbolt.options, tinbolt.lang | Game settings and language. |
tinbolt.seen, tinbolt.tutorial | Whether you have seen the intro screens and finished the tutorial. |
You can remove these by clearing this site's data in your browser. That doesn't delete your account on the server.
Cookies and tracking
QPang Online uses cookies and similar technologies, such as browser storage, including tracking cookies. We use them to:
- Keep you logged in.
- Understand how the game and the website are used.
- Enforce bans and prevent cheating and abuse, which can include recognising a browser or device that was banned.
If you block these in your browser, you may not be able to log in or play.
We may keep the data we use to enforce a ban for as long as the ban applies.
Fonts and images are served from our own site, not from third parties.
If you follow a link to Discord, Discord's own privacy policy applies there. Likewise, Tebex's own privacy policy applies on its checkout pages.
Who else handles data
We don't sell your data and we don't share it with advertisers.
Cloudflare hosts this website and the game client, and the connection to the game server passes through its network. Cloudflare therefore handles your IP address and technical request details. It may set a short-lived security cookie if its bot protection is active. Order records are stored in Cloudflare D1, its database service. The game server runs on server infrastructure used by CraftiGames.
Tebex Limited runs the checkout for Cash purchases as merchant of record. We tell it which bundle you chose, the price and an order number. You give it your details directly at checkout, and it sends us the payment events described in Buying Cash. See its privacy policy.
Your data may be handled outside your own country, including where the laws differ from those at home. We may also disclose data where the law requires it, or where it is needed to protect players or the service.
Why we use your data
Where data protection laws such as the GDPR apply, we rely on these grounds:
- Providing the game you asked to play: your account, progress, wallet, items and friends.
- Performing the contract when you buy Cash: the order record and Tebex events, so we can add the Cash and deal with problems, refunds and chargebacks.
- Our legitimate interests: keeping the service secure and running, preventing cheating and abuse, fixing faults and understanding how the game and website are used, using IP addresses, logs, bans, cookies and similar technologies.
- Legal obligations: where a law requires us to keep or disclose information, including tax and accounting records for purchases.
How long we keep it
We keep account data for as long as the account exists. There is currently no automatic deletion of inactive accounts. We haven't set a fixed period for how long server logs are kept. We keep them only as long as we need them for the reasons above, and we will state a period here once one is set.
We keep order records, including the Tebex events, for as long as tax and accounting law requires. Deleting your account doesn't delete them during that time. We will state a fixed period here once one is set.
If you email us, we keep that conversation for as long as we need it to deal with your request.
Your rights
Depending on where you live, you may have the right to:
- Ask for a copy of the data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted.
- Restrict or object to how we use your data.
- Receive your data in a portable format.
- Complain to your local data protection authority.
The game has no self-service option for these yet, so email support@qpangonline.com with the username concerned, and the Tebex transaction ID if it is about a purchase. Because a username alone doesn't prove who you are, we may ask for more information before acting, and we may be unable to act on a request if we can't connect you to the account. We may keep the data we use to enforce a ban for as long as the ban applies, and we may have to keep order records for tax and accounting reasons. For the data Tebex holds, see its privacy policy.
Children
QPang Online is for people aged 13 or older, or the minimum age to use online services without parental consent in your country if that is higher. The game doesn't ask for your age. If you believe a child under that age has given us personal data, email us and we will delete it, unless the law requires us to keep it, as with order records. Buying Cash has its own age rules.
Changes and contact
We will update this page if what we collect or how we use it changes, and we will change the date at the top. Questions go to support@qpangonline.com.