Privacy and data

Last updated: 2026-11-02

BLRQ offers optional accounts. You can play as a guest without giving us an email address. Guest handles and active game state are temporary and are not saved as accounts.

Account information

• For an account, BLRQ stores your verified email address, unique handle, profile settings, account identifier, account timestamps, and your player blocklist.
• Sign-in codes are short-lived. The server stores a keyed code hash, expiry, attempt count, and a keyed hash of the requesting IP address for rate limiting, not the code itself or a raw IP address in the challenge record. The transactional email provider receives your email address and sign-in code to deliver the message.
• Session records contain a one-way token hash and creation, expiry, and revocation timestamps. The browser session token is held in an HttpOnly, Secure, SameSite cookie.
• Special accounts also store their access kind and assigned tester, developer or administrator role. Administrator invitations store the recipient email, role, issuer, expiry, usage/revocation timestamps and a one-way token hash. Privileged access changes are recorded in the persistent administrator audit, without invitation tokens or sign-in codes.

Gameplay and security

Player position, physics, match membership, weapon state, and guest identity exist in server memory while connected. BLRQ does not persist moment-to-moment gameplay state or archive chat by default. This release does not collect payment details, advertising identifiers, or precise location. Voice media capture is not available in this release.

Retention

• Account and profile information is kept until you delete the account.
• Sign-in challenge records are removed within 24 hours after their 10-minute expiry.
• Expired or revoked session records are removed within 30 days.
• Invitations are removed within 30 days after their seven-day expiry. Account deletion redacts the invited recipient email and revokes pending invitations.
• Closed moderation reports are removed after 12 months. Blocklist entries remain until unblocked or the account is deleted. Administrator and moderation action history is retained permanently unless an eligible administrator completes the audited deletion-approval flow.

BLRQ does not retain web/API access logs in this deployment. Encrypted off-site backups and a tested restore process must be configured by the service operator before account registration is enabled. Account deletion immediately removes the profile, anonymizes the stored email, revokes sessions and tickets, and records a minimal account-identifier tombstone so deleted data is not reintroduced from a restored backup.

Your controls

From the account panel you can export account/profile/session data, sign out, or delete your account. Deletion requires a recent email-code sign-in. The profile is removed and access is revoked immediately; account records are anonymized. Guest play remains available after sign-out or deletion.

Contact

For privacy questions or account access issues, contact the BLRQ service operator through the project community link on the game page.