Privacy policy

Effective 19 October 2026

Who we are

NimbleMyth is an independent game studio run by Yvan Boily in British Columbia, Canada. In this policy, “we” means Yvan and NimbleMyth. It covers the website at nimblemyth.ca and our games: Downdraft, Puck & Glory, Vector Trackz and the upcoming roguelike.

Yvan Boily is our Privacy Officer and is responsible for the personal information described here. Write to support@nimblemyth.ca with any question, request or complaint.

The law that applies to us is British Columbia’s Personal Information Protection Act (PIPA). Where our games are used across provinces or borders we also follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA). We give everyone the same rights, wherever they live.

The short version

• No game needs an account, and none asks for your name, address, phone number or payment details.
• Your saves, scores and settings stay on your device. We never receive them.
• Some games send anonymous play statistics (what was played, how it went) under a random number, never your name. Each game below says whether that is on or off to start, and how to change it.
• The Android version of Downdraft shows ads through Google AdMob, and sells a one-time “remove ads” purchase through Google Play. Google handles both.
• Our website and games run on Cloudflare, which sees your IP address when you connect.
• We do not sell your information, and we do not share it for advertising.

What each game sends

Windows versions on Microsoft Store and Steam are planned. Those stores collect their own data under their own policies, and we will update this page before a game ships there.

Downdraft

On your device: your high-score table (including the initials you enter), your options and key bindings, the mission you are partway through, whether you bought “remove ads”, and a random install number. This lives in your browser’s or app’s own storage. Clearing the site’s data, or uninstalling the app, deletes it. On Android, the system may include app data in your device backup to your Google account; that is Android’s feature, controlled in your Android settings.

Anonymous play statistics go to our own server at stats.nimblemyth.ca, run on Cloudflare. Every report carries a random install number (not your device, advertising or store id), the platform (web, Android, Steam or GOG), the game version, a random number for the current sitting, the seconds since the install number was made, and the days since you last played. Cloudflare tells the server which country the connection comes from; we keep the two-letter code and not your IP address. The reports themselves are:

• the game was opened;
• how long your first rescue took and whether you played the training;
• how each mission ended: which mission, the tour, the difficulty, complete or failed, prisoners rescued, time taken, medal, and whether you used a continue;
• when your last chopper was lost: the mission and the cause in a word such as crash or missile;
• your daily sortie: its number and rule of the day, your score, time, and whether you shared it;
• that you shared a result or opened a shared link, by kind and route (never what you shared);
• in the Android app, that an ad was shown and what kind, and that a purchase happened, by the item’s name only, never a receipt or payment detail;
• what you unlocked, and your difficulty, assist and notification settings.

Never sent: your name, email, IP address (stored), location, key presses, anything typed, or anything recorded frame by frame. Reports are kept about 90 days, then deleted by the service. We use them in totals and averages, never to look at one person.

Control: Options, Anonymous play statistics. When off, nothing is recorded and anything not yet sent is thrown away. The game plays the same with it off or with no connection at all.

Android app only. The app asks for the internet permission and no other: not your location, contacts, camera, microphone or files. Ads and purchases are described under Google Play and AdMob.

Fonts: the game loads the Bangers font from Google Fonts, so Google sees your IP address and browser details when it does.

Puck & Glory

On your device: your options and controls, your tournament and campaign progress, achievements, practice medals, and a random install number. Clearing the site’s data deletes it all.

Anonymous play statistics are off until you turn them on. The game asks on first load, and asks again at most once a year if you said no; a yes is never asked twice. Your browser’s Global Privacy Control or Do Not Track setting does not turn them on, and does not override a yes you gave. If you say yes, the game sends, under the random install number:

• for each match or practice: the kind (quick game, cup, shootout, campaign, practice), the rules, the team ids, level, number of players, controls scheme, kind of device and language, and the options you changed from their defaults;
• how it ended: finished, quit or abandoned, periods, score, shots, penalties, fights, face-offs, the moves you used and whether they worked, and time played;
• for practice drills: the drill, points, medal, repeats and whether you left early;
• for each visit: active time, which kinds of input you used (keyboard, gamepad, touch or mouse) and how often, screen class, browser and operating system family (never the full browser string), whether the game is installed, language, the hour on your clock, load time, the share of slow frames, and how far into the menus you got;
• errors: the first 160 characters of an error message, the script and line where it happened, and the save version.

Never sent: your name, email, IP address (stored), or anything you type. The country comes from Cloudflare as a two-letter code. Raw statistics are deleted after 180 days. Match summaries are then kept without the install number. Daily totals are kept.

Control: Options, Data, Share play statistics.

Feedback (optional). The Feedback screen, and the culture and rights page on the game’s website, send us your message and its category (bug, suggestion, inclusiveness, legal or other), and may include the game version and a description of your device (browser string, screen size and number of gamepads). Your message and those details become a public GitHub issue in our repository, so please do not put personal information in it. An email address, if you give one, is not put in the issue; it goes privately to Yvan’s email, with a copy of the report, and is used only to reply. When you open Feedback, the game loads Cloudflare Turnstile from challenges.cloudflare.com to check you are not a bot. Turnstile looks at your IP address, browser and similar signals. Cloudflare is also a controller of those signals and uses them to improve its bot detection (see its Turnstile privacy addendum).

Fonts: the game loads Fredoka, Lilita One and Baloo 2 from Google Fonts, so Google sees your IP address and browser details when it does.

Vector Trackz

Vector Trackz sends us nothing. It has no statistics, no accounts and no feedback form. The tracks you build, your records and saved replays, your options, controls, initials and car settings are kept in your browser’s own storage (localStorage and IndexedDB). Clearing the site’s data deletes them.

Sharing a track or replay makes a link, a code or a file, which you pass on yourself. There is no server in between: the code travels in the link or file, not through us. A shared track carries the title, author name (up to 16 characters) and note you typed, and the dates and times it was made. Once you give it to someone, or post it somewhere such as Discord, that place’s rules apply and we cannot take it back.

Fonts: the game loads Orbitron from Google Fonts, so Google sees your IP address and browser details when it does.

Upcoming roguelike

This game is not released. As built today it keeps saves and settings on your device, and sends nothing until you act. Play statistics are off until you turn them on, are kept under a random statistics id, and can be downloaded or deleted from Options. Raw statistics are deleted after 180 days. If you send feedback it becomes a public GitHub issue, with a private copy by email if you gave an address, and a Cloudflare Turnstile bot check as in Puck & Glory. We will list its exact statistics here, and update this page, before it is released.

This website

nimblemyth.ca sets no cookies and has no analytics or advertising scripts. Its pages, fonts and images come from nimblemyth.ca, and its gameplay clips come from media.nimblemyth.ca, our own address on Cloudflare. If you choose Daylight or Dusk, that choice is saved in your browser only.

Links to Discord, GitHub, Google Play and other sites lead away from ours; their own policies apply once you follow them. Our Discord server is run on Discord. We can see what you post there, and Discord collects its own data about you. We do not connect it to anything from the games.

Cloudflare

Cloudflare, Inc. hosts our website and the game sites, and runs the server code, databases and email forwarding behind them. When you load a page or play a game online, Cloudflare receives your IP address and request details (the page asked for, browser and device type, the time) in order to deliver and protect the service, and may set strictly necessary security cookies (such as __cf_bm) if it needs to check traffic. Its dashboard also shows us aggregate traffic counts and security events.

For the games, Cloudflare also stores what you send us: play statistics (Analytics Engine for Downdraft, a D1 database for Puck & Glory and the roguelike), and feedback emails (Email Routing). Our server code uses your IP address only to limit how many requests one connection can make, and does not store it with your statistics. Cloudflare’s logs for that server code can include request details, and are kept for a short time. Only Yvan can read the statistics: the Puck & Glory and roguelike dashboards sit behind Cloudflare Access, and Downdraft’s are read with a restricted Cloudflare key.

Cloudflare acts as our service provider under its Data Processing Addendum. It is a separate controller for its own bot-detection signals (Turnstile).

Google Play and AdMob (Downdraft for Android)

Google Play. You get the app through Google Play, which collects its own data about you under Google’s privacy policy. We never see your Google account details or payment information. What Google gives us as the developer: totals of installs, uninstalls and updates, by country, device model and Android version; ratings and reviews, which are public and show the name on your Google account; crash and not-responding reports, if you have chosen to share diagnostics with Google; and records of purchases (such as order number, item, price and country), which we use for support and accounting only.

The purchase. “Remove ads” is a one-time purchase handled entirely by Google Play. The app learns only whether Google says you own it, so the ads stay off, also after a reinstall. Someone who has bought it is not shown ads or asked for ad consent.

Ads. The free app shows a short full-screen ad (an interstitial) between missions, and an optional rewarded video ad that you can watch to get one continue after losing your last chopper. Both are served by Google AdMob. To show and measure ads, Google and its ad partners may collect your device’s advertising ID, IP address (from which they estimate a general location), device and app information, and how you interact with ads. We do not receive this and do not combine it with anything else. The app asks for ads suitable for teens at most.

• Consent: where the law requires it (Europe, the UK and similar places), the app asks for your consent with Google’s form before it requests any ad. If you refuse, no ads are shown. You can change your choice at any time in Options, Privacy options.
• Your device: you can reset or delete your advertising ID, and turn off ad personalisation, in your Android settings. Google’s AdMob data disclosure lists what its SDK collects.

Google acts for itself, not for us, in how it uses this data. What we declare about it in the Google Play Data safety section matches this page.

Why we use information, and your consent

We use what is described above to run the games and website, keep them secure, answer feedback, understand how the games are played so we can fix and balance them, and (in the Android app) show ads and take payment through Google. We use it for nothing else without asking you first.

Under PIPA we rely on your consent. Where a game says statistics are off to start, we ask first and only collect if you say yes. Where Downdraft’s statistics are on to start, we rely on this notice, the anonymous nature of the information, and the off switch; the information is not sensitive and the purpose is plain. You can withdraw consent at any time, and we will tell you what that means for the game (nothing, for statistics). Withdrawing does not undo what was done before.

Where your information goes

Cloudflare, Google, GitHub and Discord are US companies, and Cloudflare runs a global network. Your information may be handled in the United States and other countries, where courts, law enforcement and national security authorities may be able to access it under local law. Under BC’s PIPA private-sector rules this does not need your separate consent, but you are entitled to know it. We choose services with data protection terms, send everything over HTTPS and collect as little as we can.

We share your information with: Cloudflare (hosting, statistics, bot check, email forwarding); GitHub (public feedback issues you choose to send); Google (Gmail for private feedback emails; Fonts; Google Play and AdMob for Android); and Discord if you join. We do not sell it, and we do not share it for advertising. We do not profile you or make automated decisions about you.

How long we keep it

Cleanup jobs run once a day, so data can outlast these limits by up to a day.

Your choices and rights

Under PIPA you can ask us to tell you what personal information we hold about you, how we use it and who we have given it to; to correct it; and to withdraw consent. Write to support@nimblemyth.ca. We reply within 30 days, free of charge. If we cannot give you something, we say why.

• Statistics are anonymous and kept under a random number, so we cannot tell which records are yours unless you give us that number. In Puck & Glory and the roguelike it is saved in your browser’s storage; Downdraft does not show you its number. Where you can give us the number, we will send you a copy of the records or delete them. Otherwise the records are deleted automatically when their time is up, and turning statistics off stops any more.
• Feedback: we remove a feedback issue or delete your feedback email on request. Write from the address you gave, or tell us which issue it is.
• On your device: clearing the site’s data in your browser, or uninstalling the app, removes your saves, settings and install number.
• Google, Cloudflare, GitHub and Discord hold their own data about you. Use their controls, or ask them.

Children

Our games are not designed for children under 13 and are not directed at them. Downdraft is published for ages 13 and over. We do not knowingly collect personal information from children. The play statistics hold none from anyone, and a child should ask a parent or guardian before sending feedback or turning on statistics. If you think we hold information from a child, write to us and we will delete it.

Security and breaches

Everything travels over HTTPS. Only Yvan has access to the statistics, databases and feedback email, through Cloudflare Access or restricted keys. Our server keys have only the permissions they need and are kept in Cloudflare’s secret store, never in our code. We collect as little as we can: no names, no accounts and no stored IP addresses.

PIPA does not oblige private organisations to report a breach, but we will. If a breach of our security creates a real risk of significant harm to you, we will tell you as soon as we can (by email if we have your address, otherwise by a notice on this page) and tell the Office of the Information and Privacy Commissioner for BC. We keep a record of every incident, whatever its size.

Complaints

Please write to us first at support@nimblemyth.ca. We will acknowledge you within 7 days, answer within 30, and tell you what we did. If you are not satisfied, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, or the Office of the Privacy Commissioner of Canada. Elsewhere, your local privacy regulator can help.

Changes to this policy

When we change what a game or the website collects, we change this page first and the date at the top. We note material changes in the game’s changelog too. We review this policy at least once a year.

• 19 October 2026: first full version.