Legal

Privacy Policy

Last updated 23 August 2026

Mass Expansion is a 3D multiplayer strategy game that runs in a web browser at play.massx.io and as a desktop application. This policy covers both. It describes what we collect, why we collect it, who else touches it, and how to have it deleted.

The short version: we collect an email address so that you can sign in and get your commanders back on another machine, we keep your game saves so the universe persists, and we count anonymous product events so we can tell whether anyone is playing. We do not sell data, we do not run advertising, and we do not track you across other sites.

Signing in with Google

Signing in with Google is optional — an email address and password does the same job. If you choose it, we use Google Identity Services, which hands us a signed token about your Google account. We request only the standard openid, email and profile scopes. We ask for no additional Google permissions: we have no access to your Gmail, Drive, Contacts, Calendar, or anything else in your Google account, and we cannot post anything anywhere on your behalf.

From that token we store exactly three things:

• Your email address — it is your account identifier, it is how we send you a password reset, and it is how a Google sign-in and an email sign-in for the same address are recognised as the same person rather than two.
• Google's account identifier for you (the sub claim) — an opaque string. It is what the link is really keyed on, because an email address can change and this cannot.
• Whether Google says the address is verified — we require this. An unverified Google address is refused rather than linked, because otherwise anyone who could assert your address could reach your saved game.

We do not store your name or your profile picture, even though the token contains them, and we never receive your Google password. Google user data is used only to authenticate you to this game. It is not sold, not shared with anyone for their own purposes, not used for advertising or profiling, and not used to train machine learning models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Mass Expansion from your Google account at any time at myaccount.google.com/connections. That stops the sign-in method; it does not delete your game account, which is the separate request described under Deleting your data.

What we collect

Account information. Your email address, and — if you registered with a password rather than Google — a one-way hash of that password. We never store the password itself and cannot recover it; a reset replaces it. Alongside this we keep the commanders you create: their callsigns, which worlds are theirs, and the account identifiers that tie them together.

Game state. Planet saves, fleets, ships and modules, research, clan membership and similar progress. This is the point of having an account: it is what makes a world you built still be there tomorrow, and on a different computer.

Product analytics. Anonymous counts of things like "the title screen was reached", "a commander was created", "a base was established" and total playtime, tied to a random identifier stored in your browser rather than to your identity. We use these to answer whether the game is playable and whether people get past the first ten minutes. Site visit counts come from Cloudflare Web Analytics, which is cookieless and does not fingerprint or track visitors between sites.

Steam, on the desktop build. If you play through Steam, Valve tells us your Steam ID and public persona name so that hosting and friend invites work.

What we do not collect. No advertising or cross-site tracking identifiers. No payment details — there is nothing to buy. No IP addresses in our own database. No voice or chat recordings. No contact lists.

Playing without an account

The browser build can run the entire game inside your own tab with no server at all, and the sign-in screen offers that as "Play offline". Choose it and nothing about your session reaches us — the world lives in your browser's own storage. The trade is the one stated on that screen: progress made offline is not saved to the online universe and can be lost.

Where it lives and how it is protected

Account data and game saves are held in a database on Amazon Web Services in the US West (Oregon) region. Everything travels over HTTPS. Passwords are stored as scrypt hashes with a per-password salt. Verification and password-reset links are stored only as hashes, expire (24 hours for a verification link, 1 hour for a reset), and are single-use — a link that has been used cannot be used again.

Your browser also keeps things locally that never leave your machine unless you are signed in: a device credential, your carried loadout, and — in offline play — the planet itself.

Who else is involved

• Amazon Web Services — hosting and database.
• Amazon SES — sending verification and password-reset email. Your address is disclosed to it for that purpose only.
• Cloudflare — serves the site and the game client, and provides the cookieless visit analytics described above.
• Google — only if you choose Google sign-in.
• Valve / Steam — only for the desktop build.

Each of these is a service provider processing data on our behalf. We do not sell personal information, and we do not share it for anyone else's independent purposes. We may disclose information if the law requires it.

How long we keep it

Account and progress data is kept while your account exists, because deleting it is the same act as deleting your game. Expired sign-in and reset tokens are removed. Analytics events are kept in aggregate. If you ask us to delete your account, we delete it.

Deleting your data

Email derekbrenner@gmail.com from the address on the account and ask for it to be deleted. That removes the account, its commanders, their saved worlds and fleets, and the Google or Steam link. You can also delete a single commander from inside the game without touching the rest. There is no charge and no waiting period beyond the time it takes to answer you.

Depending on where you live you may also have the right to ask what we hold about you, to correct it, or to object to our processing it. The same address is how to do that.

Children

Mass Expansion is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, write to the address above and it will be removed.

Changes

If this policy changes, the date at the top changes with it. A change that materially affects what we do with an existing account will be sent to the address on that account.

Contact

Mass Expansion — derekbrenner@gmail.com