Privacy Policy
Last updated: November 2, 2026
Mad Orbs (madorbs.com) is a free game that runs in the browser. This page explains what data is handled when you play, what for, and how to exercise your rights, under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018). This is a translation of the Portuguese original; if the two differ, the Portuguese version prevails.
Who is responsible
The data controller is Érick Matheus de Oliveira. For anything about privacy, write to contatomadorbs@gmail.com.
Accounts are optional
You can play without an account, without giving an email address, phone number or password. If you want to keep your name and your stats, you can sign in with your Google account (Sign in with Google).
What data is handled
- In-game name and Orb look. You choose the name and the Orb. They are sent to the server when you join an online match and are shown to the other players (scoreboard, names over the Orbs, chat). Don't use your real name if you don't want it to show. Without an account, the server gives you a temporary player ID for the visit (like #ANON-7Q2M), shown on the scoreboard and not kept.
- Account (only if you sign in with Google). Google tells us your account's identifier, email address, name and profile picture; we keep them with a player ID made for your account (like #K7Q2MX, it never changes), the name you choose in the game, your Orb and your online stats for each game mode (kills, deaths, wins, matches, the most kills in one match and, in Capture the Flag, captures), your progress in the old Campaign mode if you played it and the highest wave you reached in the Waves mode and how long you took to reach it, with the Cores you earned, the upgrades you bought in the Workshop and, for each checkpoint, the crate upgrades and cards a run had when its wave began; and, in the Vesuvius, the Obsidian you earned, the upgrades you bought in the Forge, the highest level you won and your best time on it, your wins and your runs. The game's Ranking is public: it shows any visitor the name you chose, your player ID, your Orb's colours and those numbers. The game server reads your session when you join a match, to show your player ID on the scoreboard, and adds your results to the stats. Your email address and Google name are not shown to other players. You can delete your account at any time in the game's Account window: the account and its profile are erased right away. In Google's sign-in window, Google may use its own cookies.
- Chat messages and in-match actions. They go through the server to reach the other players during the match. For moderation, the server keeps the latest messages (with the writer's name and player ID) in memory only, never on disk: they are gone when the server restarts, which happens at least with every game update.
- Settings. Name, Orb, volumes, language, training preferences and your progress in the Waves (record, Cores and upgrades; and in the old Campaign mode, if you played it) are stored in your own browser (local storage), not on the server, and so are the last settings of a private room, the key that makes you the host of the rooms you created and how many matches you started in this browser (from the second one, with an ad blocker on, the game asks once a visit to turn it off). Signed in, the browser also notes which account that progress belongs to (its ID), so it doesn't get mixed with another account signing in after; signing out erases the progress from the browser, and the account keeps it. To erase them, clear the site's data in your browser.
- Private rooms. While a private room is open, the server keeps in its memory only its code, its settings, the account that created it (to limit how many rooms one account opens and to let it run the room from any device) and the accounts its host removed; all of it is gone when the room closes. Private matches don't count for the statistics, the Ranking or the match history.
- Waves runs. When a run of the Waves mode starts and ends, the game sends the server a summary of it (the wave it started on and the one it reached, kills, length, starting weapon, cards picked, the Workshop levels, how it ended, the language and how smoothly the game ran), and a short note as each wave starts, so we can see how the mode is played and balance it, and so the server can check the run before it counts for the ranking (a run played faster than the game allows doesn't count; the reason is kept with the summary). Signed in, the summary is tied to your account. Without an account, it goes with a random identifier of this browser (kept in its local storage, with none of your data), and only when usage statistics are allowed in the cookie notice; refused, the run is counted without identifying anyone. The summaries are kept for up to a year, and deleting the account deletes its own.
- Vesuvius runs. The Vesuvius is played only with an account. When a run starts, when each phase begins and when it ends, the game tells the server, which keeps a summary tied to your account: the level, the weapon, the Forge levels, when each phase began, how it ended, the phase reached, how much of the volcano's life you took, the length, deaths, kills, the Obsidian earned, the language and how smoothly the game ran. It lets us see how the mode is played and balance it, and lets the server check a win before it counts for the ranking (a win faster than the game allows doesn't count; the reason is kept with the summary). The summaries are kept for up to a year, and deleting the account deletes its own.
- Technical logs. The server logs joining and leaving matches (in-game name and time) to run and keep the service secure. As with any website, the connection uses your IP address, which the hosting infrastructure may log for a limited time for security and abuse prevention. We also keep a summary of each online match (mode, map, length, how many played, how many bots there were and the winner's name) and how many players were online every 5 minutes, without identifying anyone.
- Moderation. Whoever breaks the terms of use may be kicked from matches; the IP address of someone kicked may stay blocked for a few hours, in the server's memory only. A blocked account is recorded (the reason and until when) and leaves the Ranking while the block lasts.
This data is used to provide the game you opened and, as a legitimate interest, to keep the service secure and prevent cheating and abuse. It is not sold.
Cookies and similar technologies
The first time you open the site, a banner explains the cookies for usage statistics and for ads. What happens depends on where you are, as told by your browser's time zone:
- In Europe (the European Union, the European Economic Area, the United Kingdom and Switzerland): nothing from Google Analytics or from the ads (Google AdSense) is loaded before you agree.
- Everywhere else, Brazil included: usage statistics and ads are on from the start, on the legitimate interest of keeping the game free, and you can object to them at any time: in the banner itself (Reject or Customize) or later.
You can accept only one of them, refuse both, or change your mind at any time with the Cookies link at the bottom of the pages (refusing deletes Google's cookies from this site, and the ads stop loading).
- Necessary (always on). Kept in your own browser's storage, not in cookies: your settings (name, Orb, volumes, language, training, the tutorials already seen), your sign-in session if you have an account, and your cookie choice. The game needs them to work; they are not used for ads or statistics.
-
Usage statistics (can be refused). Google Analytics tells us how many people
visit and how the site is used: Google records the pages viewed, what is done in the game (the modes and tutorials played, how matches end, the weapons and menus chosen, whether you are signed in, how smoothly the game runs), the device and browser, the approximate region
(from the IP address, which Google doesn't keep) and how long the visit lasts, using cookies (such as
_ga) and identifiers, and shows us only reports. Visits are counted only on madorbs.com. - Ads (can be refused). Google AdSense: Google and its partners use cookies and identifiers to show ads, including based on your visits to this and other websites. You can also turn off personalized ads in Google's My Ad Center, learn more about how Google uses cookies in advertising and opt out of other ad vendors' cookies at aboutads.info.
- Sign in with Google. If you choose to sign in, Google's sign-in window uses Google's own cookies, under Google's privacy policy.
Where the data is
The game's servers are in a data center in the United States. When you play online, the match data described above is transferred there, only to run the game. Accounts are kept by Supabase, in a data center in São Paulo, Brazil.
Who the data is shared with
- with the other players, for your name, Orb and chat, during the match;
- with any visitor, in the Ranking, if you have an account: name, player ID, Orb colours and stats;
- with the hosting providers that keep the site running, and with Supabase, which keeps the accounts;
- with Google, for the usage statistics, the ads and signing in, as described above;
- with authorities, when the law requires it.
Children
Mad Orbs is not directed at children under 13 and doesn't knowingly collect data from children. Parents or guardians who believe a child has sent us data can ask for its deletion at the email address above.
Your rights
Under the LGPD, you can ask for confirmation that we handle your data, access to it, correction, anonymization, blocking or deletion, information about sharing, and withdrawal of consent where it applies (for cookies, at any time with the Cookies link). Write to contatomadorbs@gmail.com. Wherever you live, we answer these requests, and you can also complain to your data protection authority (in Brazil, the ANPD).
Security
The site uses an encrypted connection (HTTPS) and the server checks the actions sent by the game. No system is completely secure, but we take care to keep as little data as possible.
Changes to this policy
This policy may be updated, for example when the game gets a shop. The date at the top shows the latest version; important changes will be announced on the site.