Privacy Policy
Last updated: 16 July 2026
This Privacy Policy explains how MALIK ("MALIK", "we", "us", or "our"), the online multiplayer maze shooter available at maliks.net and app.maliks.net (the "Game"), collects, uses, shares, and protects your personal data when you play or create an account.
We are the data controller for the personal data described here. This policy works alongside our Terms of Service. If you have any questions, or wish to exercise your privacy rights, contact us at contact@maliks.net.
1. Data we collect
We only collect what we need to run the Game, keep your account secure, and process payments. We collect:
Account & profile data
| Data | Details |
|---|---|
| Email address | Used to create your account, verify it, sign you in, and contact you about your subscription. Stored in lowercase. |
| Password | Never stored in plain text. We store only a salted PBKDF2-SHA256 hash. We cannot read your password. |
| Display name & player tag | The name and short tag shown to other players and on leaderboards. |
| Profile customization | Your flag colours and optional slogan. |
| Account identifiers | An internal player ID, sign-in method (email or Google), and — if you use Google — your Google account ID and the name/email Google shares with us. |
| Account status flags | Whether your email is verified, whether you completed the solo labyrinth, admin status, and premium status. |
Payment data
Payments for MALIK Premium are handled entirely by Stripe. We never see or store your full card number, CVC, or bank details. From Stripe we store only your Stripe customer ID, subscription ID, premium status, and the date your premium started — so we can grant your benefits and let you manage your subscription.
Gameplay data
- Your saved solo progress (maze state, score, upgrades, position).
- Match results used for leaderboards: score, flag hold time, PvP kills, rounds played, and win records.
- Rooms you create (room name, settings) and your ownership of them.
Technical data
- Your IP address and basic connection/browser information, processed by our hosting provider and content delivery network as part of serving and securing the Game.
- A small item stored in your browser's local storage (your email address, so we can restore your premium status when you return). See section 4.
- Temporary email-verification tokens, which are automatically deleted after 24 hours.
2. How we use your data
- Run the Game — create and manage your account, save progress, run multiplayer arenas, and display leaderboards.
- Authentication & security — sign you in, verify your email, and protect against cheating, fraud, and abuse.
- Transactional email — send you account verification and essential service messages (via Resend).
- Payments & premium — process your subscription and grant premium benefits (via Stripe).
- Advertising — the Game is free to play and may show ads in the future. Ads are not currently active. If and when we introduce advertising that uses personal data, we will ask for your consent through a cookie banner first.
We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects about you.
3. Legal bases (GDPR)
If you are in the European Union, we rely on the following legal bases under the GDPR:
- Performance of a contract — to provide the Game, manage your account, and process your subscription (the Terms of Service you accept when you play).
- Legitimate interests — to keep the Game secure, prevent cheating and abuse, and maintain fair leaderboards.
- Consent — for optional advertising cookies/tracking, if introduced. You may withdraw consent at any time.
- Legal obligation — where we must retain certain records (e.g. for tax on payments).
4. Cookies & local storage
MALIK uses very few cookies and does not currently run advertising or analytics trackers.
- Local storage (essential) — we store your email address in your browser to restore your premium status when you come back. It stays on your device and you can clear it any time through your browser settings.
- Sign in with Google — if you use Google login, Google's Identity Services may set cookies to run the sign-in flow. This is governed by Google's Privacy Policy.
- Stripe — during checkout, Stripe may set cookies for payment security and fraud prevention, governed by Stripe's Privacy Policy.
- Advertising cookies — not used today. Before any advertising cookies are set, we will show a consent banner and only proceed with your agreement.
5. Who we share data with
We share personal data only with service providers ("processors") that help us run the Game, and only as needed:
| Provider | Purpose |
|---|---|
| MongoDB / hosting | Stores your account, profile, and gameplay data. |
| Stripe | Processes subscription payments securely. |
| Provides "Sign in with Google" (only if you choose it). | |
| Resend | Delivers account verification and service emails. |
| Cloudflare / CDN | Serves the Game and protects against attacks. |
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and property of MALIK, our players, or the public. We do not sell your personal data to anyone.
6. International transfers
Some of our providers (such as Stripe, Google, and Resend) may process data on servers outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.
7. How long we keep data
- Account data — kept for as long as your account exists. When you ask us to delete your account, we remove your profile and the rooms you own.
- Unverified accounts — automatically deleted if the email address is not verified within 7 days.
- Email-verification tokens — automatically deleted after 24 hours.
- Inactive rooms — deleted after 30 days of inactivity.
- Leaderboard & match records — retained to keep rankings and game history fair and consistent; they are tied to your player ID and display name.
- Payment records — retained by Stripe and by us for as long as required by law (e.g. accounting and tax obligations).
8. Your privacy rights
If you are in the EU/EEA, the GDPR gives you the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data (you can also edit much of your profile in-game).
- Erasure — ask us to delete your account and personal data ("right to be forgotten").
- Restriction & objection — limit or object to certain processing.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — where we rely on consent (e.g. advertising cookies).
To exercise any of these rights, email contact@maliks.net. We will respond within the time limits set by law. You also have the right to lodge a complaint with your local data protection authority — in Croatia this is the Croatian Personal Data Protection Agency (AZOP), azop.hr.
9. How we protect data
- Passwords are stored only as salted PBKDF2-SHA256 hashes — never in plain text.
- Traffic between your browser and our servers is encrypted with TLS (HTTPS/WSS).
- Payment card data is handled entirely by Stripe and never reaches our servers.
- Access to player data is limited to what is needed to operate and moderate the Game.
No online service can be completely secure, but we take reasonable measures to protect your data.
10. Children
MALIK is not directed at young children. In line with GDPR and Croatian law, if you are under 16, you may only use the Game and provide personal data with the consent of a parent or guardian. If you believe a child has given us personal data without such consent, contact us at contact@maliks.net and we will delete it.
11. Third-party links
The Game links to external services such as Discord, X (Twitter), YouTube, and itch.io. We are not responsible for their content or privacy practices. Please review their own privacy policies before using them.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the Game. Your continued use of MALIK after an update means you accept the revised policy.
13. Contact us
For any privacy question or request, or to exercise your rights, contact us at:
contact@maliks.net