Privacy Policy

Last updated: February 2026

Push Pull Survival is operated by Colgan Farmstead, LLC ("we", "us"). We are committed to protecting your privacy. This policy explains what data we collect, why, and how you can control it.

1. Data We Collect

Data Type	Purpose	Retention
Email address	Account verification, password reset, service updates	Until account deletion
Username / display name	Game identity, leaderboards	Until account deletion (anonymized on delete)
Password (hashed)	Account authentication	Until account deletion
Game statistics	Leaderboards, achievements, matchmaking	Until account deletion (anonymized on delete)
IP address / user agent	Security, fraud prevention, rate limiting	30 days in server logs
OAuth profile (name, picture)	Account creation via Google/Facebook/Microsoft	Until account deletion
Payment data	Processed entirely by Stripe — we store only subscription status and Stripe customer ID	Until account deletion

2. How We Use Your Data

To authenticate your account and maintain your session
To display your username on leaderboards and in multiplayer
To send transactional emails (verification, password reset) — no marketing without opt-in
To process payments via Stripe (we never see or store your full card number)
To improve the game through aggregated, anonymous analytics

3. Data Sharing

We do not sell your personal data. We share data only with:

Stripe — payment processing (Stripe Privacy Policy)
Google/Facebook/Microsoft — only if you use OAuth login (Google, Meta, Microsoft)
DigitalOcean — hosting and infrastructure (DigitalOcean Privacy)
Legal authorities where required by law

4. Cookies and Local Storage

We use browser localStorage to store your authentication token and game preferences. We do not use third-party tracking cookies. If you clear your browser storage, you will be logged out.

5. Children's Privacy (COPPA)

Push Pull Survival is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us at [email protected] and we will delete the account promptly.

6. GDPR Rights (EU/UK Residents)

If you are located in the EU or UK, you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — delete your account and data (available in Settings → Delete Account)
Portability — receive your data in a machine-readable format
Object — opt out of certain processing

To exercise these rights: [email protected]

7. CCPA Rights (California Residents)

California residents may request to know what personal information we collect, request deletion, and opt out of sale (we do not sell personal data). Contact: [email protected]

8. Data Security

We use industry-standard security measures: bcrypt password hashing, JWT authentication with short expiry, HTTPS in production, rate limiting on all endpoints, and MongoDB access controls. No method of transmission over the internet is 100% secure — we cannot guarantee absolute security.

9. Account Deletion

You can delete your account at any time from Settings → Danger Zone → Delete Account. Upon deletion, your personal data (username, email, password) is anonymized and your display name is replaced with "[Deleted]". Game history is preserved in anonymized form to maintain leaderboard integrity.

10. Changes to This Policy

We may update this policy periodically. The "Last updated" date at the top reflects when changes were last made. We will notify you of material changes via in-game message or email if you have a verified address.

11. Contact

Privacy questions: [email protected]