Privacy Notice — Lootar.io

Lootar.io has no accounts and no analytics. To play, the game needs your IP address and the nickname you type.

What Is Collected

IP address: needed to deliver the game and to limit how many requests one address can send.
Nickname: shown to the other players in your room.
Game state: your ship's position and actions while the room runs.
Browser storage: your settings, a random number for this browser, and a short-lived key that returns you to your game after a reload. Only the random number and the key are sent to us, so a reload counts as the same player.
One technical cookie: lootar_seat, 5 minutes, used to reconnect you after an update.

Details are on the Cookies page.

The Android App

The Lootar.io app for Android plays in the same rooms as the website, so the server receives the same IP address, nickname and game state described above. The app itself has no advertising, no analytics and no cookies, and it asks for no permissions beyond internet access. It keeps your settings, your nickname, a random number for this install and a short-lived key that returns you to your game in its own storage on your device; only the nickname, the random number and the key are sent to us, exactly as the website sends them. Uninstalling the app removes all of it.

Logs

The server writes one short line per game event (a join, a refusal, a ship taken or lost), which may include your nickname. A connection that is turned away is logged with the address it came from; ordinary visits are logged without one. Logs are used only for security and troubleshooting.

Advertising

Advertising comes from Google AdSense. In the EEA, the UK and Switzerland, Google shows its own consent message before any advertising cookie is used; you can accept, manage the options, or decline, and the game plays either way. Third-party vendors, including Google, may use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising in Google Ad Settings, and change your choice at any time with the Privacy settings link. The game is not directed at children, and we do not knowingly collect children's data.

Who Receives Data

Our hosting provider, which runs the game's server in Istanbul, Türkiye. Email you send us passes through our email providers, whose servers are outside Türkiye. Google receives data only if you allow advertising. We do not sell data.

Retention

Game state: only while the room runs. Logs: up to 30 days. Emails: up to two years after we answer. Browser storage: until you clear this site's data.

Legal Basis

Running the game and keeping it safe rest on legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f), and so does answering your email. Advertising rests on your consent.

Your Rights

You may ask what we hold about you, have it corrected or erased, object to its use, receive a copy, and complain to your data protection authority (in Türkiye, the KVKK). Write to contact@lootar.io; we answer free of charge within 30 days.

Operator

Ahmed Husrev Dereli (kaithedevlab), an individual developer in Türkiye · contact@lootar.io. Turkish notice: KVKK Aydınlatma Metni.

Last updated: 2026-10-24