OrbVora
← All Info topics

Privacy

Last updated 6 October 2026.

OrbVora is a free browser game. This page says what it stores about you, why, who else can see it, how long it is kept and how to remove it. You can play without an account, and OrbVora has no adverts and no tracking.

Who runs OrbVora

OrbVora is run by Luciano Nery, who decides what is stored and why. Write to [email protected] with any question or request about your data.

What is stored

If you play as a guest

  • A random session identifier, so the game knows which fights and open games are yours. The server keeps only a hash of it.
  • A random public name such as Anon-Comet-4821, and the last time you were connected.
  • The fighters, matches and match chat messages you play with that session.
  • Your saved fighter and settings stay in your browser (see “Cookies and browser storage”).

If you sign in

  • Your sign-in method: the email address you used for the email code, and/or the Google account ID and verified email that Google gives us. We do not store your Google name, photo or anything else from your Google profile.
  • Your public name (a random Orb-… name until you choose one), the date you joined and the last time you were connected.
  • Your game record: saved fighter, rating and rating history, level and experience, achievements, rewards and codes you redeemed, coins, and the items you own and wear.
  • Your friends list, the direct messages you send and receive, and your global chat messages.
  • A profile picture, only if you upload one. It is cropped, shrunk to 256 pixels and stripped of metadata.
  • Everything you did as a guest on the device you signed in on joins your account, so earlier fights still count.

Kept briefly, for security

  • Sign-in codes and links work once and expire after 10 minutes. We keep only a hash of them, and remove them soon after they expire.
  • To stop abuse, the server counts recent requests per email address, session and IP address. Those counts are stored as hashes, not as readable addresses, and removed after 24 hours.
  • The web server that receives requests keeps a log of the time, the page requested, the response and your browser name, for up to 14 days. Requests reach us through Cloudflare, so the address in that log is Cloudflare’s, not yours. The game’s own logs hold no personal data.

Why, and on what basis

  • To run the game you asked to play: sessions, accounts, matches, ratings, chat and friends.
  • To keep the service safe and fair: rate limits, logs, reports of pictures and blocking abuse. This is our legitimate interest.
  • With your agreement: signing in with Google, uploading a picture, and writing in chat are things you choose to do.

We do not sell data, do not show adverts, do not profile you and do not use your data for anything else.

What other people can see

  • Anyone can open a player’s profile: public name, join date, rating and rating history (the last 100 changes), records, achievements, picture and recent matches with the names of their opponents.
  • Anyone can also open the profile of an anonymous player, found under their random Anon-… name: records, totals and recent matches. Every profile shows whether the person is online or playing now, and otherwise when they were last connected.
  • Players can read global chat. Only the people in a match can read its chat.
  • A direct message is visible to you and the person you sent it to.
  • Your email address and sign-in method are visible only to you. Other players never see them.
  • A picture that five different people report is hidden everywhere.

Cookies and browser storage

  • One cookie, orbvora_session, keeps you signed in or recognised as a guest. It is needed for the game to work, is sent only over HTTPS, is hidden from page scripts, and stops working after 30 days without a visit.
  • Your browser’s local storage holds your fighter on this device, your sound settings and small interface choices. It never leaves your browser and you can clear it in the browser’s settings.
  • There are no advertising, analytics or social-media trackers, and the fonts are served from the same site.
  • Cloudflare, which delivers the site, may set its own technical cookies to protect it from attacks.

Who else handles your data

  • Cloudflare delivers the website and the game’s address, sees the requests that pass through it (including IP addresses) and sends the sign-in emails, so it sees the address it sends to. It works worldwide, so some processing can happen outside the European Union.
  • Google receives your sign-in request if you choose Google. It then tells us your account ID and verified email.
  • The game’s database and files are on a server rented from a hosting provider in the European Union. Nobody else has access to them.

How long it is kept

  • Your account data, until you delete your account.
  • Global chat: only the newest 1,000 messages are kept; older ones are deleted.
  • A guest session stops working after 30 days of not being used.
  • Matches and their chat stay in the game’s history. After an account is deleted they show “Deleted player”.
  • A copy of the database is backed up every day, encrypted, and kept for 21 days. Data you delete leaves the backups within 21 days.

Deleting your account

You can delete your account on the account page. This removes your sign-in methods and email, saved fighter, picture link, rating and history, achievements, rewards, coins and items, experience, friends, direct messages (including the ones you sent), global chat messages and active sessions, and closes your open lobby games. Fights you played stay in the other players’ history, but your seat is replaced by a random marker that cannot be traced back to you.

Your rights

You can ask to see the data held about you, to have it corrected, deleted, handed to you in a common format, or to object to how it is used. You can change your public name and picture yourself, and delete your account yourself. For anything else, email [email protected]; we answer within 30 days. If you are in the European Union you can also complain to your national data protection authority.

Children

OrbVora is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has an account, write to us and we will delete it.

Changes

If this notice changes in a way that matters, the date at the top changes and the change is listed in the changelog.