Kill OrbitPrivacy
What killorbit.com and the Kill Orbit game keep about you, and why. Kill Orbit is made by DataGuys. Privacy questions: [email protected].
Last updated 24 September 2026
The short version
- You sign in through Privy, our identity provider. Privy holds your email address; we never show it on the site.
- We keep your account id, your callsign and profile settings, your verified wallet addresses, your match results and your campaign save when you enable cloud sync in a linked game.
- Your public profile shows your callsign, stats and campaign progress, and a “wallet verified” badge. It never shows a wallet address or your email. You can make it private.
- No advertising, no third-party analytics, and we do not sell your data.
What we store
| What | Details | Why |
|---|---|---|
| Account | Your Privy account id (a random identifier), callsign, bio, public or private setting, when you joined, when you last signed in or played, how many times you have signed in, and account status. | To run your account, profile and leaderboard entry. |
| Wallets | The wallet addresses Privy has verified as yours (Solana, or Ethereum for older sign-ins), whether each is a wallet created for you or your own, which one is primary, and when it was verified. | To link wallets to your profile. Shown only to you; the public sees a “wallet verified” badge. |
| Website session | A cookie, ko_web, and a matching session record with a keyed hash of your IP address (not the address itself). It lasts 7 days, or until you sign out. |
To keep you signed in and to protect forms against forgery. |
| Game link | When you link the game: the eight-character code, with your account id and the callsign and wallet handed to the game. The code expires after 30 minutes and old codes are then deleted. We also keep, per account, when you last linked a game and when it last checked in, so your account page can show the link. The game keeps its sign-in token on your PC; it lasts 30 days. | So the game can sign in as your account. |
| Match results | For every finished online match: your account id and callsign, team, eliminations, deaths, assists, damage, streaks, score, time played, the result and any rating change. The servers send these; they are public on the leaderboard and your profile unless your profile is private. | Leaderboards, ratings and your career record. |
| Campaign save | Once the cloud-save game update ships: the save file your linked game uploads, the list of missions you have completed, your chapter, when it was uploaded and the game build. Completed missions show on your profile unless it is private. | Cloud save, and progress on your profile. It is reported by your game and is never used to pay rewards. |
| Downloads | When you press Download: your account id and the time, and a cookie, ko_dl, sent only to the download folder and valid for 7 days. |
To serve the beta to signed-in players and let an interrupted download resume. |
| Security logs | Hashes of IP addresses for rate limits, kept for minutes to hours. Our web host and Cloudflare also keep standard server logs: IP address, browser, the pages requested and when. | To stop abuse and fix problems. |
| Old “Notify me” list | If you joined it before the beta: your email address, with the IP address and browser string from that moment. The list is closed to new sign-ups. | Only to send the one release notice it promised. Never shared. To be removed, email [email protected] from the address you signed up with. |
Signing in and wallets
Sign-in is handled by Privy. If you sign in by email, Privy sends the one-time code and holds your email address; it also creates a Solana wallet for you. If you sign in with your own wallet, you sign a message to prove it is yours. Signing that message costs nothing and gives no one access to your funds. Privy tells our server which account and wallets are yours; we check that answer on our server and never trust an address sent from a browser.
The sign-in and account pages load Privy’s code from the jsDelivr CDN, and Privy keeps its own sign-in state in your browser’s local storage. Signing out on this site ends that state too.
What the game sends
The game contacts killorbit.com to link your account, to check that sign-in, to fetch the server list and to sync your campaign save when cloud sync is enabled in a linked game. The dedicated servers report the results of online matches. The campaign itself runs on your PC.
Who else handles it
- Privy: sign-in, email codes and wallets.
- Cloudflare: every request to killorbit.com passes through it for delivery and protection.
- jsDelivr: serves Privy’s code on the sign-in pages.
We do not sell or rent your data, and we do not use advertising or third-party analytics.
Cookies
Only two, both first-party: ko_web keeps you signed in (7 days) and ko_dl lets you download the beta (7 days, sent only to the download folder). Both are HttpOnly and Secure. There are no tracking cookies.
Your choices
- Make your profile private on Account & wallet. It disappears from the leaderboard and from public view.
- Change your callsign or bio, or unlink a wallet, on the same page.
- Sign out from the account menu. “Sign out everywhere” on your account page ends every website session and cancels your download links, and can also sign the game out on every PC.
- To have your account data removed, or for a copy of it, email [email protected] from the address you signed in with.
Your rights
You can ask us for a copy of the data we hold about you, to correct it, or to delete it. Email [email protected] from the address you signed in with, so we can tell the request is yours. You can also complain to the data-protection authority where you live.
The beta
Kill Orbit is live as a public beta, building in public. When what we store changes, this page changes with it, and the date at the top moves. The rules for the beta itself are in the beta terms.