Your data

In short

• Playing as a guest, your progress stays in your browser. There are no ads and no cookies. Visits are counted, without cookies and without keeping your IP address, to see how the site is used (see Counting visits).
• Signing in is optional. If you do, your progress is copied to your account so it follows you to other computers, and your runs are checked by the server so that your scores can count toward the ranks.
• The leaderboard never shows you unless you choose a leaderboard name, and you can take the name off again at any time.
• In a 1v1 against another player, your page sends theirs the name you type and your orders. Unless you choose to hide it, the two browsers connect directly and each learns the other's IP address (see 1v1).
• You can download your progress at any time (Settings, Export) and delete your account and all of its data yourself (account menu, Delete account).

Who runs Microscend

Microscend is run by MABARIS di M.A.B., a sole proprietorship in Italy, which decides what is stored and why (the data controller). Questions, requests and complaints about your data: privacy@microscend.com. If you write, your message is used only to answer you.

Playing as a guest

Your runs, best scores, routine results, hotkeys and settings are kept in your browser's local storage, under the name microscend_profile_v1. A routine you are in the middle of is kept in session storage until the routine ends, and a run you choose to watch again (Watch replay, on its results) until you close the tab. None of this is sent anywhere. Clearing your browser's site data removes it; Settings can back it up to a file and restore it.

The site is hosted by Cloudflare, which receives the requests your browser makes to load the pages, as any web host does, including your IP address. That is needed to deliver the site and keep it secure (a legitimate interest, Article 6(1)(f) GDPR). Fonts and images come from microscend.com itself.

Your rank on a drill is set against how all players score on it, and the leaderboard is public. To show both, the pages ask microscend.com for the players' figures and for the boards (and for a run you choose to watch), and Cloudflare passes those requests on to Supabase, where they are kept (see The leaderboard). Such a request says which figures are wanted and nothing about you or your play, and it goes on with nothing of yours: Supabase receives it from Cloudflare's address, not yours, and without your browser's details, and keeps a record of it for at most seven days. The figures last read are kept in your browser's local storage, under the name microscend_standings_v1, so that your ranks show at once on the next page.

Counting visits

To see how the site is used, Microscend counts visits in two ways for now: with Umami Cloud, a service of Umami Software, Inc. (San Francisco, United States), and with its own statistics, which run on Cloudflare, so that the two can be compared before Umami Cloud is dropped. Neither sets cookies or stores anything in your browser.

What is counted

• Each page you open: its address and title, the address you came from, your browser, operating system, kind of device, screen size and language, and your country and region, which Umami works out from your IP address. The IP address itself is not kept.
• Each drill you start and finish: which drill, and the rank the run reached.
• Each 1v1 you start and finish: which game (army against army, or a full game), whether it is against the computer, at which level, or against a player, and whether it was won, lost or drawn.
• To tell visits apart: Umami makes a code from your browser's details and your IP address, which changes every month. Microscend's own statistics do the same with a secret of their own that is replaced every month: they keep the code, never your IP address or your browser's details, and once a month's secret is deleted nobody, Microscend included, can tell whose a code was (Cloudflare's database backups keep a deleted secret for up to 30 more days). Pages opened less than 30 minutes apart count as one visit.

Microscend's own statistics keep, of each page you open: its address, the site you came from (and that site's page, when your browser says it), any campaign tags in the link (utm_source and the like) and, for a link from an ad, which ad network it came from (not the ad click's own code); your country, region and city and the name of your internet provider, which Cloudflare works out from your IP address; the names and versions of your browser and operating system, the kind of device, your screen size and your browser's language; how long the page was on screen, how far you scrolled and how quickly it loaded and responded (the measures known as Web Vitals), and clicks on links to other sites and on files to download. Not the page's title. They receive the drills and 1v1s above as Umami does.

To keep automated traffic out of the figures, they also check whether your browser is being driven by a program, whether its clicks, taps and keys were made by a person (only whether, never what you typed or where you clicked) and whether its requests look like a real browser's. Only these yes-or-no results are kept; your browser's time zone is compared with your connection's location and not kept. Visits that look automated are counted apart.

Before anything is sent, the page takes out of the address everything but the drill, routine or board you have open: the code a sign-in brings back and a practice seed never leave your browser. Nothing counted names you or is linked to your account, and none of it is used for advertising. If your browser asks sites not to track it (Do Not Track or Global Privacy Control), nothing is sent at all, and neither script is even loaded.

Why, where and how long

To know which drills and pages are used, how people find the site and how quickly its pages load, with automated traffic left out, so that it can be made better (a legitimate interest, Article 6(1)(f) GDPR). You can object at any time by turning on Global Privacy Control or Do Not Track in your browser. Umami processes the figures for Microscend only, under its Data Processing Agreement, which covers transfers out of the European Union with the Standard Contractual Clauses; its servers are in the European Union and the United States, and its other providers are on its sub-processors page. The figures are kept for six months.

Microscend's own statistics are kept by MABARIS on Cloudflare, in a database held in the European Union, with no time limit; your browser sends them to stats.microscend.com, where Cloudflare receives your IP address as any server does, and it is not kept. They hold no IP address, and a code stops pointing to anyone once its month's secret is deleted.

If you sign in

You sign in with Discord or Google. Microscend never sees your password: the provider confirms who you are and sends back a few details.

What is stored

• From the provider: an id for your Discord or Google account, your email address, your display name and the address of your profile picture. These identify your account and show you who is signed in; other players never see them.
• Your progress: each run (drill, score, time played, actions per minute and the drill's own statistics), your routine results, your settings and hotkeys, and which tutorial lessons you finished.
• To keep you signed in: a sign-in session in your browser's local storage. It is needed for the service you asked for, so no consent banner is shown.
• Records of signing in: Supabase, which runs the accounts, keeps records of sign-ins and requests, including IP address and browser, for at most seven days, to keep accounts secure and to fix problems.
• Ranked play: your best verified score on each drill, and a leaderboard name if you choose one. The leaderboard, below, says what that involves and what others can see.

Your profile picture is loaded from Discord's or Google's own servers, without telling them which page you are on.

Why

To provide what you asked for by signing in: keeping your progress safe and in step across your computers, and ranked play. That is the legal basis (Article 6(1)(b) GDPR: a service you asked for) and the only use; the records of signing in are kept to protect the accounts (a legitimate interest, Article 6(1)(f)). Your data is not sold, shared for advertising, or used to profile you: a rank is worked out from scores in the game and nothing else.

Where

Accounts are kept by Supabase, in its Central EU region (Frankfurt, Germany), under Supabase's Data Processing Addendum. Supabase relies on other companies to run its service, listed on its sub-processors page; some of them are outside the European Union, which the addendum covers with the safeguards the GDPR requires for such transfers. Cloudflare, which hosts the site, is based in the United States (Cloudflare's privacy policy).

Signing in with Discord or Google is also covered by their own policies: Discord, Google.

How long

Until you delete your account. Delete account, in the account menu, erases your account and everything stored with it at once: every run, result and setting, your verified scores and your leaderboard name. Your browser keeps its own copy of your progress as a guest's, which you can remove with Settings. Records of signing in are removed after at most seven days.

Age

You must be at least 14 years old to create an account, or older if the law in your country requires it. Anyone can play as a guest.

The leaderboard

The leaderboard lists players' best scores drill by drill, and the overall rating those scores come to; the ranks follow how all players score. A score counts for either only once the server has played the run again from its record and come to the same score itself. So this part concerns signed-in players: a guest's runs are never sent. What is described here is kept where the accounts are.

What is stored

• Each run you start: the drill, the time, and the random seed the server picks for it. Notes older than a day are cleared whenever you start another run.
• Each run you finish: its record is sent to be checked: the commands, selections and control groups you gave, moment by moment, and where your camera was and where you pressed the mouse on the battlefield (in the game's own coordinates: nothing of your screen or your device). The server replays it and does not keep it, with the exception just below. A run that did not start as a ranked one (a practice seed from the address bar, no connection when it started) is not sent.
• Your best verified score on each drill, with when it was verified, how long the run lasted and its actions per minute. The record of that run stays with it if the score placed among the first fifty of its board when it was set, so that a leading run can be watched again (see below).
• Your leaderboard name, if you choose one, and when you last set it.

What others can see

Nothing that points to you, unless you choose a leaderboard name. You are asked for one when you first sign in, and can skip the question; later it is in the account menu, under Leaderboard name. From then on anyone can see that name on the boards, beside your best verified score on each drill, its actions per minute and when it was verified, and, once you have a verified score on every drill, on the overall board beside the overall rating those scores come to. Where the record of that best run was kept (above), anyone can also watch the run from the board, played back from its record: what you did, where your camera was and where you clicked. It is a name you type yourself: your Discord or Google name, your email address and your picture are never shown. You can change it once a day and take it off at any time; taking it off, or deleting your account, removes you from the boards at once.

With or without a name, your verified best scores are counted in the figures the ranks are set from: how many players have a score on a drill, the middle score, and how far apart the scores lie. Those figures are public and name nobody. When you delete your account they are worked out again without you.

Why

Ranked play is part of the account, and being listed is something you ask for by choosing a name (Article 6(1)(b) GDPR: a service you asked for). To keep the boards fair, the records of leading runs are kept, and those of listed players can be watched by anyone, so that a run not honestly played shows for what it is; an account whose scores were not honestly played can be left off the boards and out of the figures, and a name that is offensive or passes for someone else can be removed (a legitimate interest, Article 6(1)(f)).

1v1

The results of your 1v1 matches, against the computer and against players, and what you last chose in the 1v1 lobby (the game, the level, the length and armies of a match or the map of a full game, your 1v1 name, whether to hide your IP address) are kept in your browser's local storage with the rest of your progress, under microscend_profile_v1. They are not sent anywhere, and an account does not carry them.

Playing another player

Nothing is sent until you press Find an opponent, Play a friend or Join. Then:

• Meeting: your page connects to Supabase Realtime, a service of the Supabase that runs the accounts (where it works and who helps it is under If you sign in, above), which receives your IP address and browser details as any server does. While you look for an opponent, every page looking at the same time sees the name you typed, the game you want to play and a random code for your visit. A match with a friend has a code of six letters, in the link you send; it means nothing once the match is over.
• In the match: your page sends your opponent's page the name you typed, your orders as you give them (which of your units, and where to), and what keeps the two games in step: ready, pings, checks of the battlefield. Your opponent sees your name and how you play, nothing else about you. Messages that go through Supabase are passed on and not kept.
• A direct connection: to keep the game quick, the two browsers then try to connect directly (WebRTC). To find a way to each other, each browser asks a STUN server, Google's or Cloudflare's, for its own public address, so that server sees your IP address; and your opponent's browser learns your IP address, as yours learns theirs. If you tick Hide my IP in the lobby, none of this happens: everything goes through Supabase, at the cost of a little delay.

All of this is what playing another player takes, which you ask for by starting a match (Article 6(1)(b) GDPR: a service you asked for). Supabase keeps a record of connections, with your IP address, for at most seven days, as for the accounts. The name is not checked or kept by Microscend: if you would rather not, do not type your real name.

Your rights

Under the GDPR you can ask to see the data held about you, to have it corrected or deleted, to receive it in a portable form, and to object to or restrict its use. Much of this you can do yourself: Export downloads your progress as a file, the leaderboard page shows your verified scores and your name, and Delete account erases everything. For anything else, write to privacy@microscend.com; you will get an answer within a month.

You can also complain to a data protection authority: in Italy, where Microscend is run, the Garante per la protezione dei dati personali; or the authority of the EU country where you live or work.

Changes

If this page changes, the date at the top changes with it.