Cosmo Arena
Privacy Policy
Last updated: 11 September 2026
Cosmo Arena is a free online space-combat game, playable in a browser at cosmoarena.co and as Android and iOS apps. This policy explains exactly what the game collects, why it collects it, how long it is kept and how to get rid of it. It is written to be read, not to be survived.
The short version. We collect the callsign you choose, a password hash (or a Google account identifier if you sign in that way), your match results, and your chat messages. We do not display ads inside the game. On supported Android and iOS versions, adults can optionally allow Meta app measurement to help us understand which ads bring players to the game. This shares app and device information with Meta only after you opt in. You can delete your account and everything attached to it at any time, from inside the game or from this page.
Who is responsible
Cosmo Arena is operated by its independent developer. For any privacy question, request or complaint, write to hello@cosmoarena.co. We answer privacy requests within 30 days.
What we collect, and why
| Data | Why | How long we keep it |
|---|---|---|
| Callsign (username) | Identifies you to other players, in the lobby, the kill feed and the ladder. | Until you delete your account. |
| Password hash and salt | Signing you in. The password itself is never stored — only a salted hash, which cannot be turned back into your password. | Until you delete your account. |
| Email address (only if you sign in with Google, or add one) | Recovering an account and linking a Google sign-in to the right player. | Until you delete your account. |
| Google account identifier (only if you use Google sign-in) | Recognising you on your next sign-in without a password. | Until you delete your account. |
| Avatar image (only if you upload one) | Shown on your profile. | Until you replace it or delete your account. |
| Match results — ship flown, kills, deaths, score, duration, win or loss, and your rating | Career stats and the competitive ladder. | Until you delete your account. |
| Chat messages you send in lobbies and matches | Delivering them to other players, and moderation — so that a report can be investigated with the actual exchange rather than one line out of context. | 7 days, then automatically deleted. Text quoted inside a report is kept with that report. |
| Reports, blocks and sanctions | Enforcing the community rules and keeping a record of moderation decisions. | Up to 2 years, so repeat behaviour can be recognised. |
| Game settings and saved presets | Following your setup between your devices when you are signed in. | Until you delete your account. |
| Server logs — including your IP address, connection times and errors | Keeping the servers running, diagnosing crashes, and stopping abuse. | 30 days, then rotated out. |
What we do not collect
- No ads displayed inside the game.
- No Meta app measurement before you opt in.
- No GPS location collection. IP addresses may indicate an approximate location.
- Meta measurement does not access your contacts, photos, files, microphone or camera.
- We do not receive or store your card or bank details. Android purchases are processed by Google Play. We receive the product purchased, purchase token, order status, country code and transaction identifiers needed to verify the purchase, grant credits, prevent duplicate claims and handle refunds.
Playing as a guest
You can play without creating a password. A guest account is still a real account on our server — it has a callsign, a rating and a match history — but it has no password, so it lives on the device you created it on. Guest accounts that go unused for 30 days are deleted automatically. You can turn a guest account into a full one at any time, keeping your record.
Chat, moderation and other players
Cosmo Arena has live text chat between players. Anything you type in chat is sent to the other players in that lobby or match, and is stored for 7 days for moderation. Chat is filtered automatically: any word the filter objects to is replaced with symbols before the message reaches anyone, so the offending content is never delivered. Slurs also count as a strike against the sender, and enough strikes mute the account.
You can block any player from their name anywhere it appears — in the lobby roster, the in-match player list, or on any chat line. Blocking is private: the other player is not told, and from then on neither of you sees the other's messages. You can also report a player; a report is sent to a moderator together with the recent chat from that room, and can result in a mute or a suspension.
Who your data is shared with
Other players see your callsign, your avatar, your rating and rank, your match results in games you played with them, and whatever you type in chat. That is the whole of it.
We do not sell your data. Services involved in operating and measuring the game include:
- Google, if — and only if — you choose to sign in with Google. Google tells us your account identifier, email address and display name. Google's own privacy policy governs that step.
- Our hosting provider, which runs the server the game is on and therefore processes the data on our behalf. Servers are located in the United States.
Optional mobile ad measurement
Android version 0.34 and later, and iOS version 0.34.0 and later, include Meta's app-events SDK. If you choose Allow (18+), we share installation, app-open and measurement-opt-in events, device and app information, IP address, and available advertising or attribution identifiers with Meta. This helps measure our advertising and may support Meta's advertising services. We do not send your callsign, email address, chat, or account password to this SDK. Meta processes the information under its privacy policy.
On iOS, Apple's App Tracking Transparency sheet is the only first-launch measurement prompt. If tracking is denied or restricted, this integration does not initialize Meta measurement. Choose Ask App Not to Track to play without it. Android uses its own optional in-game choice. You can change the iOS permission in iPhone Settings or open it from the game's Settings → Ad measurement. Turning it off stops future automatic app-event collection; it does not delete information already received by Meta. For deletion assistance contact hello@cosmoarena.co or use Meta's privacy controls. We do not set Meta's retention periods. Players under 18 should choose Not now.
We may also disclose data if we are legally required to, or where it is necessary to investigate abuse or protect players from harm.
Deleting your data
You can delete your account at any time:
- In the game — open your profile (the account chip at the top of the menu), then Safety & privacy → Delete my account.
- On the web, including after uninstalling the app — see Delete your account.
Deleting removes your account, callsign, email, password hash, avatar, rating, match history, settings and block list immediately and permanently. Two things deliberately survive: moderation records of any reports or sanctions involving your account, which are kept so a banned player cannot erase the ban by deleting the account, and chat lines within the 7-day window, which are detached from your account and then expire on schedule. Server logs age out within 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, export, restrict or delete the personal data we hold about you, and to object to how we use it. Everything we hold about you is visible on your profile page in the game, and the delete route above is unconditional. For anything else — including a copy of your data — write to hello@cosmoarena.co.
Our legal basis for processing, where the GDPR applies, is the performance of our contract with you (running your account and the game), and our legitimate interest in keeping the game safe and working (moderation, abuse prevention, security logs).
Children
Cosmo Arena is not directed at children under 13, and we do not knowingly collect personal data from them. The game contains live chat with other players, which is why it is rated for teens and above. If you believe a child under 13 has created an account, write to hello@cosmoarena.co and we will delete it.
Security
Passwords are stored only as salted hashes. All traffic between the game and our server is encrypted with HTTPS. Sessions expire, and signing out invalidates the session immediately. No system is perfect, but we do not keep data we do not need — which is the most effective protection there is.
Changes to this policy
If this policy changes in a way that materially affects you, the new version will be posted here with a new date at the top, and the game will show a notice on the next sign-in. Continuing to play after a change means you accept the updated policy.
Contact
Questions, requests or complaints: hello@cosmoarena.co.
Advertising measurement
On the website, optional Reddit measurement can measure a page visit, the first game start and multiplayer start in a page session, and account registration. It may receive browser/device information, IP address, page URL, referral and ad identifiers, and may store advertising cookies. If you arrive through an X ad, we retain X's click identifier for up to 30 days and send that identifier to X only if you create an account, so we can count ad-driven signups. We do not send callsigns, email addresses, chat, passwords or gameplay data to X. This does not track app installations.