Privacy Policy
Last updated: 11 November 2026
The short version: we keep your email, the name you pick, and the times your targets upload. Your name and times are public on the leaderboard; everything else is private. We run no analytics, ads or trackers, and you can download or delete your data yourself at any time.
Who we are
Leo Lasers is run by [BUSINESS NAME] (“we”, “us”). For anything about your data, write to [CONTACT EMAIL].
What we collect
- Your account. Your email address, the name you choose (your “callsign”), the avatar you pick, and a record that you confirmed your age and accepted this policy and the terms. Your password is stored only as a salted hash by our sign-in provider; we cannot read it.
- Your times. For each run your targets upload: which game it was, your time, any split times, which zone was hit, and when it happened.
- Your targets. For each target linked to your account: its ID, the name you give it, its firmware version, battery level, WiFi signal strength, and when it last checked in.
- Technical records. As with any website, the servers that host this site and receive uploads see the IP address and browser or device making each request, and keep short-lived logs for security and troubleshooting.
What we do not collect. The targets do not record audio, video or location. Your WiFi password is saved on the target only and is never sent to us. The site does not use analytics, advertising or tracking cookies.
What other people can see
Your chosen name, your avatar and your times are shown publicly on the leaderboards and in the list of latest runs. Your email address, your targets and their details are never shown to anyone else. If you would rather not be identifiable, choose a name that is not your real one.
Why we use it
- To run your account, show your progress, and rank times on the leaderboards. This is what you sign up for.
- To send the emails an account needs: confirming your address and resetting your password. We send no marketing email.
- To keep the service secure and the leaderboards honest, which is in our legitimate interest and yours.
We do not sell your personal information, and we do not share it for advertising.
Who handles it for us
- Supabase stores the database, runs sign-in, sends the account emails and runs the server code that receives uploads.
- Cloudflare hosts and delivers this website.
They act on our instructions and are not allowed to use your data for their own purposes. Their servers may be in a different country from you, including the United States; where the law requires it, transfers are covered by standard contractual safeguards.
How long we keep it
We keep your account and times until you delete your account. When you do, your login, your profile and every one of your scores are erased straight away, and your targets are unlinked and their names cleared. Records a target wrote about its own runs remain, but they carry only the target’s ID and no longer point to any person. Our providers’ server logs expire on their own short schedules.
Your choices and rights
- Download your data. Sign in, go to your profile, and choose “Download my data” under “Your data”. You get one file with everything tied to your account.
- Delete your account. In the same place, choose “Delete my account”. It takes effect immediately and cannot be undone.
- Correct it. You can rename your targets and change your avatar at any time. To change your name or email address, write to us.
Depending on where you live, the law gives you further rights: for example under UK and EU data-protection law (GDPR) or California law (CCPA), to access, correct, delete or restrict the use of your data, to object to its use, and to take it elsewhere. Write to [CONTACT EMAIL] to use any of them; we will answer within one month. You can also complain to your data-protection regulator, such as the Information Commissioner’s Office in the UK.
What is stored in your browser
When you sign in, the site saves your session in your browser’s local storage so you stay signed in; signing out removes it. Nothing else is stored, and we set no cookies for analytics or advertising, which is why there is no cookie banner.
Children
Accounts are for people aged 16 or over. We do not knowingly collect data from anyone younger. If you believe a child has created an account, write to us and we will delete it.
Security
The site is served over HTTPS, passwords are stored only as salted hashes, and database rules limit each account to its own private data. Each target proves its identity with its own secret key when it uploads, so one target cannot post as another, and only you can read your targets’ own records. No system is perfectly secure; if you find a weakness, please report it to [CONTACT EMAIL].
Changes to this policy
If we change what we collect or how we use it, we will update this page and its date before the change takes effect, and tell signed-in users about anything significant.