PRIVACY

Last updated: 2 September 2026

1. Who is responsible?

The person named above is the controller for the processing described in this notice.

2. Hosting and delivery

Factor Jump is delivered through services provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, and its affiliates. When you open the website, Cloudflare processes technical request data required to deliver and protect the service. This may include your IP address, the requested address, date and time, request method, response status, browser or device information, and security events.

We use this data to deliver the website, maintain availability, prevent abuse, and investigate technical or security incidents. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and abuse-resistant operation of the game.

Cloudflare acts as our processor for customer content and customer logs under its Data Processing Addendum. Cloudflare operates a global network. Where data is transferred outside the European Economic Area, Cloudflare provides transfer safeguards described in its Data Processing Addendum, including the EU Standard Contractual Clauses where applicable. The Factor Jump leaderboard database is configured for the European Union; this does not mean that all network traffic or Cloudflare metadata is processed exclusively in the EU.

Technical data is kept only for as long as required for delivery, security, troubleshooting, or legal obligations. The exact retention of infrastructure metadata is governed by our Cloudflare configuration and processing agreement.

3. Playing a verified run

When you start a game, the server creates a random run ID, a random seed and an authentication token. The token itself remains in the current browser session; only a cryptographic hash is stored on the server. During the run, the browser sends bounded batches of game timing and input events, such as entered digits, the use of a skip or a problem refresh when play resumes after a pause. The server replays these events to calculate and verify the score. We do not use these events to profile you.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are providing the online game requested by the player and maintaining a fair scoring system that cannot be changed through simple fabricated submissions.

A run token expires after six hours. Expired run records are removed during the next scheduled application cleanup. If you leave before a run is completed, its temporary verification data may remain until that cleanup occurs.

4. Rate limiting and protection against abuse

For selected requests, such as starting a run, the application temporarily derives a one-way, keyed value from the connecting IP address. The raw IP address is not stored in the Factor Jump database. The temporary value, a request count and an expiry time are used to limit excessive requests. These buckets expire after approximately two minutes and are removed during a subsequent cleanup.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are protecting the service, the leaderboard and other players against disruption and automated abuse.

5. Global leaderboard

If your score qualifies for the global Top 10, you may voluntarily submit an arcade name consisting of one to eight letters. Please use an alias and do not enter your real name, email address or other identifying information.

The submitted arcade name and score are displayed publicly to visitors worldwide. We also store the associated run ID, submission time and moderation status. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are providing the global arcade competition deliberately requested when a player submits an alias, and maintaining a fair, consistent and moderated ranking. Because publication is optional, the game remains playable without submitting an arcade name.

Leaderboard records are retained while they are needed to calculate, operate and moderate the ranking. They are removed if the leaderboard is discontinued, if continued storage is no longer necessary, following moderation, or following a justified deletion request. Removed entries may be retained in restricted moderation records for as long as needed to prevent abuse and document moderation decisions.

To request removal, contact us and provide the arcade name, approximate score and approximate date. We may request additional information where reasonably necessary to avoid deleting another player’s entry.

6. Contact form and spam protection

If you use the contact form, we process the name, email address and message you enter in order to answer your inquiry. The message is sent to our verified destination mailbox through Cloudflare Email Service. The legal basis is Article 6(1)(b) GDPR where your inquiry concerns a contract or steps before entering into a contract, and Article 6(1)(f) GDPR for other inquiries. Our legitimate interest is answering messages sent to us.

The form uses Cloudflare Turnstile to protect it against automated abuse. Cloudflare processes technical connection and device data and returns a validation token; Turnstile does not receive the content entered in the form. We validate that token before sending the message. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is keeping the contact channel available and protecting it against spam and automated attacks.

Contact messages are deleted when they are no longer required to answer or document the inquiry, unless statutory retention duties or the establishment, exercise or defence of legal claims require longer storage.

7. Voluntary support through PayPal

Factor Jump contains a locally rendered link to a PayPal.Me page where visitors can voluntarily support the project. No PayPal script, frame, tracking pixel or other PayPal content is loaded when you open Factor Jump. Data is transmitted to PayPal only after you deliberately select the support link and leave this website.

PayPal (Europe) S.à r.l. et Cie, S.C.A. processes data on its own website under its own responsibility. If you complete a payment, we receive the transaction information made available by PayPal, which may include your name, account or email identifier, payment amount, message, transaction ID and time. We use this information to receive, administer and document the voluntary support. The legal bases are Article 6(1)(b) GDPR for carrying out the payment initiated by you and Article 6(1)(c) GDPR where records must be retained to meet statutory accounting or tax obligations.

8. No advertising or audience tracking

Factor Jump does not currently use advertising networks, analytics pixels, cross-site tracking, social-media plugins or non-essential cookies. The PayPal support option is a plain external link and does not load PayPal before it is selected. The public leaderboard version does not read or write a local browser leaderboard. Audio and visual game assets are delivered as part of the website and are not loaded from third-party media services.

9. Recipients

• Cloudflare and its approved subprocessors receive data as required to host, deliver and protect the service.
• Our email provider receives contact messages as required to deliver them to our mailbox.
• PayPal receives data only when a visitor selects the external support link or completes a payment on PayPal.
• Visitors worldwide can see the arcade names and scores currently displayed in the Top 10.
• Public authorities or other recipients receive data only where we are legally required to disclose it or where this is necessary to establish, exercise or defend legal claims.

We do not sell personal data.

10. Your rights

Subject to the applicable legal conditions, you have the right to request access to and rectification or erasure of your personal data, restriction of processing, and data portability. You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. You also have the right to lodge a complaint with a competent data protection supervisory authority.

Because Factor Jump does not require an account and intentionally collects very little identifying information, we may be unable to connect a record to you without additional details. We may request information necessary to verify a request and protect other players’ data.

11. Children and aliases

The game does not ask for a player’s age and does not require an account. Players, especially children, should choose an invented arcade alias and must not enter a real name or contact details in the leaderboard.

12. Automated decisions

The game automatically calculates scores and determines whether a run reaches the Top 10. This has no legal or similarly significant effect on a player. We do not use personal data for profiling or automated decisions with such effects.

13. Changes to this notice

We will update this notice if the game, hosting, payment links, analytics or other data processing changes. The current version will be available through the Privacy link on the website.