Privacy Policy
Last updated 27 October 2026.
This page says what personal data ZeroSnake Arena keeps, why, for how long, who else handles it, and how to get a copy or have it deleted. It describes what the site's code actually does; the code is open source.
The controller is Surnin Synergy Ltd, a private limited company registered in England and Wales, company number 16770926, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For anything about your data, write to hello@surninsynergy.com.
We handle personal data under the UK GDPR and the Data Protection Act 2018. For people in the European Union the EU GDPR applies as well, and for California residents the California Consumer Privacy Act as amended by the CPRA. The rights below apply to everyone.
In short
- We know what GitHub tells us when you sign in, and what your bots do here.
- No advertising, no tracking cookies, no selling or sharing of personal data, no third-party scripts other than Cloudflare's cookieless analytics.
- You can download everything and delete your account yourself, in Settings.
What we collect
| Data | Where it comes from, what for | Kept |
|---|---|---|
| GitHub account: numeric id, login, display name, primary email address and whether it's verified, avatar URL; the OAuth access token (encrypted) | From GitHub when you sign in (scopes read:user, user:email). To identify your account and suggest a username. Your email address and name are never shown publicly; your avatar is shown on your profile. We don't use the token after sign-in. | Until you delete your account |
| Username | You choose it. Public: it names your profile and bots. | Until you delete your account |
| Web sessions: IP address and browser user agent at sign-in, creation and expiry | Kept by the sign-in system with each session, to keep you signed in and to spot misuse. After you sign out, only a one-way hash of the session token remains, so the sign-out holds. | 30 days after last use; hashes until the session would have expired |
CLI sign-in: the device code while you confirm it; for each zerosnake login, a hash of the token (never the token), the CLI's user agent and IP address, when it was created and last used | So the CLI can deploy for you, and so you can see and revoke your logins in Settings. | Device codes: valid 10 minutes, deleted an hour after that; tokens until revoked or 90 days after last use |
| Bots: names, skins, every version's source files and bundle, what the CLI sent with it (CLI and SDK version, message), check reports, status changes | You upload them. To run your bots and show them. Source code is public on the bot's page. | Until you delete your account |
| Games: each life of your bots (room, ticks, score, length, kills, how it died and who killed it, times) and ratings | Made by the arena. Public: bot pages, the leaderboard, replays. | Until you delete your account |
| Replays | Recordings of whole rooms, public. They name snakes only by random ids; the site looks up the bot and username when you open one. | 2 days; replays of the best lives for as long as they rank among the best |
| Traces: what your bot logged and decided, tick by tick | Made by the arena. Visible only to you. | 7 days |
| Moderation: bans, quarantines, their reasons, and a log of admin actions | To keep the arena safe and fair, and to answer appeals. | Bans and quarantines with the account; the admin log (ids and the moderator's note, which may name your username) as long as it is needed to prevent abuse |
| IP address of each request | Used to rate-limit requests (Cloudflare keeps the counter for one minute) and to cap live-arena connections per visitor (as a hash, in memory, while connected). Apart from the session and CLI sign-in records above, our own records don't keep it, but IP addresses may appear in Cloudflare's request logs, which we use only for security and debugging. | Up to 7 days, in the request logs |
| Request logs: time, route, status, latency, request id and your user id if signed in; Cloudflare's invocation logs add request details such as the URL, IP address, country and user agent | To run, debug and secure the service (Cloudflare Workers Logs). | Up to 7 days |
| Service metrics: counts of deploys (with your user id), lives (with the version id), errors and rate-limited requests | To watch the arena's health (Cloudflare Workers Analytics Engine). | Up to 3 months |
| Page views: page URL, referrer, browser, device type, country, load times | Cloudflare Web Analytics, cookieless: no cookies, no local storage, no fingerprinting, no cross-site tracking. Only aggregate numbers reach us. | As Cloudflare keeps them; we see aggregates only |
We don't ask for, and don't want, any special categories of data. We don't send marketing email. We don't make automated decisions with legal or similar effects; the automated checks and quarantines only concern your bot's code.
Why we may use it (legal bases)
- To provide the service you signed up for (contract, UK GDPR and EU GDPR art. 6(1)(b)): your account, sessions, CLI tokens, running and showing your bots and their games.
- Legitimate interests (art. 6(1)(f)): security, rate limiting, logs, metrics and cookieless analytics to keep the service working; moderation and its log to prevent abuse and cheating. You can object; we'll then stop unless we have compelling reasons, such as preventing abuse.
- Legal obligations (art. 6(1)(c)): when the law requires us to keep or disclose something.
Who else handles it
- Cloudflare, Inc. hosts the whole service (Workers, D1, R2, KV, Durable Objects, Queues, logs, Analytics Engine, Web Analytics) and protects it from attacks. It processes data for us under its Data Processing Addendum.
- GitHub, Inc. handles the sign-in. GitHub's own privacy statement covers your GitHub account; we receive only what is listed above.
We don't sell personal data or share it for advertising, and we don't give it to anyone else unless the law requires us to.
International transfers
Cloudflare runs a global network and GitHub is in the United States, so your data may be processed outside your country, including in the US. Transfers from the UK rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) and from the EU on the EU-US Data Privacy Framework, in which both companies take part, and on the European Commission's standard contractual clauses.
Deleting your account
Settings → Delete my account. At once: your name, email, avatar, GitHub login and username are erased, the link to your GitHub account and your CLI tokens are deleted, every session is signed out, and your bots stop playing and leave your profile, the leaderboard and every page. Then, usually within a few hours: your bots, their versions, source code, bundles, ratings, lives and traces are erased. Your username is held, as a one-way hash, for 30 days, so nobody else can take it and pose as you; then anyone may claim it.
What stays: other players' games keep the fact that a snake, now a “deleted bot”, took part, without your name; recorded replays expire on their own schedule (above); logs and metrics age out as listed; the moderation log keeps ids that no longer lead to you, and the moderator's note. A bundle or source file byte-for-byte identical to another player's upload (an unchanged template, say) is stored once, and stays while their version uses it. Database backups (Cloudflare D1 point-in-time recovery) roll over within 30 days. If you sign in with the same GitHub account later, you start a new, empty account.
If you sign in but never choose a username, you can delete the account (or download what we have) from the username page; otherwise we delete it ourselves after 30 days.
Your rights
Wherever you live, you can ask us to:
- give you a copy of your data (access, portability): Settings → Download my data, a JSON file with links to your bundles and sources;
- delete it: in Settings, with Delete my account (see above);
- correct it: your name and avatar come from GitHub at your first sign-in; write to us to change anything we hold;
- restrict or object to some uses, as described above.
Write to hello@surninsynergy.com for anything Settings doesn't do. We answer within one month (California residents: within 45 days), and may ask you to prove the account is yours, for example by writing from the email address GitHub gave us. You can also complain to the UK's Information Commissioner's Office (ico.org.uk) or, in the EU, to the data protection authority where you live. California residents (CCPA/CPRA): we don't sell or share personal information, don't use sensitive personal information, and won't treat you differently for using these rights.
Cookies and local storage
The site uses only cookies that are strictly necessary to sign you in, so it doesn't ask for consent. It stores nothing in your browser's local storage, and the analytics are cookieless.
| Cookie | Purpose | Lasts |
|---|---|---|
__Secure-better-auth.session_token | Keeps you signed in (HttpOnly, first party) | 30 days, renewed as you use the site; removed when you sign out |
__Secure-better-auth.state | Protects the GitHub sign-in against forgery | 5 minutes, during sign-in |
__cf_bm, cf_clearance | Set by Cloudflare only if it has to check for bots or attacks | Up to 30 minutes / as Cloudflare sets |
The zerosnake CLI keeps its token in a file in your home directory; that stays on your computer.
Children
You must be at least 16 to have an account. The service is not aimed at children. If you believe a child under 16 has an account, tell us and we'll delete it.
Security
Everything travels over HTTPS. Session tokens are kept away from the part of the service that runs bot code, CLI tokens are stored only as hashes, GitHub tokens are encrypted, and bot code runs in a sandbox. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you and the authorities as the law requires.
Changes
We'll update this page when what we do with data changes, and announce important changes on the site. The date at the top says when it last changed.