Byte Swarm Privacy Policy
Last updated: September 4, 2026
Byte Swarm is a game created and published by Commander Beef. This policy explains what the game and its first-party web tools actually store and send.
No Account, No Sale of Data
Byte Swarm does not require a Byte Swarm, Google, or other third-party account. Byte Swarm does not sell personal information, build advertising profiles, or use cloud saves for advertising.
Local Game Data
Game progress, settings, unlocks, checkpoints, coins, cores, and similar gameplay data are stored locally in your browser or application runtime. Local saves remain usable offline and can be imported, exported, or removed through your browser or device controls.
No-Account Encrypted Cloud Saves
On supported online builds, cloud sync is enabled automatically and uses no player account. It can be stopped with Forget Key on This Device. Your device creates a random 256-bit Recovery Key and derives separate vault, authentication, and AES-GCM encryption values from it. The complete save is encrypted on your device before upload. The Byte Swarm cloud service stores only the encrypted current save, one encrypted prior revision, a derived vault identifier, a hashed authentication verifier, revision numbers, and timestamps. It also maintains one aggregate count of stored vaults. The service does not receive the Recovery Key or plaintext save contents.
The pairing QR code contains the Recovery Key in the URL fragment. Browsers do not send URL fragments in web requests, but any person or app that can see the QR code or copied key can access, replace, and decrypt that cloud save. Keep it private. Byte Swarm cannot recover a lost key or decrypt a save without it.
Cloud-Save Retention and Deletion
The current encrypted save and one prior encrypted revision remain stored until that cloud copy is deleted; there is no automatic expiration. Forget Key on This Device removes the key only from that device and leaves the encrypted cloud copy available to other linked devices. Delete Cloud Save Everywhere permanently deletes the cloud vault while keeping the current local save. Deleting or losing the only copy of the Recovery Key without deleting the vault makes the encrypted cloud copy inaccessible.
Diagnostics
Byte Swarm keeps a bounded diagnostic log locally on the device, including up to 96 recent cloud-sync receipts. Cloud receipts record events, byte counts, revision numbers, redacted identifier fingerprints, and save summaries such as stage and coin counts. They do not record Recovery Keys, authentication tokens, ciphertext, or complete save contents. Diagnostics leave the device only when you deliberately download or submit them with a bug report.
Bug Forum
The first-party bug board stores the report fields you submit, such as what broke, severity, frequency, device/platform, build number, reproduction details, and optional diagnostics. Ordinary report fields and reproduction details appear on public issue pages. When a report is accepted, the developer may receive an email notification containing those ordinary fields. The optional diagnostic payload is private to the developer; the private diagnostic payload is not included in that email or on public pages. Official replies are restricted to the developer. The bug board uses a first-party abuse guard implemented in the Byte Swarm Worker: rate limiting, a hidden honeypot field, minimum form time, request-origin/header checks, payload limits, and recent-duplicate rejection. No CAPTCHA or third-party challenge widget is required.
Hosting, Security, and Network Data
Byte Swarm loads game and website content from byteswarm.net using Cloudflare infrastructure. Source archives may be served from downloads.byteswarm.net using Cloudflare R2, and encrypted saves use a Cloudflare Worker and Durable Objects. Cloudflare may process IP addresses, user-agent/browser information, traffic-routing data, security signals, and request metadata to deliver and protect these services, as described in Cloudflare's Privacy Policy. Byte Swarm application code derives a short-lived rate-limit key from the request IP address and user agent, but does not store the raw values in a cloud-save record.
Analytics and Advertising
Byte Swarm has no behavioral advertising or targeted-ad tracking. Cloudflare Web Analytics may provide aggregate site-performance and visit measurements when enabled by the hosting layer; Cloudflare describes that service as not collecting or using visitors' personal data. Privacy tools may block its optional beacon without affecting the game.
Children's Privacy
Byte Swarm is not directed to children under 13 and does not knowingly build profiles of children. Bug reports should not include private or identifying information that is unnecessary to reproduce a bug.
Changes
This policy may be updated if Byte Swarm's features or data practices change. The revision date above will be updated when that happens.
Contact and Privacy Requests
Questions or privacy requests can be sent to bluedinosaur139@gmail.com or through the Byte Swarm bug board. Because cloud saves have no accounts and use derived identifiers, include only the information needed to explain the request and never post a Recovery Key publicly.