Two systems, not one
Your account lives on the account service, which is what the game launcher talks to. This website is a separate system that asks the account service about your account using your own sign-in. The website has no direct access to the account database, and it never sees your password after passing it to the account service.
What the account service holds
- Email address: to verify the account and to send reset codes. Nothing else is sent to it.
- Password: hashed, never in readable form. Nobody, including staff, can read it.
- Codename and profile: chosen in game, along with a short profile message.
- Statistics: kills, deaths, accuracy, matches, rounds and experience, from matches you play.
- SP and the ledger: your balance and a record of what changed it, so a mistake can be traced.
- Inventory: items you own, when you got them and when they expire.
- Friends and clan: who you are connected to, and any note you wrote about them.
- Sessions and tickets: hashed sign-in sessions and one-use game launch credentials.
What this website holds
- A session: a cookie called
sfwebthat identifies your browser session. It holds nothing but an identifier; the sign-in token it maps to stays on our server. - Support tickets: what you wrote, the address to reply to, and your account number if you were signed in. Messages are scanned and anything that looks like a password or a code is removed before it is stored.
- A hash of your address: for rate limiting and abuse handling we store a keyed hash of your IP address, never the address itself.
- An audit trail: actions staff take on this site: who did what, to what, and when.
- A theme preference: stored in your browser, not sent to us.
What we do not do
- No advertising, no analytics, no tracking pixels, no third-party scripts.
- No selling or sharing of anything, to anybody.
- No profiling beyond what the game needs to work.
- No storing of your raw IP address in the website's database.
Cookies
One, sfweb, and only once you sign in or raise a ticket. It is marked HttpOnly and SameSite=Lax, and Secure whenever the site is served over HTTPS, which means script cannot read it and it is not sent when another site links to us. There is no consent banner because there is nothing to consent to.
How long it is kept
Account data lasts as long as the account. Support tickets are kept so that a later question about the same problem has its history. Rate-limit records are swept once they are outside their window. The audit trail is kept, because an audit trail you can prune is not one.
Asking about your data
Raise a ticket from the account in question. We will answer questions about what is held on an account, and we will delete an account on request — deletion removes the account, its profile, its inventory and its social links. Tickets you raised stay, with the account number removed, because they are also a record of our own conduct.
Security
Everything is over HTTPS. Passwords are hashed by ASP.NET Core Identity at 600,000 iterations. Five failed sign-ins lock an account for ten minutes. Resetting a password ends every session on the account. If you find a security problem, report it in a ticket rather than publicly.
Changes
Material changes to this notice are posted in news.
Last updated 15 September 2026.