Privacy Policy

Who runs this site

Resonator Lab is a private project run by one player. For anything about your data, write to hello@resonatorlab.com.

Using the site without an account

You can use the whole site without an account. What you add (your Resonators, weapons, teams, plan and notes) is saved in your browser’s storage, on your device. It never reaches the site. Clear your browser’s data and it’s gone.

This storage is what makes the site work, so the law allows it without asking you first, and there is no cookie banner. The site sets no advertising cookies and never follows you to other sites.

Using the site with an account

When you log in with Google or Discord, they send the site your name, your email address and your profile picture. The site never sees your password, your contacts or your messages.

The site then keeps:

• an account ID from Google or Discord, so it knows it’s you next time
• your email address, name and picture (your picture takes the place of Log in in the top bar)
• what you add: your Resonators, weapons, teams and plan, and the notes written with the Notes tool, which only the site’s admin account has

It keeps them to run your account and to give you your data on every device. The legal basis is that you asked for an account (GDPR, Article 6(1)(b)).

After you log out, this browser keeps one mark that an account was used here, so the site says “Welcome back” instead of asking you to sign up. It holds no name, email or account ID. Deleting your account removes it, and so does clearing your browser’s data.

If this browser has used an account here, the site also loads Google’s sign-in script, so you can log back in with one tap. When it loads, Google can see that your browser visited this site, as with any Google sign-in button. It is never loaded for anyone else. The script keeps one small cookie of its own here, “g_state”, which only remembers whether you closed its prompt, so it does not ask again too soon.

How the site counts visits

To see which pages and tools get used, the site counts what happens on its pages: which page you open and for how long, what you click, what you add (a Resonator, a weapon, a team, a plan) and the mini games you play. It never keeps what you type, like a search or a note.

Without an account, the count is anonymous. Your browser keeps a random number for 13 months, so the site can tell a new visit from a return. The number holds no name or email, and it is never joined to an account, even if you sign up later. The count stores no IP address.

With an account, the count is tied to your account, so the site can see how the app is used over time. These records stay for 13 months. After that, only anonymous totals remain.

The count is used only to improve this site. It is never sold, never shared and never combined with other sites. The legal basis is the site’s legitimate interest in knowing what works (GDPR, Article 6(1)(f)). For visits without an account, the law allows this kind of count without asking first, as long as you can turn it off. You can, right here:

When you send feedback

The feedback form sends what you write, and your email address only if you type one. It also sends the page you were on, the name of your browser and system (for example Chrome on Windows), the size of your window, and whether you were logged in. It never sends your account or your roster, and the note itself doesn’t carry your IP address.

When you open the feedback form, Cloudflare Turnstile checks that the note comes from a person and not a bot. You don’t see it and there’s nothing to solve. For the check, Cloudflare sees your IP address and some details about your browser, and also uses them to get better at spotting bots, as its Turnstile privacy policy explains.

Every note arrives as an email at support@resonatorlab.com, and a copy goes to the site’s private repository on GitHub, where notes are tracked. The copy leaves out your email address, unless the email couldn’t be sent: then it’s the only way to answer you. The site itself keeps nothing.

Your email address is used only to answer you. Notes are deleted once they’re dealt with. To have yours removed sooner, write to hello@resonatorlab.com. The legal basis is the site’s legitimate interest in fixing what breaks and hearing what you’d add (GDPR, Article 6(1)(f)).

Where your data lives

Accounts are stored with Supabase, in their data centre in Frankfurt, Germany. The pages are served by Cloudflare. Both handle the data only on the site’s behalf and cannot use it for themselves.

When you open any page, Cloudflare sees your IP address and basic details about your browser, as every web host does, to deliver the page and keep the site safe from attacks.

Supabase and Cloudflare are US companies, so your data may be reached from outside the EU, for example by their support teams. Supabase covers this with the EU’s Standard Contractual Clauses. Cloudflare is certified under the EU-US Data Privacy Framework.

Backups

Once a day, a copy of the accounts is saved to the site’s own storage on Cloudflare, so nothing is lost if something breaks. Each copy is deleted after 30 days.

How long it’s kept

Your account stays until you delete it. When you do, it leaves the database at once and the backups within 30 days. If an account breaks the Terms, the site can close it, and it goes the same way.

Counted visits stay 13 months tied to a browser or an account, then only anonymous totals remain, and those are deleted after 25 months. Turning off “Count my visits” deletes what was counted at once, and so does deleting your account.

Who else sees it

Only the two services above handle your account data, and only for the site. It is never sold or used for ads. It goes to anyone else only if the law requires it.

A note sent through the feedback form also reaches GitHub and Google, which runs the site’s mailbox. Both are US companies certified under the EU-US Data Privacy Framework. The emails are sent through Resend, a US company certified under the same framework.

Inside the site, only its admins see the accounts and the counts, to run and improve it.

Tips through Ko-fi

The “Support me on Ko-fi” links take you to Ko-fi, a separate service with its own privacy policy. This site loads nothing from Ko-fi.

If you leave a tip, Ko-fi and the payment service you pick (Stripe or PayPal) handle the payment. Ko-fi then shares with me your name or display name, your email address, the amount, and your message if you write one. For this data I’m a controller on my own, separately from Ko-fi.

I use it only to see who left a tip, to thank you, and to keep the records the law asks for payments, for as long as it asks. It never joins your account here and is never used for anything else. The legal basis is my legitimate interest in receiving tips, and the law on payment records (GDPR, Article 6(1)(f) and 6(1)(c)).

Your rights

You can ask to see your data, correct it, get a copy of it, or delete it, and you can object to how it’s used. Write to hello@resonatorlab.com and you’ll get an answer within a month.

If you think your data is handled wrongly, you can complain to the data protection authority in your country.

The site uses what you add only to suggest teams and pulls. It makes no automated decisions about you.

Age

Google and Discord accounts need you to be at least 13, or older in some countries. The same goes for an account here.

Changes to this page

If something important changes, you’ll see a note the next time you log in. The date at the top says when this page last changed.