A SMALL DATA FOOTPRINT

Your feedback. Your device.

SlapGPT is made by Icey. Contact icedor@icey.se about the game or your privacy.

Playing the game

Your settings, replacement counter and achievement progress stay in your browser. Achievement progress is saved locally and is not sent to the statistics service. The five latest battle logs are also saved locally in this browser. Their event history and AI prompts are not sent to statistics or an AI service; sharing happens only when you copy and paste a prompt yourself. An offline cache stores game files on your device. Replay, screenshots and recordings stay on your device unless you choose to share them. Motion sensors are enabled only with your action, and their readings are used locally. Browser speech services may send text to their provider when using an online voice; you can disable Robot voice.

Optional two-player rooms

The lobby shows your chosen gamertag, assistant, room and occupancy to other players. Gamertags are display labels, not verified identities. Hosts approve or decline requests before a guest can send game input or receive the shared room. Pending requests expire within two minutes. No account, microphone or text chat is used.

Two players exchange inputs, game state and temporary connection identifiers through an encrypted WebRTC connection, or through the PHP relay on slapgpt.icey.se. A direct connection can reveal public network addresses to the other player and may contact Cloudflare’s STUN service. The relay temporarily stores room keys, gamertags, connection descriptions, inputs and the latest room state in a protected directory. Inactive rooms expire after 45 seconds and are removed on a subsequent lobby request. This temporary shared-game data is separate from anonymous play totals.

Website statistics

Icey AB uses first-party, cookie-free statistics to understand how many people visit SlapGPT, which countries visits come from, and how actively the game is used. Website statistics run automatically, without a consent popup or an activation step. You can stop all game statistics using Website statistics in Settings → Privacy. Previously saved off settings are preserved. Browser Do Not Track and Global Privacy Control also stop collection. Native Android and iOS apps do not send these statistics and hide the setting.

The game sends small batches of game loads, play starts, active seconds, hits, tools used and combinations. These are added directly to daily UTC totals; we do not store a player's movements, individual event history, achievements, battle logs or prompts. Offline counts are discarded, with no later upload queue.

To estimate daily visitors, visits, same-day returns and repeat loads, the server uses the network address (IP) and browser header already sent with a request. It creates a pseudonymous identifier with a random secret replaced every UTC day. Raw IP and browser header are not written to the analytics store. No analytics identifier or tracking cookie is stored in your browser. We do not use device fingerprinting APIs, cross-site tracking, advertising profiles or third-party analytics scripts.

We estimate country with a local database: IP Geolocation by DB-IP. Your address is not sent to a geolocation provider. We do not collect city, precise location or an individual browsing history. The temporary identifier keeps only the latest reporting minute, a same-day-return flag and a counter to limit overlapping active time. It is not linked to the tools you use or shown in the dashboard.

Each identifier expires at midnight UTC, within 24 hours. Expired cache is physically replaced on the next audience request or a scheduled cleanup; deletion during periods without requests is not guaranteed. The private cache is outside the application directory and deployment backups. Hosting logs and system backups are separate. Hashing reduces exposure but does not make all processing anonymous.

Only daily aggregates appear in the dashboard, retained for 365 UTC days. They include country totals and hourly loads. Country groups smaller than three in the chosen period are combined for display. A new visit starts after 30 minutes without a report. Shared networks, different browsers, reloads and extra tabs affect these estimates. Weekly and monthly visitor figures are sums of daily visitors, not distinct people across the period. Active time excludes pauses, background tabs and extended inactivity; it is not a recording of your session.

Your choice and our legal basis

Icey AB relies on its legitimate interest in understanding and maintaining this free game (GDPR Article 6(1)(f)), with short-lived daily pseudonyms, aggregate reports and the safeguards above. Statistics are not needed to play. You have the right to object: switch off Website statistics in Settings → Privacy, or contact icedor@icey.se. No explanation is required for using the switch. It stops new reports, clears pending counts and, when online, requests removal of the current daily identifier. An already in-flight request may finish; a blocked removal request leaves the identifier to expire normally. Previously aggregated counts cannot be traced back to you and remain.

Your off preference is saved with the game's local settings, not as a tracking identifier. Clearing site data also removes this preference; browser privacy signals still apply. Release 1.0.53 used a separate opt-in visitor setting. Saved off values from that version are preserved conservatively, and its historical counts are not reconstructed or relabelled as complete audience totals.

Hosting and private administration

The site and its PHP backend are hosted by Oderland. Hosting security and access logs are separate from the game's statistics and can contain IP addresses; their retention follows the hosting configuration. The owner-only dashboard uses an email sign-in link, an essential secure session cookie lasting at most eight hours, and short-lived hashed login tokens. Login emails travel through the configured SMTP provider. Admin pages and responses are never included in the offline game cache.

Icey AB uses necessary hosting and access-security data to provide and protect the service. The current website statistics use the legitimate-interest basis described above, without individual profiles. For questions about logs, legal basis, retention, access, correction or deletion, contact the address above. You may also contact the Swedish Authority for Privacy Protection (IMY). You may request access, correction, erasure, restriction or portability where applicable, object to processing based on legitimate interests, and withdraw any consent you have separately given. Aggregated daily totals cannot be traced back to a player to identify or erase an individual visit.