01 // Categories of Information Processed

We collect only the bare minimum information necessary to authenticate operators, preserve high scores, prevent spam, and secure mainframe infrastructure:

02 // Information We Explicitly NEVER Collect

Unlike commercial gaming portals, JIMBAD.COM maintains a zero-surveillance posture:

• No Advertising Beacons or Trackers: Zero Google Analytics, zero Meta Pixels, zero TikTok trackers, zero ad retargeting tags.
• No Financial or Credit Card Data: The platform is completely free to play. We do not collect credit cards, banking info, or billing addresses.
• No Precise Geolocation Tracking: We do not poll GPS or device location APIs. Access logs only parse client IP addresses for network routing and firewall protection.
• No Data Brokering: We will never sell, lease, or distribute your personal data or gameplay records to any data broker or commercial enterprise.

03 // Cipher Lounge & Cryptographic Architecture

The Cipher Lounge instant messaging module is engineered with strict cryptographic confidentiality:

• AES-256-GCM Authenticated Encryption: Message content is encrypted at the application layer with a 256-bit symmetric key derived using scrypt. Each packet includes a unique 12-byte initialization vector (IV) and a 16-byte authentication tag to guarantee integrity and authenticity.
• Strict Operator Privacy Shield: User directory search exposes only operator usernames, public IDs, and avatars. Real names, email addresses, and phone numbers are never exposed in search results.
• Mutual Consent Channel Creation: Direct messages cannot be sent unilaterally. A recipient must explicitly approve an inbound chat request before messaging channels are opened.
• Ephemeral Auto-Purge: Messages configured with ephemeral timers are irreversibly purged from database storage upon expiration.

04 // Cookies & Local Web Storage

We believe in cookie minimalism. Our platform utilizes:

• Essential Session Cookie: A single encrypted HTTP-only session cookie (connect.sid via express-session) utilized solely to verify your login session. It is flagged with HttpOnly and SameSite=Lax to prevent cross-site scripting (XSS) extraction.
• Client-Side LocalStorage: Used exclusively on your local device to store non-identifying interface preferences:
  • lang: UI language preference (EN / FR).
  • jimbad_audio_muted: Audio mute toggle state.
  • crt-off: Visual scanline aesthetic filter preference.

05 // Server & Account Security

Your data is handled with standard industry security best practices:

• Hosting & Facilities: Hosted in secure, reputable cloud datacenters with strict physical controls, environmental safeguards, and network failover protection.
• Cryptographic Password Hashing: Passwords are protected using salted cryptographic hashes to protect user accounts.
• Network Security: Protected by automated rate limiting, strict security headers, and parameterized database queries to safeguard against common web vulnerabilities.

06 // Operator Privacy Rights & Data Control

Regardless of your global location, we extend comprehensive data sovereignty rights to every registered operator:

• Right of Access: You can review your account credentials, avatar, high scores, and activity logs at any time via your profile console and the public leaderboards.
• Right to Rectification: You may update your profile avatar, modify your password, or re-enroll your Two-Factor Authentication credentials directly from the Arcade Lounge settings modal.
• Right to Erasure ("Right to Be Forgotten"): You have the absolute right to demand the permanent deletion of your account. Upon verification, your user record, avatars, high scores, guestbook transmissions, and chat histories will be completely purged from the production database.
• Right to Data Portability: You may request an export of your stored account records and game scores in machine-readable JSON format.

07 // Global Standards & Regulatory Compliance

JIMBAD.COM operates in strict alignment with international privacy standards, including:

• Canada PIPEDA / Quebec Law 25: Ensuring transparent consent, strict purpose limitation, and accountability for personal data stored on Canadian infrastructure.
• European Union GDPR: Respecting foundational principles of legality, data minimization, accuracy, storage limitation, and cryptographic integrity.
• California Consumer Privacy Act (CCPA): Confirming that we do not sell personal information ("Do Not Sell My Personal Information" is our default standard for all users).

08 // Privacy Inquiries & Data Protection Contact

For data access requests, deletion demands, or questions concerning our privacy practices: