Privacy Policy

Last updated: September 19, 2026

1. Introduction

Welcome to Barstow. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our web-based multiplayer game.

2. Information We Collect

Account Data

When you create an account via OAuth (powered by WorkOS), we receive your email address from your identity provider and store it to maintain your account. Your in-game username is generated for you — we do not import a name from your provider.

Guest Accounts

You can play without creating an account. Guest accounts are assigned a random username and identified by a secure session cookie. Guests have no email address on file.

Usernames

You may change your display username. Usernames are visible to other players in game lobbies and matches.

3. Cookies

We use the following HTTP-only cookies:

session — A signed token that identifies your account (guest or registered) for about 30 days. It carries only your account identifier, not your email or name.
return_to — A short-lived cookie that remembers which page to send you back to after signing in.

4. How We Use Your Information

We use the information we collect to:

Provide and maintain the game service
Authenticate your identity and manage sessions
Display your username to other players
Improve game performance and fix bugs
Prevent abuse and enforce our terms

5. Game Telemetry

We collect game telemetry, including match events and player statistics, to balance gameplay, detect issues, and improve the experience. When your account is created, and each time you join a match, we also record your IP address, the approximate country it places you in, and your browser and device type, to prevent abuse and to fix problems that affect particular browsers or regions. When a match fails to load for you, your browser reports which loading step failed and the error, so we can fix it. During a match, your browser also reports how smoothly the game runs: how long its frames take to draw, your graphics settings, and the name of your graphics card as your browser reports it, so we can find the devices and maps the game runs poorly on. All of this is associated with your account ID.

Page Visits

When you view a page, it tells us which page it was, the site that referred you, and any campaign tags in the link you followed, along with your approximate country and browser and device type. We use no cookies or other storage on your device for this. To count visitors without identifying them, we combine your IP address and browser details with a random key that changes every day and is then destroyed, so visits on different days cannot be linked to each other and your IP address is never stored with them. If you already have an account, the visit is recorded against it, and if you create an account, it is linked to that day's visits so we can tell where players come from. If your browser sends a Global Privacy Control signal, we record no page visits at all.

6. Chat and Voice

Text chat sent during a match is kept for 30 days so that reports can be reviewed, then deleted. Voice chat is not recorded by us, though a moderator may listen to a match's voice chat live while it is being played. Another player in your match can attach roughly the last minute of voice they heard, which may include your voice, to a report they file about someone. Those clips are stored privately, reviewed only by moderators, and deleted after 30 days.

You can set voice chat to Off in Settings, in which case you neither send nor receive voice and nothing you say can be attached to a report.

7. Third-Party Services

We use WorkOS for authentication. When you sign up or log in, your authentication flow is handled by WorkOS at the login and callback steps only; afterward your session runs on our own token. See the WorkOS Privacy Policy to learn how they handle your data.

8. Data Retention

We retain your account data while your account is active. Guest data may be periodically purged after extended inactivity. Game telemetry, page visit records, and the IP addresses recorded with your account and match connections are retained indefinitely. Match chat and any voice clips attached to reports are deleted after 30 days.

9. Your Rights

You have the right to:

Request access to the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Withdraw consent at any time

10. Children's Privacy

Barstow is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Contact Us

Questions about this policy? Email contact@navoke.com.