Privacy Policy

SlapTopia

Last updated: 14 August 2026

This document was drafted by an agent and is not legal advice. Every statement in it describes what the build actually does today, but a lawyer should read it before it is submitted to an app store.

The short version

SlapTopia is operated by Blacktop Social LLC. It has no accounts, no sign-up, no email addresses, no passwords, no analytics, no advertising, and no third-party trackers. It never asks for your real name, your location, your contacts, your photos, or your microphone.

Three things leave your device, and only when you finish a run: the display name you typed, your score, and the force numbers from that run. They are published on a public leaderboard, which is the point of the leaderboard.

If you play on a Mac with the optional slapd helper, it reads your laptop's built-in accelerometer. That sensor data never leaves your machine — it travels from the helper to the game on your own computer and is never sent to us or to anyone else.

What we collect, and why

1. Your display name

You choose it. You type it into the game before your first run and you can change it at any time.

We do not verify it, and we do not want it to be your legal name.
It is stored on our server alongside your score and is shown publicly on the global leaderboard and on any challenge link you share.
It is limited in length and stripped of characters that would break the board.

Do not use your real name, your email address, or anything else you would not want published. It is a leaderboard handle.

2. A random per-browser identifier (`cid`)

The first time you play, the game generates a random identifier — a UUID — and keeps it in your browser's localStorage.

It is generated on your device, at random. It is not derived from your hardware, your network, your account, or anything about you.
Its only job is to let the leaderboard recognise a returning player as the same row, so your personal best replaces your previous best instead of adding another line.
It is not linked to any other identifier, because there is no other identifier.
Clearing your browser storage destroys it. You then appear on the board as a new player, and the old row stays behind under the old name and score.

3. Scores and force numbers

When a run ends, the game sends your score and the average and peak force of that run (in g) to the leaderboard, keyed to your cid.

The force numbers exist because the game measures how hard you hit — deliberately without rewarding it — and reports it back to you and to anyone you share a score card with.

4. Preferences kept only on your device

The following live in your browser's localStorage and are never sent anywhere:

your best score and best recorded force
your daily streak
your per-world progress and which worlds you have unlocked
your entitlements (which paid or granted worlds you own)
your display name (a local copy, so you don't retype it)
whether you dismissed the "add to home screen" prompt
which world you last played

All of these are namespaced slaptopia.*. Clearing your browser data deletes them, permanently and irreversibly — there is no cloud backup of your progress, because there is no account to back it up to.

5. The accelerometer, on Mac only (`slapd`)

slapd is an optional command-line helper you install yourself. It reads the Sudden Motion Sensor built into Apple laptops so that physically slapping the machine flaps your citizen.

It streams impact events to the game over a local connection on your own computer.
It transmits nothing off the machine — no sensor readings, no impact data, no telemetry of any kind.
It has no network access to us. It never contacts our servers.

6. Rate limiting

To stop a script filling the leaderboard, the server counts how many scores a given cid has posted today. That counter is keyed to the random identifier and to the date, and it is short-lived.

7. What our hosting provider sees

The game is served by Vercel and its leaderboard is stored in Upstash Redis. Like every website on the internet, requests to those services carry your IP address and your browser's user-agent string as an ordinary part of how HTTP works. Those providers may log them for operational and security purposes under their own policies:

Vercel — https://vercel.com/legal/privacy-policy
Upstash — https://upstash.com/trust/privacy.pdf

We do not use those logs, join them to your cid, or build any profile from them.

What we do not collect

To be explicit, because the absence is the whole point:

No accounts, no passwords, no email addresses, no phone numbers.
No analytics — no Google Analytics, no Plausible, no Mixpanel, no PostHog, nothing.
No advertising, no ad identifiers, no ad networks.
No third-party trackers, pixels, or social widgets.
No cookies used for tracking. (The game uses localStorage, described above, for your own settings.)
No location, no contacts, no photos, no microphone, no camera.
No cross-site or cross-app tracking of any kind.
No sale or sharing of personal data with data brokers. We do not sell your data. There is no arrangement under which we could.

Where the data lives, and for how long

Data	Where	Retained
Display name, score, force	Upstash Redis, on our leaderboard	Indefinitely — it is an all-time board
Random `cid`	Your browser, and as the key of your leaderboard row	Until you clear your browser storage; the server row persists
Rate-limit counter	Upstash Redis	Short-lived, expires automatically
Challenge links	Upstash Redis	30 days, then they expire
Everything else	Your device only	Until you clear your browser storage

The leaderboard is all-time by design. A board that quietly deleted itself would not be one.

Your choices and your rights

Change your name. Type a new one. It replaces the old one on the board the next time you post a score.
Stop appearing on the board. Don't finish runs, or clear your browser storage — a new random cid posts as a new player.
Delete your row. We hold no email address for you, so we cannot identify your row on our own. Contact us at support@blacktop.social with the score and display name shown on the board, or with your cid (visible in your browser's localStorage under slaptopia.cid), and we will delete it.
Get a copy of what we hold. Same route. It will be one row: a name, a score, and a random identifier.
Delete everything local. Clearing site data in your browser removes every slaptopia.* key. Uninstalling slapd removes the accelerometer helper.

Depending on where you live you may have further rights under the GDPR, the UK GDPR, the CCPA/CPRA, or comparable law. Our lawful basis for publishing a name and a score is your consent, given by typing a name and finishing a run; you can withdraw it by asking us to delete the row.

Children

SlapTopia is not directed at children under 13, and we do not knowingly collect personal information from them. We collect no information that would let us determine a player's age. If you believe a child has published a name on the leaderboard, contact us and we will remove it.

Security, honestly stated

Traffic is encrypted in transit (HTTPS). The leaderboard is stored with a managed provider using access-controlled credentials.

We also want to be straightforward about the limits: the game is client-authoritative, so scores are not cryptographically verified, and the leaderboard should be read as a scoreboard rather than a record book. This does not affect your privacy — no additional information is collected as a result — but you should not treat the board as an authenticated record of anything.

Changes to this policy

If this policy changes materially, the "last updated" date at the top changes with it, and the current version is always the one served at this URL.

Contact

support@blacktop.social

Blacktop Social LLC.

This policy is governed by the laws of the State of New York, United States.

← SlapTopia