Privacy

Clunkyard is a game where you program robots and watch them fight. This page says what it keeps about you and your robots, where, for how long, and why. There are no ads or advertising trackers, and your information is not sold or shared for marketing.

Updated 5 November 2026

Your account

When you sign in, we keep what the service needs:

• Your email address. We send a one-time sign-in link to it. The link's secret is stored only as a one-way hash and expires after 15 minutes.
• Your handle and display name. You choose them. Your handle is public: it appears beside your robots, in match results and on the rankings.
• Your passkeys, if you add them: the public key your device creates, its sign-in counter, the label you give it, whether your device says it is synced, and when it was added and last used. Your device keeps the private key; we never see it.
• Your sign-ins. Each signed-in browser has a session whose token we store only as a one-way hash, with when it was created and last used. Sessions end after 30 days or when you sign out.
• Access keys you create for remote robots or tools, stored as one-way hashes with their label, purpose and when they were last used.

Your robots

• Source code. Every save is kept as a revision, so you can go back to it. Each robot's source is stored in its own repository on Cloudflare Artifacts, with a copy of each saved revision on our servers so builds and matches can use it.
• Builds. Your code is compiled and run inside an isolated sandbox with no network access. We keep the built program and its build output. Build output is shown only to you.
• Private and published robots. A private robot's source is visible only to you. Publishing a robot lets other players see and copy its source.
• Matches are public. The robots in a hosted match, their handles, languages, results, statistics, ratings and the replay of the match can be seen by anyone on the site. That is how the arena, rankings and tournaments work. Practice in your own browser stays in your browser.

GitHub

If you connect GitHub, we keep the GitHub App installation you chose, the account or organisation it belongs to, which repositories you granted, and for each linked robot the repository, branch or tag, folder, and the last commit we imported. We use this only to import the code you ask for. Disconnecting in GitHub stops further imports.

Email

We email you a sign-in link when you ask for one. If you turn on the daily build summary in Account, we also email you once a day when one of your robots failed to build. You can turn it off there at any time. No newsletters and no marketing.

The website

The website keeps you signed in with one cookie that holds your session, which only clunkyard.com can read (not the page's own scripts), and a second cookie that protects your forms from being submitted by other sites. Your browser's own storage remembers display preferences, such as sound, view style and overlays; they never leave your browser.

We use Cloudflare Web Analytics to count page views and page load times. It sets no cookies, stores nothing in your browser, does not fingerprint you and does not follow you across sites. We do not build profiles of visitors.

Cloudflare, which serves the website, handles each request's network details (such as your IP address) to deliver the page and defend it from abuse.

Keeping the service working

Like any online service, Clunkyard keeps records of how it is running, so that we can fix problems, keep it secure and stop abuse.

• Service logs. The servers write short log lines about requests, builds and matches, which can include an account, robot or match reference and an error. They do not include your source code, passwords or sign-in tokens. Logs are kept for 31 days and only the operator can read them.
• Job records. The service remembers which builds and matches ran, when, and whether they worked, so it can retry them and show you their status.
• Limits. Request counts per account and address are kept for minutes, to limit floods.
• Alerts. If something looks wrong, we are sent an alert. It describes the problem, such as a queue that stopped moving, not what anyone was doing.

We keep operational records because the service cannot be run safely or reliably without them (for people in the European Union, this is our legitimate interest in keeping it secure and working). We do not use them to follow what individual people do.

The house robots you play against belong to a Clunkyard account of our own.

How long we keep it

• Your account and robots are kept while your account exists.
• Revisions of a robot are kept while the robot exists, so you can restore any of them.
• Matches, replays and ratings are kept so that results and rankings stay complete.
• Sign-in links expire after 15 minutes; sessions after 30 days.
• Service logs are kept for 31 days.
• Backups of the database are taken daily and kept for 3 days, so a deletion reaches every backup within a few days.

Who handles it for us

• Cloudflare serves the website, stores robot source repositories (Cloudflare Artifacts, in the United States), sends our emails and counts page views. Data it handles may be stored and processed outside Canada, including in the United States, where it can be subject to the laws of those countries.
• GitHub handles the GitHub connection when you choose to use it.

Everything else, including the database, builds, matches and backups, runs on servers we operate ourselves. They are in Canada today; we may also run builds and matches on our own servers in the United States, and will update this page when we do.

Your data is yours

• Export your robots' source any time through the workspace, WebDAV or your linked GitHub repository, and download any replay.
• Correct your display name and your robots directly on the site.
• Delete a robot, or ask us to delete your account, by writing to us below. Deleting your account removes your sign-in, email address, passkeys, sessions, access keys and private robots. Results of matches already played stay in other players' history under a removed account.
• Ask what we hold about you, or for anything else, by writing to us below. We answer within 30 days.

Children

Clunkyard is not meant for children under 14, and we do not knowingly keep their information.

Changes

If this policy changes in a way that matters, we say so on the site and update the date at the top.

If something goes wrong

If personal information is ever accessed or disclosed without permission, or lost, we contain it, record it, and, when there is a risk of serious harm, tell the people affected and the privacy regulators promptly.

Questions

Stephen Olesen is responsible for protecting personal information at Clunkyard.

Ask about your data, or ask for it to be deleted, at [email protected], or by mail:

Stephen Olesen (slepp)
PO Box 99900 SD 067 861
RPO Wye Road
Sherwood Park AB T8B 0A8
Canada

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Québec, the Commission d'accès à l'information.