Privacy Policy

Scope

This policy applies to the SPECIAL CODE public website (game guides, account features, support, and related pages). It does not describe internal staff dashboard operations except where staff actions affect public user data.

Operator and contact

SPECIAL CODE is operated by Mahdi Suliman, an individual based in the Kingdom of Saudi Arabia, who is responsible for the personal data described in this policy. For privacy requests (access, correction, export or deletion), use the in-site support flows (guest or signed-in) or the account settings. We do not publish a physical mailing address.

Accounts and authentication

You may create a public account with email and password. We store account identifiers, a password hash (not your plain password), display name, and session tokens to keep you signed in.

You can delete your public account from your profile after confirming your password and typing DELETE. Deletion removes the public account record and related sessions managed by our application database.

When email delivery is enabled, we send account emails (address verification and password reset) through our transactional email provider, Resend. Each link is single-use and expires (24 hours for verification, 30 minutes for password reset); we store only a hash of the link token and the time your address was verified. Resetting your password signs you out of every device.

To protect accounts, we count failed sign-in attempts for an email address for 15 minutes and pause sign-in for that address after repeated failures. This record is keyed by a hash and expires on its own.

Gameplay and personalization data

When signed in, we may store progression-related preferences and saved state you choose to keep on SPECIAL CODE (for example loadout or progression helpers tied to your account). This data is used to personalize your experience on the site.

Alerts and community activity

If you turn on alerts, we store the channel you chose (email, or a Telegram chat linked through our bot) and the topics you follow, and we send you only those alerts. You can turn alerts off from your account at any time.

Votes you give on builds (for example "worked / didn't work"), builds you publish, favorites and comments are stored with your account. Vote totals are shown publicly in aggregate (for example a percentage beside a weapon in the meta ranking); we do not show who voted.

Support

Support is available to guests and registered users. Messages you send may be stored so staff can respond. Do not send passwords or payment card numbers through support forms.

Cookies and consent

We use essential cookies and local storage needed for sign-in, locale, and site function.

Optional analytics and advertising categories are off until you accept them in the on-site consent banner (stored locally as sc_consent_v1). You can change choices when the banner or privacy controls are shown again.

Analytics

If you consent to analytics, we may load Google Analytics 4 (GA4) using the measurement ID configured in deployment (NEXT_PUBLIC_GA4_MEASUREMENT_ID).

With the same analytics consent we may also load PostHog product analytics (pages visited and feature usage). Session recording is off, text on the page is masked, and Do Not Track is respected. Withdrawing consent stops it immediately.

We also operate first-party analytics and admin-facing reporting on aggregated usage. Google Search Console live integration is not enabled in the current product.

Advertising

Ad placements use slots (AdSlot) that respect consent, campaign state, and an administrative kill switch. Live ad networks are not enabled; this policy will be updated before they are.

Realtime features

Some live or realtime experiences may connect to Ably (ably.io) when those features are enabled. Connections use WebSocket or HTTPS as required by the provider.

Staff, premium, and replay

Staff authenticate separately (including via the operations dashboard) and use platform APIs with role-based access. Staff accounts are not the same as public accounts.

Premium entitlements visible in staff tooling refer to records in our database; consumer checkout, refunds, and tax handling are not live in this product version.

Session replay policy settings exist for staff review, but replay capture is disabled by default and no third-party replay vendor is wired for public visitors in this release.

Retention and security

Specific retention periods for logs, backups, and support tickets will be defined in the legally approved policy. We apply transport and browser security headers in production deployments.

Error monitoring may be sent to Sentry when configured via environment variables at deploy time; secrets are not stored in the repository.

Your choices

Use consent controls for optional analytics and ads. Delete your account from profile settings when you no longer want a public account.

You can download a copy of the data stored for your account (as a JSON file) from your profile at any time. Passwords, secrets and link tokens are never included.

Changes

We will update this page when product behavior or the law changes, and show the new "Last updated" date. Material changes are announced on the site.