Privacy Policy

This policy explains what personal data the browser game Nothing 2 Lose at nothing2lose.eunothing2lose.eu collects, why, and what your rights are under the EU General Data Protection Regulation (GDPR). We collect as little as we can: no third-party analytics and no trackers, only anonymous hourly and daily totals (section 1). The game is free and is paid for by ads from Google (section 7a)from CrazyGames in this version (section 7e).

1.Playing as a guest

You can play without an account. As a guest, your progress and settings stay in your own browser (localStorage / IndexedDB); we never get a copy of that save. Clearing your browser data deletes it. Only what your rounds earned, the totals of your guest round wins and kills, your guest daily quests and your login streak are recorded on our server (below). Except the Playgama version: there they are saved through Playgama's storage instead (section 7c). Verified guest earnings: so your progress can move into an account later, our server keeps a short record of what your guest rounds earned (Cash, EXP and Tickets, plus the round in progress), under a random guest id in a cookie (n2l_guest). It holds no name, email or IP address. When the progress moves into an account, the record notes which account took it (removed if that account is deleted). Once your guest rounds have earned something, it also keeps your guest daily quests and their progress, your login streak (day count and last day) and which of those rewards were paid, so each pays once (a paid-reward entry is deleted after 60 days); logging in moves your streak into an account that has no streak of its own yet. It also keeps your best Survival Unlimited time per map and, if a guest round reports more than it can give (or a long Survival Unlimited run has almost no kills), a plausibility flag (section 2). It is deleted 90 days after your last round or guest reward. When you play inside another website and open nothing2lose.eu to log in, a one-time code (valid 10 minutes, stored only as a hash) moves that record to the new tab. In the Wavedash version they also stay in your browser, in its storage for the Wavedash site (section 7d).

Anonymous game statistics (guests and accounts alike): your browser does send us how the game runs and is played (load time, frame rate, error counts, connection quality, device type, graphics setting, where you came from, map results and gun kills, and which first steps you reached), and our server works out a few more from the request itself (your country and city, and whether the visit is a bot; see below). It is stored only as a fixed category or a rounded range, never as raw detail, except the referring site's host name, campaign tags, language, and country and city, which are kept as daily totals per value; a few values (such as load time or seconds) arrive as plain numbers and are rounded into a range on arrival:

• Device and screen: device class (desktop, phone or tablet), browser family and operating system family (for example "Brave" and "Windows", worked out in your browser; the user-agent text itself is never stored, and our server reads it only to tell bots from players, see "Where you came from" below), screen size class, orientation, pixel-ratio class, whether touch controls are on, whether the game runs installed / full screen or inside a portal's frame, and the game version.
• Loading: when the page starts, a short note with your device class and the kind of source (such as a portal or our own site); if you close the page before the game comes up, how far loading got and how long (in seconds) the page was open; if loading fails, the kind of error, whether 3D graphics (WebGL) are available, whether the browser is too old, and whether the portal's script loaded. No id; not sent by the Playgama version. Also how long (in seconds) the game took to download, start and reach the menu, and to load each map. For each map load: your device class, how long each loading stage took (in milliseconds) and how long the game waited after the map was built; whether the load finished, failed or was cancelled, and whether it was the first load since the page opened; the graphics preset and whether you picked it yourself; and whether your browser supports parallel shader compiling. We keep these only as daily counts, never as a row per load. If you close the page on the map loading screen, the loading stage it was at.
• Rounds: how far into a round you got (step and seconds), whether it was this browser's first round, and if you left a round early: whether you were still alive, your health band, how many seconds since your last kill and your last input, how many of the round's objectives were done (for example 1 of 2 cans) and how many seconds you had been dead; how often you turned or backgrounded the device, and counts of touch-button presses (fire, reload, jump...); counts of stutters in the first minute after the round starts and of long frames; the seconds you actually played after deploying (time on the deploy card doesn't count); in single player, the round's modifier tier and modifiers (as short codes), whether the tier you picked was switched off for that round, and whether it was a Survival Unlimited run.
• First visits and return days: a band of days since this browser's first visit (for example "1 day" or "8-13 days"), the kind of site of that first visit and whether this browser was playing as a guest or logged in at that first visit, sent at most once a day; the timings of your first session (seconds from loading to the menu, to pressing PLAY, to your first kill) and how that first round ended (also sent with the later return-day band); a test group letter ("a" or "b") when this browser takes part in a test of two game versions; the menu screen you were on when you closed the page; which tips, setting changes and store screens you used; the minutes of play before a guest's first bought gun; which first steps were reached, by device class and kind of site; and whether the first day had finished rounds (none, one, or two or more), a multiplayer round and a full minute of play (sent with the later return-day band).
• Errors: the kind of a client error (for example a network or graphics error), a short code computed from it, and where it happened: the file name, line and column in our own game code, otherwise only "portal SDK", "ads", "browser extension", "other site" or "page"; for a thrown value that is not an error, only its type (for example text or number); whether it was the first time on this page load; the game version, device class, browser family and kind of site. Never the error message, the page address or an extension's name.
• Ads: for each ad request, the kind (break or rewarded), the place (round end, match end, leaving a round (Playgama only), round bonus, consolation, 2x EXP, revive or free gun), the result (shown, watched, skipped or none) and, when no ad played, a short reason code (such as "adblock", "unfilled", "adCooldown" or "timeout"). Kept only as counts; no id is stored with them (the report's random presence id is used only for the bot check below, then forgotten).
• Where you came from: counted only as daily totals, never per player:
  • Country and city: when the game reports a page load, how the game starts up (the loading report) or a connection report (connection quality), or the menu checks how many players are online, our server looks up your IP address in a local copy of a geolocation database (DB-IP "IP to City Lite", section 5), in memory only. Only the country and city are used; the IP address is never written to disk or logs and never sent to anyone by us (Cloudflare sees it in transit, section 8). A city with fewer than 5 page loads on a day is never shown and is counted as "other" in its country.
  • Referring site: only the host name of the site the link was on (for example google.com), never the page address, path or query. Rare sites past a daily limit are grouped as "other".
  • Campaign tags: the utm_source, utm_medium, utm_campaign and utm_content values of the link that opened the game (trimmed, lower-case, at most 40 characters).
  • Language: your browser's language setting (for example "cs" or "en-US").
  • Landing page: which of our pages the visit started on (game, about, privacy, terms or other).
  • New or returning: whether this browser is new or came back on a later day, per kind of site. This is worked out from the first-visit date kept in your own browser (section 7); no id is sent.
  • Bots: our server decides whether a visit is a bot (search and ad crawlers, page-speed tools, automated browsers) from the browser's user-agent text, whether the request came from Google's published crawler and proxy networks, and the browser's own "automated browser" flag. The user-agent text is read only for this check and never stored. Bots are kept out of player counts and counted separately, per kind of bot. So that a real player is not mistaken for a bot, a statistics report also carries the random id this browser uses for the live player counter (n2l.presenceId: random, no name or email), or the login cookie when the browser adds it; the server only asks its in-memory counter whether that browser already counts as a player, then forgets it. A report it cannot place yet waits in memory for up to 30 seconds. Neither is stored or logged.

We store only hourly and daily totals per category, with no account, IP address, browser ID or user-agent attached, so they can't be linked back to you. We also count how many of these reports our server refused or dropped, and why (for example too many at once); those counts hold nothing of the reports' content. For where you came from we learn the kind of site (for example a search engine, YouTube or a game portal), the host name of the referring site and whether this is your browser's first visit, never the address of the page. All of this sits in a separate statistics database, with no per-player rows and nothing that links days or players together. We use no cookies or ids for these statistics, no third-party pixels and no fingerprinting. The live player list keeps the kind of site, your device class, browser family, operating system family and country (on the operator's private server console also your city) in memory only while you play; they are never stored. When the game is shown inside another website, we also record that website's name (its domain only, such as example.com, never the address of the page) in the same daily totals and in the live player list. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in improving the game.

2.What we store when you create an account

Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR) for running your account, and our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR) for abuse protection.

3.Bringing an account from our website

In this version you sign in only with your CrazyGames account (section 7e). If you already have an account on our website, you can get a link code there and enter it here (Account, then "Enter its code"): your CrazyGames login then plays with that account. It keeps the data it already holds from our website, as this policy describes there. We never ask CrazyGames for any of it.

4.Emails

We send only two kinds of email: account verification and password reset. They come from our own mail server. We use no mailing lists, no newsletters and no third-party email provider for the mail we send. Mail you send to owner@nothing2lose.eu is forwarded through Cloudflare to our mailbox (section 8).

The CrazyGames version sends you no email: an account made there has no email address of its own (section 7e) unless you add one on our website; then you get the verification and reset emails described in our website's version of this policy. Those come from our own mail server. We use no mailing lists, no newsletters and no third-party email provider for the mail we send. Mail you send to owner@nothing2lose.eu is forwarded through Cloudflare to our mailbox (section 8).

5.IP addresses and logs

Your IP address is used only in memory for rate limiting and abuse protection, to look up your country and city in a local geolocation database (section 1) and to recognise Google's crawler networks, and is not written to disk. The lookup runs on our own server. Your connection reaches us through Cloudflare (section 8), which passes your IP address on to our server and sees it itself; we send it to no lookup service. Our web server logs keep no IP addresses, no query strings and no full user-agent, only the referring site's host name and a bot tag. Game server logs contain no IP addresses, tokens, player names or chat text.

IP geolocation by DB-IP, licensed under CC BY 4.0.

6.Multiplayer and chat

When you join a multiplayer room, your username, the title you wear, your in-game actions and your chat messages are sent live to the other players in that room. We do not store or log room chat messages. Direct messages between friends work differently (section 6b).

Leaderboards: for a verified account, your username, total EXP, active play time (all time and this week), kills and wins can be seen by every player on the leaderboards in Settings → Highscores. Guests never appear there.

You can turn text chat off in Settings. In the CrazyGames version, chat also follows CrazyGames' own chat setting: when it is off there, room chat and direct messages are hidden.

6a.Voice chat

Voice chat is off by default. Your microphone is only used if you turn voice on yourself.

• While you talk, your voice reaches everyone in your room who is in range or in your channel. Other players could record it on their side, so don't say anything you wouldn't want kept.
• Your voice is relayed live through our own server (it passes through Cloudflare's network on the way, encrypted between you and Cloudflare and between Cloudflare and us, like all traffic; section 8). We never record, store or log it, and we use no voice-chat service.
• You can mute anyone. With an account, your mute list (an opaque player key, mute on/off and volume) is stored on our server so it follows you. As a guest, it is kept only in your browser tab.
• Vote-kick bans use a hashed network key, kept for 10 minutes in memory only, never your raw IP address. For guests, a ban covers the whole network (for example a household) for those 10 minutes. Players on the same network also share one vote in a vote-kick.

6b.Friends, messages and parties

Friends, direct messages and parties need an account. Guests can't use them.

• What friends see: your username, when you became friends, whether you are online and, when you are in a room, its map, player count, whether a round is on and whether it is private. They see the room's code only when the room is public (it is listed anyway). Friends can join your room through our server, private rooms too, while you are friends and not appearing offline. Once in, they are a member like any other and see the room's code, so a private room can be joined by the friend of any player in it.
• Friend requests: the player you ask sees your username and when you asked.
• "Appear offline" hides all of it: friends see you as offline and can't join you.
• Blocking someone ends the friendship, hides your status and room from them, stops their friend joins, and hides their friend requests and party invites on your screen. A friend request they send while blocked is never shown to you and is deleted when you unblock them, or after 30 days. In a room you both play in they can still see you: use mute or vote-kick there (section 6a).
• Parties exist only while you are in a room and are never stored. Party membership and party colour are visible to everyone in that room.
• Direct messages: you can message a friend only (accounts only, and only while neither of you blocks the other). Messages are stored on our server in the EU (on the way they pass through Cloudflare, section 8) so your friend can read them later, and are filtered for profanity before they are stored. We also keep which messages each of you has read. Messages and read markers are deleted 7 days after sending, or earlier when either of you deletes your account. If the friendship ends or one of you blocks the other, the messages are hidden from both of you at once, but stay until those 7 days are up so the other player can still report them. They are never written to our server logs, and are included in the copy of your data we send you on request (section 10).
• Reports: if you report a message, or report a player after removing or blocking them, we keep a copy of the reported message (for a player: up to 20 of their recent messages to you) and both usernames for up to 90 days, so we can review abuse (legitimate interest, Art. 6(1)(f) GDPR). Deleting your account deletes the reports you made. If the reported player deletes their account, the report stays until the 90 days end.
• Invites: an invite to your room lives only in our server's memory, for 60 seconds. It never contains your room's code: your friend joins through our server.
• We can turn direct messages off for everyone or for one version of the game (for example the CrazyGames version), and turn room invites off.

7.Cookies and browser storage

We set one first-party session cookie (HttpOnly) when you log in, so the game knows it is you. It is strictly necessary and needs no consent. As a guest, a second HttpOnly cookie, n2l_guest, holds a random guest id for your verified guest earnings, guest daily quests and login streak (section 1); it is also strictly necessary and expires 90 days after your last round. In normal operation Cloudflare sets no cookies on our site: we keep its bot-check and challenge features off. Only during an attack on the site may Cloudflare set a strictly necessary security cookie (cf_clearance) after a browser check. The game also uses your browser's localStorage / IndexedDB for settings and guest progress, plus one flag, n2l-funnel, listing which first steps (page loaded, menu, first round...) this browser already reported, so each is counted once; it holds no id. A second item, n2l-days, keeps the day number of this browser's first visit and of its last report, the kind of site of that first visit, your total seconds of round play and a few flags (first session sent, first round sent, first gun bought, whether you were a guest at your first session, browser from before this update), how this browser's first round ended, its test group letter ("a" or "b") and whether its first day had finished rounds, a multiplayer round and a full minute of play, so the return-day band of section 1 can be worked out in your browser; it holds no id, and only the band, the kind of site of the first visit, the guest-or-logged-in flag, the first-round result, the group letter and those first-day facts are sent. n2l-save-ask counts how often the "save your progress" question was shown and your rounds since, so it stops asking; n2l-again keeps the end time and step of your daily play streak. Neither is sent to us. To load faster, your browser also keeps two caches in IndexedDB: the game's item and weapon pictures (n2l-thumbs) and each map's path-finding data (n2l-cache). They hold no personal data, never leave your device, and are replaced with each game update. While you log in, the tab's sessionStorage keeps the time you asked to keep your guest progress, so your guest progress can be added to your account after the sign-in; it is deleted once used or when the login is cancelled. When you play the game inside another website and open nothing2lose.eu from it to log in, that game hands its guest progress to the new nothing2lose.eu tab inside your browser (only to our own site, never to the other website or to our server); it becomes that tab's guest progress if the browser has none there yet, and reaches your account only if you then log in there. We use no third-party analytics and no trackers, only the anonymous hourly and daily totals of section 1. Ads are the only third-party part (section 7a), plus the trailer video if you choose to play it (section 7b), except the Playgama version, which also loads Playgama's scripts and storage (section 7c), and the CrazyGames version, which loads the CrazyGames SDK (section 7e). The Wavedash version runs inside Wavedash's page; there your browser keeps the session cookie and storage separately for the Wavedash site (section 7d).In the CrazyGames version the only third-party part is the CrazyGames SDK, with its ads (section 7e).

7a.Ads

On nothing2lose.eu we show (or will soon show) ads through Google AdSense (Google Ireland Ltd.): short full-screen ads only at natural breaks (for example between rounds, never during play), and optional rewarded ads you choose to watch for an in-game reward. To show and measure ads, Google may set cookies or use similar technology and process data such as your IP address, device and browser information.

In the EU, EEA, UK and Switzerland a consent message from Google (a certified consent management platform) asks you first. If you do not agree to personalised ads, Google may still show non-personalised or limited ads. You can change your choice at any time: use the privacy settings link that Google's consent message adds to the page, or clear this site's cookies and reload to be asked again. Legal basis: your consent (Art. 6(1)(a) GDPR) for personalised ads and ad cookies. How Google uses data: How Google uses information from sites that use its services. You can also manage ad personalisation at adssettings.google.com.

Ads are not loaded when the game runs inside another website (for example a game portal). There, that website's own ads and privacy policy apply.

7b.Trailer video (YouTube)

The trailer on our About page is a YouTube video (Google Ireland Ltd.). Until you press play you only see a picture hosted by us, and nothing loads from YouTube. When you press play, the video loads from YouTube's privacy-enhanced mode (youtube-nocookie.com), and Google receives data such as your IP address and browser information. Pressing play is your choice to load it (Art. 6(1)(a) GDPR). See the Google Privacy Policy.

7e.CrazyGames version

When you play Nothing 2 Lose on CrazyGames (crazygames.com), the game also loads the CrazyGames SDK (sdk.crazygames.com). It loads only in that version, never when you open nothing2lose.eu directly. CrazyGames' own privacy policy covers their side.

• What CrazyGames receives: when the game is loading and when you are playing (as opposed to menus and breaks), happy moments such as a rank up, your multiplayer room code and whether friends can still join it (so they can be invited), and requests for its ads. The SDK itself also reports load timings, files that failed to load, and script errors (these can include the error text and the page address). We send it no name, email or account id.
• Signing in with CrazyGames: if you are logged in to CrazyGames, the game signs you in automatically each time it loads (and when you log in to CrazyGames while playing): it sends CrazyGames' signed login token to our server, which checks its signature with CrazyGames' public key (downloaded from CrazyGames; we send no player data to get it). On your first visit this creates an account linked to your CrazyGames user id. If you play as a CrazyGames guest, you can log in from the menu or with the "Log in with CrazyGames" button at the end of a round. We store your CrazyGames user id with your account. On a new account, your CrazyGames username becomes the starting in-game name (cleaned up and made unique; it is not updated later). We get no email from CrazyGames: the account gets an internal placeholder address built from that user id, which is never used to send mail, until you add your own email and password to the account.
• Guest progress stays in your browser's storage, as on nothing2lose.eu. Some browsers (for example Safari) may clear it when the browser closes, so log in to keep your progress.
• Ads in this version come from CrazyGames, under its own privacy policy (section 7a).
• Ad blocker check: to know whether a Watch ad button can work, the game checks inside your browser whether an ad blocker hides an ad-like page element. Nothing is sent for this check; if a blocker is found, ad-reward offers are replaced by a short note, and the result is only counted in our anonymous totals (section 1).

8.Who else gets your data

• Hosting: our own server rented from Skrime in Germany (EU). The hosting provider runs the hardware only and processes data on our behalf.
• Cloudflare, Inc. (USA): delivers our website and game connections from a location near you and protects the server. Every request passes through Cloudflare, which sees your IP address, browser details and the content of the traffic in transit (it decrypts it to deliver it), possibly outside the EU. Cloudflare processes this on our behalf under its data processing agreement; transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses. Cloudflare keeps its own short-lived logs under its policy. Cloudflare Email Routing also forwards mail sent to owner@nothing2lose.eu to our mailbox, which is hosted by Google (Gmail).
• Google: if you choose "Continue with Google" (section 3), and as our ad provider on nothing2lose.eu (section 7a), and YouTube if you play the trailer (section 7b). Our mailbox is hosted by Google (Gmail), so mail you send to owner@nothing2lose.eu is stored there. Google may process data outside the EU under its own safeguards.
• Google: YouTube, only if you play the trailer on our About page (section 7b), and Google if you link Google to your account on our website (described in our website's version of this policy). Our mailbox is hosted by Google (Gmail), so mail you send to owner@nothing2lose.eu is stored there. Google may process data outside the EU under its own safeguards.
• Playgama: only in the Playgama version, for its storage, optional sign-in, purchases, analytics, achievements and leaderboard (section 7c).
• Wavedash: only in the Wavedash version. Wavedash runs the page the game is shown in and is the source of your login token and username; we send no player data to Wavedash (section 7d).
• CrazyGames: only in the CrazyGames version, for its SDK (loading and gameplay events, load and error reports, multiplayer invites, ads) and signing in with CrazyGames, automatic when you are logged in there (section 7e).

Apart from those listed above, nobody else. We never sell your data.

9.How long we keep it

• Account data, game progress and your voice mute list: until your account is deleted.
• Which days your account played and for how long: until your account is deleted. After that, only an id that no longer links to anyone is left.
• Anonymous hourly and daily totals (section 1), including the daily totals per country, city, referring site, campaign tag, language, landing page and bot kind, and load and connection times per country: kept indefinitely; they hold no personal data.
• Your country and city in the live player list: in memory only while you are online, never stored.
• Achievement statistics, claims and titles: until your account is deleted. The daily single-player counters that limit achievement progress: deleted after 2 days.
• PvP statistics: until your account is deleted, and deleted with it.
• Event chest rolls: what each boss chest gave you (kind, item and amount), kept under your account or guest id so it is paid only once and the daily chest limit holds: deleted after 7 days, or with your account / guest record.
• Friends: until you remove them or delete your account. Pending and declined friend requests are deleted after 30 days (a declined one stays for those 30 days even if its sender removes it, so it can't be sent again). Blocks and your "Appear offline" setting: until you change them or delete your account. Deleting your account deletes all of them.
• Online status for friends: kept in server memory only, for 25 seconds after your game last checked in.
• Direct messages between friends and their read markers: deleted 7 days after sending, or earlier when either account is deleted. Ending the friendship or blocking hides them at once; they are still deleted on the same 7-day schedule.
• Reports (a copy of the reported messages and both usernames): deleted after 90 days, or earlier when the player who reported deletes their account. A reported player deleting their account does not shorten this.
• Survival best times: until your account or guest record is deleted, and deleted with it.
• Plausibility flags: deleted after 90 days, or earlier with your account or guest record. An uncleared flag keeps the account off the leaderboards for at most 30 days.
• Room invites to friends: in server memory only, for 60 seconds.
• Room chat: never kept (sent live only).
• Parties: never kept (they exist only while the room is open).
• Voice audio: never kept (relayed live only).
• Unverified accounts, expired sessions and expired verification / reset links are purged automatically.
• IP addresses: only in memory, for as long as a rate limit or the country and city lookup needs them.
• Cloudflare's logs: per Cloudflare's policy.

10.Your rights

Under the GDPR you have the right to:

• access the data we hold about you,
• correct inaccurate data,
• delete your account and data,
• export your data in a portable format,
• object to or restrict processing based on legitimate interest,
• complain to a data protection supervisory authority, in particular in the EU country where you live, or with the Czech Office for Personal Data Protection (ÚOOÚ).

To delete your account or use any of these rights, email owner@nothing2lose.eu from the address linked to your account (your mail is forwarded through Cloudflare to our mailbox, section 8). We answer within one month. A copy of your data includes your direct messages still on our server, their read markers and the reports you made or that name you, your Survival best times and any plausibility flags on your account. Accounts made with Playgama sign-in have no email: write to the same address with your username, and we match the request to your account. The same goes for accounts made in the Wavedash and CrazyGames versions; deleting such an account also deletes its Wavedash or CrazyGames user id.Accounts made in the CrazyGames version have no email: write to the same address with your username, and we match the request to your account. Deleting such an account also deletes its CrazyGames user id.

11.Children

Nothing 2 Lose is not directed at children under 13, or under 16 where national law requires it. Children below that age should not create an account. If you believe a child has given us personal data, contact us and we will delete it.

12.Security

All traffic uses HTTPS (between you and Cloudflare, and between Cloudflare and our server). Passwords and tokens are stored only as hashes, and access to the server is restricted.

13.Changes

If this policy changes, we update the date at the top. Important changes will be shown in the game.