Privacy

For Agent X. Effective date: 2 November 2026.

Who we are

The Agent X team operates this fictional interactive comic-book game. This page explains the information used to provide play, save progress, check scores and answer support requests.

What the game stores on your device

You do not need to register an account or supply an email address or password. When you connect, the play service issues a random guest ID and secret token. Your browser saves this guest credential in local storage under decision-game:v1:guest. It lets the service recognise your guest on later visits. It is a pseudonymous identity, not a promise that your activity can never be linked to you.

The browser also saves display and immersion settings, lite mode, local run history and progress, recovery copies of saved runs, and cached results. These records help the game resume and recover. It may remember that you dismissed an installation hint. If the optional consent notice is enabled, it saves your acceptance on this device.

The consent notice is off by default. When enabled, it waits for acceptance before connecting to the play service. The static game files can still download while that notice is open.

The service worker caches the game shell, legal pages and public scenario information. Art and narration files may be cached when requested. After installation, offline access can show the shell, scenario preview and some saved information or media. Starting or continuing gameplay, fetching current rankings and transferring a guest still need a connection. Offline audio and video are not guaranteed.

What the play service stores

• Your random guest ID, a hash of its token, the guest creation time, and an optional display name.
• Runs, scenario and content versions, chapter attempts, choices and other play commands, game responses, answer timing, results and scores, with timestamps.
• Score records used to calculate the leaderboard. Public entries show only a display name, rank and meter score. Guest IDs, tokens and individual choices are not public leaderboard fields. Guests without a display name are not ranked publicly.

The service uses these records to resume play, handle retries and verify scores. A transfer request temporarily keeps an encrypted copy of the credential and a hashed code lookup in memory. Transfer codes are single-use, expire after five minutes and stop working on a service restart. A new code replaces the previous code for that guest.

What we do not collect

The game has no email or password sign-up, advertising, analytics or tracking scripts; the game itself sets no cookies. We do not sell player data. There are no payments today. Choose a display name that does not reveal information you want to keep private.

If you choose to email us, your message includes your email address and whatever details you send. This is separate from playing the game. We use your message to reply and to keep a record of the request. Support email is handled outside the game service; contact us to ask for deletion.

Logs and security

The play service's request logs contain the HTTP method, response status, duration and request ID. They do not contain the URL, request body, headers, guest token or client IP address. These request logs are separate from the stored play history described above.

The service uses client addresses for rate limiting. It normally uses the connection address. If a trusted proxy is configured, it selects the configured address from the forwarded chain, falling back to the connection address if needed. The address is not added to your guest or run record.

The client sends its credential without cookies. Service responses are marked not to be cached, and the worker does not cache play-service responses. Persistent guest records contain a token hash rather than the readable token. No system can guarantee perfect security. Keep your credential and transfer codes private.

Service providers

Cloudflare delivers the static game files through its CDN and edge caches. During the beta the play service runs on a server we operate, reached through a Cloudflare tunnel. It may later move to Google Cloud. These providers process traffic data, including IP addresses, to deliver the game. Their infrastructure logs are separate from the limited application request logs above.

Audio is generated offline during release preparation. Playing narration does not send your choices or text to an audio-generation provider. The browser is intended to contact only our game-file hostname and our play-service hostname.

The game files are served from agentx.msm2c3p4.uk and the play service from agentx-api.msm2c3p4.uk. Our providers may process data in Canada, the United States and other countries where they operate, so your information may be handled outside the country where you live.

Retention and backups

Guest and play records persist on the service so that progress and scores can survive restarts. The application does not set an automatic deletion period for those records. Local storage and caches may remain until you clear them or your browser removes them. Older worker caches are removed when a replacement worker activates.

The hosting procedure supports database backups, which may retain copies after a live record is removed. Forgetting a device does not remove those copies. Guest and play records remain while the game is offered unless we erase them following a request. The application does not set automatic deletion periods for request logs or backups; hosting configuration controls their retention. If an erased record is in a backup, it may remain until that backup is replaced.

Your choices

• Forget this device removes the local guest credential only. It does not erase server records, settings or caches.
• Use a transfer code to access the same guest on another device. It does not erase data or sign out the original device.
• Clear this site's data in your browser to remove local storage and cached files. This can also remove access to your guest.
• Contact us to request server-side erasure or ask about your information. Erasure is handled manually; there is no automatic server-delete button. We may need enough information to locate the guest and check that the request is yours. Never send the secret token.

See Your data for the working actions. Rights to access, correction, deletion or a complaint to a privacy authority depend on the law that applies to you. Contact us for the status of a privacy request.

Children

The intended minimum age is 13. Players under the age of majority where they live must have a parent or guardian's permission. The game is not directed at children under 13. The game does not ask for a birth date. If you believe a child has provided information contrary to this policy, contact us so we can review it.

Changes

We will date changes to this policy and explain any material change to how player information is used. We will post the updated policy on this page and may show a notice in the game.

Contact

Write to support@msm2c3p4.uk, addressed to the Agent X team. See the Contact page for request details.