Your data and the arena

LNVPlay Privacy Policy

Last updated: October 5, 2026

Document version 2026-10-05

This Privacy Policy describes how LNVPlay (“LNVPlay,” “we,” or “us”) handles information when you visit lnvplay.com and play Late Night Rumble Arena. It is written to match how the service actually works. It is not a claim of legal compliance with any particular statute.

1. Data minimization

LNVPlay is a temporary game. Players do not create accounts. Quick Play needs no room code. A livestream room asks for its code. We ask for an agreement to the current Terms, not for a real name, email, phone number, age, date of birth, school, address, photos, videos, or social-media login.

2. How LNVPlay works

You can start Quick Play without a code. The server opens a short public lobby, then a temporary match, and fills open seats with bots. That match ends on its own and is not a livestream room. Separately, a host can create one livestream room. Its five-digit code appears on the Late Night Vision livestream. You enter that code, agree to the Terms and acknowledge this Privacy Policy, receive a server-generated display name, and play. When a match or livestream room closes, its sessions end. A later livestream room may reuse a previously used code. Quick Play does not add an account, a custom username, or a public profile.

3. Temporary player information

While you play, LNVPlay processes:

• The livestream room code you enter, when you use one
• A server-generated player identifier
• A server-generated display name
• The operator/character you select
• Scores and live game state
• A temporary player session
• Limited operational diagnostics (connection and lobby status)

That gameplay information is held in memory for the room. Display names, player identifiers, and scores may be visible to other players in the same room, the authenticated display screen, and the administrator. They are removed when you leave, are removed, or the room closes. We do not keep a permanent player profile or score history.

4. Information we do not ask for

LNVPlay does not ask players for a real name, email address, phone number, age, date of birth, school, physical address, photos, videos, files, YouTube identity, social-media identity, precise location, MAC address, or a browser fingerprint. There is no player chat, direct message, public profile, friend list, or player directory.

5. Cookies

LNVPlay sets first-party cookies that are HttpOnly, path-scoped to /, host-only (no Domain attribute), and Secure in production. Player, security, and display cookies use SameSite=Lax so the same-origin WebSocket can authenticate. The admin session cookie uses SameSite=Strict:

• lnv_player_session — authenticates your gameplay session and WebSocket. Its maximum age is the remaining room lifetime. The server revokes the session when you leave, are kicked or banned, the room closes, or the session expires. A leftover cookie may remain in the browser until that maximum age, but a revoked session is not valid.
• lnv_security_id — a random security identifier used for moderation, one active session per browser, and join rate limits. Maximum age is 30 days. It can remain after a room closes. The server stores a hash, not the raw value, when it needs the identifier. This is not an advertising identifier, but it can distinguish the same browser across visits for up to 30 days.
• lnv_display_session — used only for an authenticated display/projector connection, not ordinary play.
• lnv_admin_session — used only for the host dashboard. Default idle timeout is about 30 minutes and default absolute lifetime is about 8 hours.

Our network provider, Cloudflare, may also set its own security cookies. Those cookies, if present, are created by Cloudflare, not by the LNVPlay application.

6. Browser preferences

LNVPlay uses your browser's local storage and session storage to remember settings such as audio levels, accessibility preferences, control settings, dismissed guidance, lobby progress, temporary playback preferences, and optional local diagnostic preferences.

These preferences are stored locally in your browser and are not used for advertising or cross-site tracking. Some session preferences are automatically cleared when you close the tab, while other preferences remain until you reset them or clear the site's browser data.

LNVPlay does not use IndexedDB or a service worker for these preferences.

You can reset LNVPlay's local preferences from the Accessibility page or clear the site's data through your browser settings.

Marketing pages also use first-party Rajdhani font files served directly by LNVPlay. LNVPlay does not load this font from Google Fonts or another third-party font CDN.

7. IP addresses and network security

Cloudflare processes your network address as the public edge for LNVPlay. The LNVPlay application does not store raw player IP addresses in its database and does not write raw IP addresses to its application logger. It derives a daily rotating hash from the client network address for rate limiting and related security controls. Player bans use the security identifier, not an IP address.

8. Cloudflare and YouTube

Cloudflare is used for DNS, HTTPS, tunnel ingress, and network protection. Request metadata that reaches Cloudflare is handled under Cloudflare’s terms and settings. Retention of Cloudflare logs or analytics, if any, is configured in the Cloudflare dashboard and is separate from LNVPlay application logs.

The site may include an outbound link to the Late Night Vision YouTube channel. LNVPlay does not embed YouTube, call YouTube APIs, or connect a YouTube account. If you follow that link, YouTube receives the request under YouTube’s own policies.

9. Children and teenagers

LNVPlay does not ask for age or date of birth and has no age-verification or parental-consent collection. The product is designed as a family-friendly livestream companion without social posting or player-to-player messaging. The 30-day lnv_security_id cookie is a persistent identifier used only for moderation and join rate limits, not advertising or profiling. Whether any children’s-privacy law applies is fact-dependent. This section describes what the product does and avoids; it is not a certification of compliance with any children’s-privacy law.

10. Advertising, analytics, and sale of information

LNVPlay does not use behavioral advertising, advertising pixels, or cross-site advertising trackers. It does not sell player information or build an advertising profile. It does not follow a visitor from this site onto unrelated websites. There is no analytics cookie and no identifier that is meant to recognize a particular visitor.

To understand how the site is used, public pages send one small anonymous report when you leave or switch away from them. The report names the page, how many seconds it was visible, whether you arrived from outside the site, and a referral category: direct, YouTube, Google, social, or other. The address you came from is not sent. The report also says whether that page address carried a paid-click marker, and whether the page was visible for under 10 seconds, 10–30 seconds, or 30 seconds or more. The page address itself is not sent. The server then counts a country code supplied by Cloudflare and a coarse device, browser, and operating-system family from the ordinary request. The raw network address and the raw browser string are discarded. Only hourly totals are kept.

The game server also adds anonymous totals when a visit may be counted: joining a game, operator and ability choices, players who start a match, players still there at the end, players who leave early, and how long a finished match lasted. Length is stored only as a broad range: under 60 seconds, 60–120 seconds, 120–180 seconds, or longer. These totals are not tied to a person. A failed count cannot affect the game. When a player session ends, its length is still added to the play-time total in the same way.

Each report is added to hourly totals and then discarded. The totals are deleted after about 30 days. They are used to understand site use, improve gameplay and compatibility, troubleshoot, measure performance, and see how visitors discover LNVPlay. They are not designed to identify you. As with every request, your network address is used briefly, in a pseudonymized form held only in memory, to limit abuse (see section 7). It is not stored with these totals. Your browser may attach this site's own cookies to the request, but they are not read or recorded for these statistics. No page report is sent if your browser uses Global Privacy Control or Do Not Track, and those same signals skip the gameplay totals for that visit. The host dashboard and display pages are not measured.

11. Moderation and security records

• A kick ends the current session. It is recorded in the admin audit log, not as a standing ban.
• A room ban is tied to the security-identifier hash for that room and is deleted when the room closes.
• A temporary ban can last 15 minutes, 1 hour, 24 hours, or 7 days and is removed about 24 hours after it expires or is revoked.
• Permanent bans are not a live player feature.
• Clearing the security cookie or using another browser can evade a cookie-based ban. LNVPlay does not fingerprint devices to prevent that.

12. Retention

• Gameplay state, scores, display names, player identifiers, and player sessions: removed on leave, removal, or room close.
• Terms/Privacy acceptance for a join: kept only with that temporary in-memory session and deleted when the session ends. LNVPlay does not keep a permanent acceptance ledger.
• Closed room administrative records: about 30 days.
• Used room-code hashes: kept as operational tombstones and deleted after about 30 days. They do not identify a player. Closed codes may later be reused.
• Admin audit events: about 90 days.
• Anonymous hourly usage totals, including page, country, device, referral, and gameplay counts: about 30 days.
• Admin sessions: until idle/absolute expiry or logout, then removed about 24 hours later.
• Security identifier cookie: up to 30 days in the browser.
• Application and host logs: allowlisted operational events. On the current production host, systemd journal retention is configured to about 14 days and about 200 MB. That is separate from the 90-day admin audit.
• Cloudflare data: per Cloudflare’s configuration.
• Local preferences: until you clear them.

Room close deletes temporary gameplay data. It does not delete every security or administrative record.

13. Your requests

Privacy questions can be sent through the Contact page. Because LNVPlay does not keep permanent player accounts or real-world identity records, we may be unable to locate a particular temporary session. We do not require government identification for ordinary privacy questions.

14. Security practices

LNVPlay uses HttpOnly cookies, same-origin checks, hashed secrets, allowlisted application logs, and a restrictive content-security policy. No security measure is perfect.

15. Sharing

We use Cloudflare as the public network provider. We do not share player information with advertising networks. We may disclose information if required by law or to protect the service and other people.

16. Changes

If this Privacy Policy changes, the document version changes. The next time you join a room you must acknowledge the current version. Players already in a room are not interrupted mid-match.

17. Contact

Use lnvplay.com/contact. The currently published inbox is [email protected]. We do not publish a mailing address on this site.