Privacy

Who runs it

The ladder is run by its operator, the maintainer of the Kung Fu Monkeys bots project, and can be reached at https://github.com/minip8/kung-fu-monkeys-bots/issues. The service's source code is public at github.com/minip8/kung-fu-monkeys-bots, so everything below can be checked against what it does.

What is stored and why

• Your sign-in identity. When you sign in with GitHub or Google, the service stores the provider's account id for you (GitHub's numeric user id, Google's subject id) and the name and email address the provider reports. The account id is what signs you in; the name and email are shown only to you (on the portal and through the API). Your display name, taken from the provider's name when you first sign in, is public as a member of your teams. None of it is used for anything else, and the service sends no email.
• Sessions and API tokens. A portal session is a cookie; the service stores only a hash of it, and a session ends after 30 days without use or when you sign out. API tokens (for the kfm command line tool) are stored only as hashes, with their name, scope and when they were last used.
• Teams. Team names, their members and each member's role (public).
• Submissions. The source archive you upload, the module built from it and the build log, in the object store. The source and log of a team's older submissions are deleted (the five most recent finished ones and the active one are kept); built modules are kept so recorded games can be re-run.
• Ranked games. The result of each game (the teams, the submissions that played, scores, the seed, the faults of each bot) and the ratings it moved. These are public: they are the ladder. A game's replay file is deleted 24 hours after the game.
• Backups. A nightly copy of the database is kept in the object store for a limited time (30 days in the standard deployment).

What is not

No password (sign-in goes through GitHub or Google), no payment data, no analytics or tracking scripts, no advertising. The portal sets only its own sign-in cookies.

IP addresses

Your IP address is seen by the web server in front of the service, which may keep it in its logs, and by the service's rate limiter, which counts requests per address in memory only. The service does not store IP addresses in its database.

Other services involved

• GitHub and Google, for signing in, when you choose them.
• Cloudflare R2, which stores the files (sources, modules, logs, replays, backups).
• Sentry, for error reports, when enabled.
• Google Cloud, which hosts the service and its database, in Australia.

Deleting your data

Unlinking a sign-in provider and deleting an account are not self-service yet. To have your account, identities, tokens or teams deleted, ask the operator at the contact above. The results of ranked games already played stay part of the ladder's record.