Privacy Policy

Quick Summary (Plain Language)

This is a friendly summary to help you understand the Privacy Policy. The full policy below controls if anything here is unclear or incomplete.

• We collect a handle, password hash, and your content if you create an account.
• Guest data stays in your browser unless you enable cloud sync.
• Cloud data is stored in Canada.
• We do not sell your data or send marketing emails.
• You can request access or deletion of your data at any time.

1. Introduction

This Privacy Policy explains how emulator.ca ("we", "our", or "the Service") collects, uses, and protects your personal information. We are committed to protecting your privacy and handling your data with transparency.

emulator.ca is operated from Canada, and your data is stored on servers located in Canada. We comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

2. Information We Collect

2.1 Information You Provide

When you create an account or use certain features, you may provide:

• Handle (Username) - Your chosen display name (3-16 characters)
• Password - Securely hashed using Argon2id; we never store plain-text passwords
• Email Address - Optional; only collected if you choose OAuth authentication
• User-Generated Content - Programs, messages, and files you create

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• IP Address and User Agent - Collected and logged for security, abuse prevention, and troubleshooting
• Browser UUID - A randomly generated identifier stored in your browser to maintain your session
• Usage Statistics - Programs saved, messages sent, games completed, BBSes visited
• Preferences - Audio settings, equipped items, display preferences
• Achievements - Progress and unlockables earned during use

2.3 Third-Party OAuth Information

If you sign in using OAuth (Google, GitHub, Discord, Reddit, Apple, or Microsoft), we receive:

• Your unique identifier from that provider
• Your display name or username (depending on provider)
• Your email address (if provided by the OAuth service)

We do not receive your password from OAuth providers.

3. Local Storage (Browser Data)

We use your browser's localStorage to store information locally on your device. This data never leaves your browser unless you choose to sync with our cloud service.

You may clear this data at any time by clearing your browser's storage for emulator.ca. This will reset your session to a new guest account.

4. Cloud Storage

If you create a registered account and use cloud sync features:

• Your data is transmitted over encrypted connections (HTTPS/WSS)
• Data is stored on servers located in Canada
• Files are associated with your user account and namespace
• Content hashes (SHA-256) are used for change detection and deduplication
• Data is isolated per user; you cannot access other users' data

5. Cookies

We do not use traditional browser cookies for tracking. Instead, we use localStorage for session management. However, third-party OAuth providers may set their own cookies during the authentication process.

6. How We Use Your Information

We use the collected information to:

• Provide and maintain the Service
• Authenticate users and manage accounts
• Save your progress, achievements, and preferences
• Enable cloud synchronisation across devices
• Provide multiplayer and communication features
• Improve and optimise the Service
• Respond to support requests

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We do not send marketing or promotional emails. If we ever introduce optional email updates, we will request express consent and provide an easy unsubscribe option.

7. Data Sharing

We may share your information only in the following circumstances:

• With Your Consent - When you explicitly authorise sharing
• Service Providers - With trusted providers who assist in operating the Service (hosting)
• Legal Requirements - When required by law, court order, or governmental request
• Protection of Rights - To protect our rights, privacy, safety, or property

8. Data Security

We implement appropriate security measures to protect your information:

• Passwords are hashed using Argon2id (a secure, modern algorithm)
• Data is transmitted over encrypted connections (HTTPS/WSS)
• JWT tokens are signed with HMAC-SHA256 and expire after 7 days
• Rate limiting protects against abuse (120 requests/minute default)
• All database queries use parameterised statements to prevent injection

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

9. Data Breach Notification

If we become aware of a data breach that poses a real risk of significant harm, we will notify affected users and report it to the appropriate privacy regulator, as required by Canadian law.

10. Data Retention

We retain your information as follows:

• Guest Data - Stored in your browser until you clear it
• Registered Account Data - Retained until you request deletion
• Cloud Storage - Retained until you delete files or request account deletion
• Log Data - Server logs are retained for up to 30 days for security and debugging purposes

If you request deletion, we aim to remove active account data within 30 days and remove data from backups within 90 days, unless legal requirements or security needs require longer retention.

11. Your Rights

Under Canadian privacy law, you have the right to:

• Access - Request a copy of your personal information
• Correction - Request correction of inaccurate information
• Deletion - Request deletion of your account and data
• Portability - Request your data in a portable format
• Withdraw Consent - Withdraw consent for optional data processing

To exercise these rights, please contact us using the information below. We will respond within 30 days.

12. Children's Privacy

The Service is not directed at children. If you are under the age of majority in your province or territory, you should use the Service only with the consent of a parent or guardian. We do not knowingly collect personal information from children without appropriate consent. If you believe we have collected information from a child without proper consent, please contact us immediately.

13. Third-Party Services

The Service integrates with third-party services:

• OAuth Providers - Google, GitHub, Discord, Reddit, Apple, Microsoft (for authentication)
• Google Fonts - For typography (VT323 font)

We load the VT323 font from Google Fonts. This may result in Google receiving your IP address and browser information when the font is requested.

These services have their own privacy policies. We encourage you to review them:

• Google Privacy Policy
• GitHub Privacy Statement
• Discord Privacy Policy
• Reddit Privacy Policy
• Apple Privacy Policy
• Microsoft Privacy Statement

14. International Users

The Service is operated from Canada. If you access the Service from outside Canada, your information may be transferred to, stored, and processed in Canada. By using the Service, you consent to this transfer.

Canada is recognised by the European Commission as providing adequate data protection for personal data transferred from the EU.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date and, where appropriate, providing additional notice. Your continued use of the Service after changes constitutes acceptance of the updated policy.

16. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, please contact:

Stephen Olesen
Email: privacy@emulator.ca
Website: slepp.ca

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.