Privacy Policy
Last updated 10 October 2026
- You can play without an account. Then nothing about you is saved on our servers.
- If you sign in with X, we keep your X ID, handle, display name and profile picture, plus your runs.
- Your handle, name, picture and best runs are shown publicly on the leaderboards.
- No ads, no analytics, no tracking cookies. We never sell your data and never post on X for you.
- Ask us any time to delete your account and runs.
1. Who we are
Meteora Run is a free browser game, available at meteora-run.vercel.app and as an Android app that opens the same game. It is made and run by Michael Zogot ("we", "us"), who is responsible for the data described here (the controller under the GDPR).
Contact: michaelzogot@gmail.com or @MichaelZogot on X.
2. Playing without an account
When you play as a guest:
- On your device only: your settings (sound, volumes, chosen runner, whether you've seen "How to play") and your best distance are kept in your browser's local storage. A finished guest run waits in session storage so it can be saved if you sign in right after. The game's files are cached so it opens offline. None of this is sent to us.
- Hosting: like every website, our host (Vercel) receives your IP address, browser type and the pages you request, keeps short-lived server logs and uses them to protect the site against abuse. We don't store your IP address in our database.
- Fonts: the game's font is loaded from Google Fonts, so Google receives your IP address when the game loads.
3. Signing in with X
Sign-in uses X's official login (OAuth 2.0). We ask X only for read access to your basic profile
(users.read, tweet.read). We receive and store:
- your X user ID, handle, display name and profile picture link;
- when your game profile was created and last updated.
We never see your X password or email address, never read your direct messages and never post anything for you. "Share" buttons only open X with a pre-written post that you can edit or discard.
We set two cookies, both needed for sign-in and neither used for tracking: mr_session keeps you
signed in for up to 30 days, and mr_oauth lasts 10 minutes during the login itself.
4. Your runs and fair play
When you're signed in, each finished run is sent to us and saved with:
- distance, coins, duration and the time it was played;
- the run's seed and the list of moves you made (left, right, jump, slide and when), so our server can replay the run and confirm the score is real;
- anti-cheat evidence: regular timing check-ins sent while you play, how often and how long you paused, whether your browser reported automated or script-generated input, and simple account facts (how old your game profile is, how many runs you saved in the last hour, your previous best).
We use this to verify scores, build the leaderboards, award badges and spot cheating. A suspicious run may be reviewed by an operator, hidden from the leaderboards, or lead to a ban. No automated decision has any effect beyond the game.
5. What other players see
The leaderboards (today, this week, all time) and ranks are public. They show your X handle, display name,
profile picture, best distance and coins. Profile pictures are loaded from X's servers (pbs.twimg.com).
6. Why we're allowed to use your data
For players in the EU/EEA and UK, the legal bases (GDPR Art. 6(1)) are:
- providing the game you asked for (b): sign-in, saving runs, leaderboards and badges;
- our legitimate interests (f): keeping the site secure, fair leaderboards and preventing cheating and abuse.
7. Who processes data for us
| Service | What for |
|---|---|
| Vercel Inc. (USA) | Hosting the game and its server functions, server logs, firewall |
| Neon (Databricks, Inc., USA) | The database with profiles and runs |
| X Corp. (USA) | Sign in with X, profile pictures |
| Google LLC (USA) | Web fonts |
Some of these process data in the United States. Where required, transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
8. How long we keep it
- Your profile and runs: as long as your game profile exists, until you ask us to delete them.
- Sign-in cookies: up to 30 days, or until you sign out.
- Hosting logs: for the short period set by Vercel.
- Data on your device: until you clear your browser's site data or uninstall the app.
9. Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. To delete your account and all your runs, email michaelzogot@gmail.com or message us on X. Your handle, name and picture update from X each time you sign in. You may also complain to a data protection authority.
10. Children
Sign-in requires an X account, which X allows from age 13. Don't sign in if you're under 13 (or under the age of digital consent where you live) without a parent's permission.
11. No blockchain, no wallet
Meteora Run doesn't connect to a crypto wallet and doesn't read or write anything on a blockchain. In-game coins are points only.
12. Changes
If this policy changes, we'll update this page and its date. Significant changes will also be mentioned in the game's "What's new".