Privacy

There are no accounts here, so there is not much to tell — but what there is, is written out in full. This describes what the site actually does, checked against the code that does it.

Last updated 22 August 2026

The short version

We never ask for your email, and we never read the one Stripe collects to send your receipt.
There is no analytics, no tag manager, no advertising pixel and no session recorder on this site. Nothing about your visit is measured, which is why there is no cookie banner: there is nothing to ask you to consent to.
The one thing you give us is a display name, and you give it to us in order to have it published. On a grave it is permanent.
Your IP address is used to stop abuse and for nothing else. It sits in a counter that deletes itself — within a minute for most limits, within an hour for the one that bounds free smacks — and it is never stored beside a purchase.
Because we cannot identify you, we cannot get your smacks back if you clear your browser. That is clause 08, and it is the real price of everything above it.

Everything this site collects

Four things, and these are all of them. Each says why it exists and when it goes away.

Your display name

What: Whatever you type into the “Your name or @handle” box on Stripe’s checkout page. It passes through a profanity and Unicode filter before it is stored, which can change or reject it.
Why: It is the product. It appears in the live feed as you hit, on the damage leaderboard while the boss stands, and — if you land the killing blow — on that boss’s grave. See clause 04.
Lawful basis: Performance of a contract: we cannot deliver what you bought without publishing it. Keeping it on a grave afterwards rests on legitimate interests — a graveyard that forgets is not a record of anything.
Kept for: In your wallet, 180 days from your last purchase or last paid smack. In the live feed, until 100 newer hits push it off that boss’s list. On a leaderboard, for the life of that boss, then frozen with its grave. On a grave, permanently.

Your IP address

What: The address your request arrives from. We do not ask for it; every request on the internet has one.
Why: Rate limiting, and nothing else. It is what stops one machine minting endless free smacks or hammering our payment endpoint. It is never attached to a purchase, a wallet, a display name or a hit.
Lawful basis: Legitimate interests: keeping a small site standing up, and bounding what free play costs us.
Kept for: The length of its own window and no longer — one minute for most limits, one hour for the free-smack limit. The counter holds timestamps and nothing else, and the database deletes it on its own. An IP also appears in a log line when a request is actually refused, and in the ordinary access log of the web server in front of the API; both are capped at three files of ten megabytes and roll over.

A visitor id

What: A random id your browser generates on its first visit and keeps in localStorage. It is not derived from anything about you, your device or your browser. It is not a fingerprint.
Why: Two things, both of them mechanics you can see on the page. It counts your three free smacks, so that the fourth one asks you to pay. And for 60 seconds after you hit, it is what makes you one of the players in MOMENTUM — the multiplier counts distinct hitters, so it has to be able to tell two people apart from one person hitting twice. A paid hit uses your wallet handle for that instead.
Lawful basis: Legitimate interests, and strictly necessary for a feature you asked for by pressing the button. It is not used to build a profile, and it is not read outside those two counters — but it is fair to call it what it is: for a minute at a time, it is what distinguishes you from the next player.
Kept for: 30 days on our side for the free-smack counter, then it expires. The MOMENTUM window holds it for 60 seconds and drops it. In your browser, until you clear your site data.

Your wallet

What: A signed handle stored in your browser that is your smacks. Against it we hold: how many smacks are left, your display name, which of our two sites it belongs to, when it was created, and the id of the Stripe session that funded it. No email, no card, no name but the one you chose.
Why: There are no accounts and no passwords, so this handle is the only thing that knows which browser’s smacks are which. It also stands in for you in the MOMENTUM window when you hit with a paid smack, the same way the visitor id does for a free one, and for the same 60 seconds.
Lawful basis: Performance of a contract. The Stripe session id is additionally kept as the record of a sale.
Kept for: 180 days from your last purchase or last paid smack — spending keeps it alive. The session id outlives it, at 720 days: it is the guard that stops one payment ever being credited twice when somebody reopens an old receipt.

What we do not collect

This list carries as much weight as the one above it, so it was checked in the code rather than assumed.

No email address. Stripe collects one on its own checkout page, to send your receipt and to run its own fraud checks. We never ask for it, and our code deliberately never reads it back — a Stripe session id travels in browser history and in screenshots, and nobody holding that string should be able to turn it into somebody’s email.
No card details, ever. You are on a page hosted by Stripe when you type them. They never touch our servers.
No analytics and no trackers. No Google Analytics, no tag manager, no advertising pixel, no heatmap, no session recorder, no A/B tool. Nothing counts your visit, and nothing follows you off this site.
No third-party assets. The display typeface is downloaded when the site is built and served from our own domain, so your browser never calls Google for it. Loading a page here fetches from exactly two hosts — this site and our own API — and from nowhere else. Links you choose to press are the obvious exception: the share buttons hand you to whichever site you picked, and that site sees you arrive, the same as any link anywhere.
No real name, address, phone number, date of birth, location, contacts, device fingerprint, or anything else not listed in clause 02. We buy no data about you from anybody, and there would be nothing to match it against if we did.

Your display name is public, and on a grave it is permanent

This is the part people are most likely to be surprised by, so it gets its own clause. The name you type at checkout is not a profile field. It is published — in the feed while you hit, on the leaderboard while the boss lives, and on the grave forever if yours is the last smack.

Treat the box as a billboard. Do not put your real name in it unless you are content to see your real name on a public page indefinitely, and do not put an address, an email, a phone number, anything private, or anything about another person into it. An engraved name can be removed on request (clause 09) — but it will have been public in the meantime, and other people’s screenshots and search-engine caches are not ours to erase.

Cookies, and what sits in your browser

This site sets no cookies at all until you buy something.

One cookie, and only after a purchase: vm_credit_token, set by our API when Stripe sends you back, lasting 30 days. It holds the same wallet handle that is already in your browser storage, as a second way of handing your own smacks back to you. It is read for nothing else, and it identifies a wallet rather than a person.
Browser storage, on your device, sent nowhere except to our own API: your wallet handle, your last known balance, your display name, how many free smacks you have left, your visitor id, and whether you muted the sound.

Every item of it is yours to delete from your browser without asking us — which is also the warning in clause 08.

Who else sees any of this

Four companies, for four specific jobs, and nobody else.

Stripe takes the payment, and collects your display name and an email on its own hosted page. Stripe’s privacy policy governs everything that happens there.
Vercel serves this website and keeps its own request logs for the pages it serves. Vercel’s privacy policy.
BackupCity, Ljubljana, Slovenia rents us the machine the game API and its database run on. They do not process any of it for purposes of their own.
Anthropic names bosses. When a new one spawns we may ask a model to choose between the names our own generator produced and to write its lore. That request contains the boss’s number, tier, silhouette, hit points and modifiers — no user data of any kind. If it fails, the boss keeps its procedural name and nobody notices.

Nothing is sold, rented, shared with advertisers or handed to data brokers. There is no advertising on this site to sell it to. We would disclose something if a court in Slovenia ordered us to, which has not happened.

Stripe and Vercel are US companies, so data reaches the United States. We rely on the safeguards those two publish for their own services, and we have no separate arrangement with either of them.

Keeping it safe

Everything travels over HTTPS. Card details never reach us. Wallet handles are cryptographically signed, so one cannot be guessed or edited into somebody else’s smacks, and the database holding them is not reachable from the internet.

We are not going to claim a certification we do not hold or an audit we have not had. This is a small site run by a small operation, and the most useful thing it does for your privacy is the thing in clause 03: it does not collect the data in the first place.

The other side of having no accounts

Not knowing who you are is what makes this page short. It is also what makes the following true, and it is the single most important sentence here:

If you clear your site data, use private browsing, switch browser or device, or your browser evicts its own storage, your unspent smacks are gone and we cannot restore them. Not because we will not — because there is no email, no password and no account to prove they were yours. A Stripe receipt shows that a payment happened; it cannot show us which browser the smacks belong to.

The same rule is in the terms, clause 06. Buy on the browser you actually intend to play on, and do not buy a large pack you plan to spend slowly.

Your rights, and how to use them

You can ask for access to what we hold about you, correction of it, erasure of it, restriction of how it is used, and a portable copy of it — and you can object to any processing we do on the basis of legitimate interests. You can also complain to a data protection authority: the one in Slovenia, or the one where you live.

Write to ziga@flisko.si and a person will read it. Say plainly what you want done.

One honest catch. There is no account, so we cannot look you up by “you”. To find anything, we need something we can search on: the display name you used, or the Stripe session id from the address bar of your receipt page. Without one of those we genuinely hold nothing we can identify as yours — which is a consequence of collecting almost nothing, not an excuse for ignoring you.

Removing a name replaces it with [removed] everywhere it appears: the feed, the leaderboard, the grave. The boss, the damage and the grave itself stay, because they record an event rather than a person. A removal is not a refund — the smacks were delivered.

There is no automated decision-making here and no profiling of any kind. Nothing on this site is aimed at children; if a name on it belongs to one, write to us and it comes off.

Who to write to

The controller of everything described above is Flisko — Informacijske storitve, Žiga Flis s.p., in Slovenia. Every question, request and complaint goes to the same place: ziga@flisko.si. The contact page says what to include and how long a reply takes.

If this page changes, the date at the top changes with it, and the version published here at the time is the one that applies.

Worth repeating, because the whole site rests on it: there are no prizes and no payouts of any kind. You are buying swings at a piñata and the chance to have a name carved on its grave. Nothing of value is ever won here — and nothing about you is worth anything to us, because we did not collect it.