Security and privacy
The playtest is a small project run by one developer. This page describes what the site stores, who can see it and how your account is protected, in plain terms. It was last updated on 29 October 2026.
In short
- Your password is never stored. Only a one-way scrambled form of it is kept, so nobody can read it, the admin included.
- Your email address is visible only to the admin. Other testers see your display name.
- There are no ads, no analytics and no tracking scripts, and your data is never sold or shared.
- The Report an Issue tool only sends anything when you click its button. Before that, everything stays on your PC.
- You can delete your account and personal data yourself at any time.
Your password
- Passwords are stored only as a salted PBKDF2-SHA256 hash with 100,000 rounds. This is a one-way function, so the password cannot be worked back out of what is stored. Each account has its own random salt, so two people with the same password get different hashes.
- Passwords are never written to logs or sent anywhere other than the sign-in request, which always goes over HTTPS.
- Forgot your password? Ask the admin for a reset link. A reset link works once, expires after three days, and replaces any earlier link. Your old password keeps working until you use it. Setting a new password signs you out on every other device.
- Use a password that you don't use anywhere else. That protects you on this site and on every other site.
Signing in
- When you sign in, your browser gets a random 256-bit session key in a cookie. The cookie is marked
HttpOnly(scripts on the page cannot read it),Secure(HTTPS only) andSameSite(other sites cannot use it). The server keeps only a hash of the key, so even a copy of the database would not let anyone sign in as you. - A session lasts 30 days. Signing out ends it straight away. Changing your password signs out your other devices.
- After 8 wrong passwords for one email address within 15 minutes, sign-in for that address pauses for 15 minutes. This stops anyone guessing passwords. The site answers the same way whether or not an email address has an account.
- Every request that changes something must carry a header that other websites cannot add. This blocks forged requests from other sites (cross-site request forgery).
- The pages use a strict Content Security Policy, cannot be framed by other sites, and are kept out of search engines. Markdown in reports and comments is cleaned with DOMPurify before it is shown, so posts cannot run scripts.
Invites, applications and links
- Accounts can only be created with a one-time invite link. The database stores only a hash of each link, so a link cannot be recovered from the database. Every link expires, and it stops working as soon as it creates an account.
- When you apply, you get a private status link. It is stored the same way, as a hash only. If you're accepted, the same link becomes your invite.
- Your IP address is not stored. To limit spam on the application form and the issue tool, the site keeps a fingerprint of it made with a secret key (an HMAC). Without that key, the fingerprint cannot be turned back into the address.
What is stored, and who can see it
| Data | Who can see it |
|---|---|
| Email address | You and the admin. It is used to sign in and is never shown to other testers. |
| Display name | All testers, on your reports and comments. |
| Password | Nobody. Only a one-way hash is stored. |
| Reports, comments and attachments | All signed-in testers. You can edit your own reports and delete your own files. |
| System information on a report | All signed-in testers. It is only what's shown in the form (Windows version, CPU, memory, graphics card and driver, screen size and game build), and you can edit or remove any line before you send. |
| Applications | The admin only: every answer you gave on the form. They're used to pick testers. If you join, your application stays linked to your tester account, so the admin can see it next to your account (for example, which PC you test on). Other testers and applicants never see it. |
| Account dates | The admin: when you joined and when you last signed in. |
Nothing on the site is public except the name and date of the newest build, which the game checks for (see Game downloads). Every page except sign-in, applying and this one needs an account.
The Report an Issue tool
- It ships next to the game. While you play, it waits in the background and keeps the logs of your recent game sessions on your PC (the newest 20). It sends nothing on its own.
- If the game crashes, it asks whether you want to report it. Only when you click the button does it upload that
session's game logs (
openxcom.log,godot.log), any crash dump, and the system information listed above. It then opens the report form so you can describe what happened. - Game logs can include file paths on your PC, which may contain your Windows user name. Crash dumps contain part of the game's memory at the moment of the crash (game data, not your files). Once a report is posted, you can delete any of its attachments.
- An upload that never becomes a report is deleted after 14 days.
Game downloads
- Builds are kept in a private Google Cloud Storage bucket with public access blocked. When a signed-in tester clicks Download, the site creates a personal download link that expires after six hours.
- Each build lists its SHA-256 checksum, so you can check that the file you downloaded hasn't been changed.
- When the game starts, it asks the site which build is the newest, and tells you if yours is older. That request carries nothing about you, your account or your PC, and the site keeps no record of it. Turn it off in the game: Options, Advanced, 3D, "Check for new playtest builds".
Where it runs
- The site, its database and attachments run on Cloudflare (Pages, D1 and KV). Game builds are stored on Google Cloud Storage in the US.
- Like any web host, Cloudflare handles the network traffic and may keep short-lived request logs for running and protecting its service.
- The pages load no outside scripts, fonts or trackers. Everything comes from this site.
Removing your data
- Testers: go to your account page (your name at the top) and choose Delete my account. This deletes your email address, display name, password and sessions, your application if you applied through the site, the PC information on your reports, and the logs, crash dumps, text and config files you attached.
- Your reports and comments stay on the board, because others are working from them. They are shown as by "Deleted tester", with any screenshots and saves you attached.
- Applicants: open the status link you got when you applied and choose Withdraw and delete my application. That deletes the application, including your contact and PC details.
- If you can't sign in any more, ask the admin, who can delete your account in the same way.
Being straight about it
This is a hobby project, not a company, and it has not had a professional security audit. It follows standard practice for small sites, as described above.