Privacy Policy

Last updated: 21 September 2026 · Applies to magesticanstudios.com, all Magestican Studios games, and the Multi Game Madness app for iOS.

This policy explains what personal information Magestican Studios (a trading name of Ultra Task Pty Ltd, an Australian proprietary limited company, hereafter "we" or "us") collects, why, and how you can exercise your rights over it. This policy is written to satisfy the Australian Privacy Act 1988 (Cth) and, where our audience overlaps, the EU General Data Protection Regulation (GDPR).

Short version

• This website (magesticanstudios.com) is static. It has no login, no comment box, and no server-side code. It sets no cookies.
• We use Google Analytics 4 to count visits, configured so that it stores nothing on your device and cannot identify you (details below). It is the only third-party script on the site.
• Our games have no game server, and you never need an account to play. They report a small number of anonymous gameplay counts (which map and mode was chosen, how many AI bots, whether the match reached an end, phone or desktop) and nothing else.
• Saving your progress to an account is optional. If you use it, we store your game progress against an anonymous identifier — and, only if you choose to set an email and password rather than staying anonymous or using Google, your email address. Both are covered under "Accounts and saved progress" below. If you do not, your progress stays in your own browser exactly as it always has.
• The only personal information we hold about you is what you have voluntarily emailed us (e.g. a bug report, a press enquiry). We keep those emails only as long as needed to reply.

What we collect

On this website: nothing. The site is served as static files. Your browser makes a request; our host (a static file provider) receives the request and responds with a file. Our host may keep short-lived access logs (typically IP address, requested URL, user-agent, timestamp) for security and abuse-prevention purposes. We do not sell, rent, or share those logs, and we do not correlate them with any other information.

In our games: no personal information. Game saves and settings (world seed, player name, preferences) are written to your own browser's storage. They stay there unless you choose to save your progress to an account, which is covered in its own section below. Splatbarn is peer-to-peer: the other players' browsers see the name you type, we do not. What we do receive are the anonymous match counts listed under "Analytics" below.

When you email us: your email address and whatever you chose to send. We reply from the same address, retain the thread as long as needed to help you, and delete it afterwards.

Accounts and saved progress

You do not need an account to play anything we make, and you never will. Every game runs, saves and remembers your progress in your own browser with no account at all. What an account adds is one thing: the same progress on a second device, and a copy that survives clearing your browser data.

What we store if you use it. A single document holding your game progress: your chosen display name if you typed one, experience points, rank, streak counts, day numbers of when you played, how many times you have played and won each game, and your personal best lap times, race times, finishing positions and points for each Kartzoom circuit. That is the whole list, and it is enforced by the database itself — our security rules name every permitted field and reject a write containing anything else, including an email address, a message, or a reference to another player.

Who you are to us. By default, nobody. Playing signs you in anonymously: Google's Firebase Authentication issues a random identifier for your browser and we store the progress document against that identifier. It is not linked to a name, an email or a person, and we cannot tell who you are from it.

There are three ways to make that progress durable, and they differ in what they involve.

• Nothing at all. Stay anonymous. Progress lives in this browser and, if the anonymous identifier persists, in our database against a random id. We know nothing about you.
• Link a Google account. Google confirms to us that two devices are the same person. We do not store your email address, your Google profile or your name — the security rules above would reject them.
• Set an email address and password. In this case we do hold your email address, because it is how you sign in. See immediately below.

If you set an email and password. Your email address is stored by Google Firebase Authentication, which operates it on our behalf as our processor. It is used for exactly two things: identifying your account when you sign in, and sending a password reset link if you ask for one. We do not send marketing email, we have no mailing list, and we do not share or sell the address.

Your password is never seen by us. It goes from the form directly to Firebase Authentication, which stores only a salted hash (scrypt). It is not written to our database — the security rules above name every permitted field and a password is not among them — it is not logged, and there is no screen anywhere, including one only we can see, that could display it.

Your email is not in the progress document either. The two are held separately: Firebase Authentication holds the address, Cloud Firestore holds the progress, and the rules reject any attempt to write an email address into the progress document.

Google's own handling of authentication data is covered by the Google Privacy Policy.

Where it is stored. Google Cloud Firestore, in a project we control. Access is restricted to your own document: the rules permit a signed-in browser to read and write the one document belonging to its own identifier and nothing else, and there is no listing, no search, and no path by which one player can reach another player's progress.

Your game library. To show "Continue", "Recently played" and your favourites, this browser keeps a short list of which of our games you opened, on which day (a day number, never a time of day), how long each game was open, how many matches you finished and won, and which games you marked with a heart. It stays in your browser. If you have an account, the same list is copied to a private library entry next to your progress document so your other devices can show it. "Erase my progress" deletes it in both places.

Deleting it. The account panel in any of our games has an "Erase my progress" button. It deletes the stored progress document and your local copy, immediately — there is nothing to email us about and no waiting period. If you also want the email address itself removed from Firebase Authentication, email us at the address under "Contact" and we will delete the account outright.

What we do with it

• Emails: to reply to you.
• Host access logs: to detect abuse or diagnose site outages.
• Nothing else. We do not build profiles, we do not target ads.

Analytics

We use Google Analytics 4 to answer one question: which games and pages people find, and on what kind of device. We deliberately run it in its weakest configuration, because a studio that advertises "no tracking" and then fingerprints you is lying:

• No cookies and no stored identifier. Analytics runs with client_storage: 'none', so nothing is written to your browser and you are not recognised on a later visit. The trade-off is ours to wear: our "users" figure is really a "page opens" figure, and we would rather under-count you than identify you.
• IP anonymisation on. Google truncates your IP address before logging it. We never see it.
• Google Signals off, ad personalisation off. The data cannot be joined to an advertising profile and cannot be used to build an ad audience.
• No personal data in events. The measurement code refuses to send player names, room codes, peer ids, or email addresses — the filter is in the source at web-engine/visits/visits.js and is covered by an automated test.

The events we record are: a page view; play_click (someone followed a link to a game); game_start (map, mode, bot count, host or joiner, phone or desktop); and match_end (map, mode, duration, score margin, and whether the reporting player's team won). None of them carries anything about you.

Analytics is loaded from Google's servers, so Google receives the request. Google's handling of it is covered by the Google Privacy Policy. If you would rather send nothing at all, any content blocker or your browser's "Do Not Track"/tracking-protection setting will stop the script loading, and the site works exactly the same without it.

Cookies and similar technologies

This site sets no cookies of its own, and the analytics described above are configured not to set any either. Games store your settings (name, chosen map, volume) in your browser's own local storage; that never leaves your device and you can clear it at any time from your browser settings.

Third parties

Google, in two roles: analytics as described above, and — only if you choose to save your progress to an account — Firebase Authentication and Cloud Firestore, which hold the anonymous identifier and the progress document described under "Accounts and saved progress". The other game-support service a browser game needs is a WebRTC signalling broker, so two players' browsers can find each other; it carries no account, no profile and no name.

The site is hosted by a static-file provider (currently expected to be Cloudflare Pages or GitHub Pages) that operates under its own privacy policy. If you follow an external link from our site or games (for example, to a game's store page on itch.io or Steam) the destination site handles your data under its own policy.

Our apps for iOS

We publish two apps on the App Store: Multi Game Madness (rated 9+) and Multi Game Madness After Dark (rated 17+). Everything in this section applies to both. Every game is built into the app and served from inside your device, so each pack plays with no network connection at all — everything above this section describes the website instead.

• No account and nothing to sign in to. There is no login anywhere in either app.
• No ads, no in-app purchases, and no advertising identifier. The analytics SDK is compiled without advertising-identifier support, so there is no IDFA to collect and no App Tracking Transparency prompt — because there is nothing to ask you to allow.
• What the app records: which screens you open, which game you start, how long you spend in it, and if a game fails to load. Alongside that, Google Analytics derives a device model, an OS version and an approximate country from your IP address. None of it is linked to you and none of it is used to track you across other apps or websites.
• Saved progress stays on the device. Each game keeps its settings and progress in the app's own storage, exactly as it would in a browser. We never receive it.
• Game updates are downloaded from us. On launch the app asks magesticanstudios.com whether a newer version of any of its games has been published, and downloads the files that changed. That request is an ordinary web request, so our host sees what any web server sees: your IP address, the time, and which files you asked for. We do not build a profile from it, and there is no identifier in the request that says which installation you are. You can stop it entirely by turning off network access for the app in iOS Settings — every game still works, at the version the app shipped with.
• Online play works the same way as on the website: a WebRTC signalling broker introduces two devices to each other so they can talk directly, and it carries no account, no profile and no name.
• Camera and microphone are refused outright. The apps declare no camera or microphone permission and actively deny any request for one from game content. You will never see those prompts, and no audio or video is ever captured.

The apps' analytics data is processed by Google LLC under the Google Privacy Policy. The App Store itself is Apple's, and Apple handles your download and any App Store data under its own policy. The licence that governs the apps is Appendix A of our Terms of Use.

Children

Our games are suitable for a general audience but we do not knowingly collect personal information from anyone under 13.

Your rights

You can ask us:

• what personal information we hold about you (typically: none, unless you have emailed us);
• to delete any emails you have sent us;
• to correct any information we hold about you.

Send those requests to the contact address published on our website. If we ever store personal information subject to the GDPR, EU residents also have the rights to portability, restriction of processing, and to lodge a complaint with your national data protection authority.

Contact

Ultra Task Pty Ltd, Gold Coast, Queensland 4226, Australia — trading as Magestican Studios. ABN 93 700 712 910, ACN 700 712 910.

Email support@ultratask.com.au for anything in this policy, including a privacy request under "Your rights" above. It is a real inbox and a person reads it.

Changes to this policy

We will update this page if what we do with data changes, and bump the "Last updated" date at the top. Material changes (anything that broadens what we collect or how we share it) will also be flagged on the site's home page for a reasonable period.

This document is provided as-is and is not legal advice. Verify against a solicitor before relying on it for anything that would trigger a regulator.

← back to the studio