Privacy

Last updated: 28 October 2026

This website is a plain information page about the game VSA – Versatility. Its public pages set no cookies, use no analytics and no tracking, and load nothing from other companies: the fonts and pictures come from this site itself. The one exception is the account page, described under Accounts below.

Who runs this site

Jerome Ulken, Switzerland, reachable at [email protected] (see also the legal notice).

Hosting

The site is hosted on Cloudflare (Cloudflare, Inc., USA). To deliver the pages and protect the site against attacks, Cloudflare processes technical data of every visit, such as your IP address, your browser and the page you asked for, and may keep it in its logs for a short time. Cloudflare runs a worldwide network, so this data can be processed outside Switzerland and the EU, including in the USA. Details: Cloudflare's privacy policy.

Accounts

On the account page you can create an account for the game. You create it with your e-mail address: we send you a one-time code by e-mail. After that you can sign in with such a code, or set a password and sign in with your e-mail address and the password.

Passwords: setting one is optional. If you set a password, it never leaves your browser in readable form: your browser scrambles it first (600,000 rounds of a slow, one-way calculation), and the site stores only a further scrambled form of that (hashed, with a random salt), from which the password cannot be read back. When you choose a new password, your browser checks it against Have I Been Pwned, a public list of passwords from known data breaches: it sends only the first 5 characters of the password's SHA-1 hash (a one-way fingerprint) and compares the answer itself (k-anonymity), so the password is never sent. When you set or change your password, all other browsers are signed out and we send you an e-mail about it.

What is stored: your e-mail address, the player name you choose, your account's id and dates (when it was created, when you last signed in), the scrambled form of your password if you set one, your sign-ins on this website (including whether each used a code or a password), the game PCs and Server Consoles you sign in with (their kind, when they were signed in and last used), your game keys and which edition of the game you own. While a game sign-in waits for your Allow (at most 10 minutes), the country it was started from, as Cloudflare reports it, is kept so that the page can show it to you. Sign-in codes and sign-in tokens are stored only in a scrambled (hashed) form. To limit how many codes one address can ask for, and how many wrong passwords can be tried for it, the codes per day and the wrong passwords per hour are counted under a scrambled form of the address, for a few days.

What for: to let you take part in the beta, to sign the game in, and so that other players in multiplayer know who you are.

Who processes it: Cloudflare hosts the site and the account database. Emailit (FunFirst s.r.o., Prague, Czech Republic) sends our e-mails (the sign-in code, the password reset code, and the notice that your password was changed): it receives your address and the e-mail's content and keeps them in its sending log, in its own data centre in the EU. Have I Been Pwned receives, only when you choose a new password, the 5-character start of the hash described under Passwords, straight from your browser (like any web request, this also shows it your IP address); its answer goes only to your browser. Game servers you join receive your account id and your player name, never your e-mail address.

What is not stored: no readable passwords, no IP addresses (we store none; Cloudflare's own logs are described under Hosting), no analytics, no payment data.

The sign-in cookie: signing in sets one cookie, __Host-vsa_session. It is strictly necessary to keep you signed in and holds only a random sign-in token. It ends 30 days after your last visit, or when you sign out.

Spam protection: the sign-in form is checked by Cloudflare Turnstile, which tells people from bots. For this, Cloudflare processes technical data of your browser and your visit. The check is loaded only on the account page, and only while you are signed out.

How long: until you delete your account. Sign-ins end by themselves 30 days after your last visit. After a deletion, the database's backups still hold the data for up to 7 days; Emailit's sending log keeps the e-mails it sent for its own retention period.

Deleting your account: press Delete my account on the account page, or write to the contact above. This removes your e-mail address, your player name, your password and your sign-ins at once.

Beta area

The beta area (vsa-p.com/beta/) is open to signed-in accounts that own the game (a game key). It uses the same account and sign-in cookie described under Accounts; nothing else is stored for it.

Downloads and updates

The installer and the game's updates are downloaded from updates.vsa-p.com, which Cloudflare delivers in the same way. Each download carries a short-lived signed pass that names your account id, so only accounts that own the game can download; the pass holds no e-mail address. The installed game contacts the same address to check for updates.

Your rights

Under the Swiss Federal Act on Data Protection (FADP), and under the GDPR if you are in the EU, you have the right to know which personal data about you is processed and to have it corrected or deleted. For any question, use the contact above.