Site privacy

What this site collects

Nothing, unless you make an account. Reading a page collects nothing at all: there is no analytics, no tag manager, no pixel, no A/B tool and no cookie, and nothing is sent anywhere while you read. This is why there is no cookie banner: the site sets no cookies. An account is the one exception, it is optional, and section 02 describes it.

One thing is kept in your browser, and only if you ask for it. Pressing the theme button at the top of the page saves your choice of the light theme in your browser’s local storage, under the name “lacunate-theme”, so that the next page you open is light as well. Switching back to dark removes it again. It is one word; only this site reads it and it is sent nowhere, and it is not a cookie. If you never press the button, nothing is written at all. The Account page is the one page that writes anything else in your browser, from the moment it opens; section 02 lists what.

Nothing is fetched from a third party while you read. The typefaces are served from this site rather than from Google Fonts, specifically so that reading a page here does not hand your IP address to another company. There is no CDN, no embedded video and no font call. The Account page is the single place on this site where something can be loaded from another company, and only if you use it; section 02 says exactly when.

If you make an account

An account is optional. Nothing on this site is behind it. You can sign in with Google, or with an e-mail address and a password you choose on the page. An account is used to sign in, manage user preferences (theme, visibility, artist profile), and configure security settings (two-factor authentication, backup codes).

What is kept. If you sign up with an e-mail address: that address and a password. The password goes from your browser straight to Firebase Authentication, a Google service, and is kept there only as a hash — the studio never receives it in readable form and cannot look it up, which is also why a forgotten password can be reset but never retrieved. If you sign in with Google: the e-mail address, the name and the profile photo link on your Google account, as Google passes them on. In both cases there is also an account number that identifies the account, the sign-in method, whether the address has been confirmed, and the times the account was created and last used. All of that is held by Firebase Authentication. The static site pages do not maintain a separate profile database.

What Google receives. Google answers the sign-in requests, so your IP address reaches it with them, as it does with any request to any server. If you sign in with Google, a Google window opens and Google’s own privacy policy applies inside it.

Why and legal basis. So that you can sign in, confirm your e-mail address, reset a forgotten password, and delete the account. Under KVKK Art. 5/2-c (contract performance) and 5/2-f (legitimate interests); under GDPR Art. 6(1)(b) and 6(1)(f). Your data is never sold, tracked, or used for advertising or profiling.

What is stored in your browser. Firebase Authentication stores your session in the browser's IndexedDB inside "firebaseLocalStorageDb" (falling back to local storage if unavailable). When signed in, local storage may also hold "lacunate_auth_user" for navigation session recognition, "lacunate_user_settings_{uid}" for local user preferences, and two-factor authentication state; session keys are removed upon sign-out or account deletion. Opening the page also initializes "firebase-heartbeat-database" for SDK version checks. The atelier (/atelier/) page does not keep persistent tracking keys. None of these are cookies, and none are used for advertising or tracking.

The one thing loaded from outside. Firebase’s Google sign-in cannot work without a script from Google (apis.google.com). On this page it is not loaded when the page opens: it is loaded the moment you press the Google button, and again if you are asked to confirm who you are with Google before an account is deleted. It is never loaded at any other time. At that same moment the page also opens a hidden window on Google’s own Firebase address for this project, galaxy-merge-41d09.firebaseapp.com, which is what carries Google’s answer back to the page. Those two together are the only exception on the whole site to serving everything from here, and they are allowed on the Account page alone.

The two messages. Confirming your address and resetting a forgotten password both work by sending you a link. Those messages are produced and sent by Firebase Authentication; this site never sends them itself. The address they come from, and the address the link first opens, are set once for the whole Firebase project that this site and Galaxy Fusion share, and they are on the domain galaxy-merge-41d09.firebaseapp.com or lacunate.com; the link then brings you back to the Account page here. Both kinds of message count against a daily limit that the game shares, which is why the button that sends the confirmation link again waits a minute between presses.

The same account as Galaxy Fusion. The site and the game share one sign-in system, so an account made here is also a game account and carries the same account number in both. If you later open Galaxy Fusion with it, the game writes a player record under that number which anyone on the internet can read, without signing in. That record holds a player name — your Google name if you signed in with Google, otherwise the part of your e-mail address before the “@” — the link to your Google profile photo if you have one, and game figures such as your score, level and dates. You can change the name inside the game. Signing in here writes no such record; opening the game does.

Abroad. Firebase Authentication runs on Google servers that may be outside Türkiye, so data is processed on Google's infrastructure as an inherent part of this service.

Keeping, deleting, and data portability. An account is kept until you delete it via the Delete button on the Account page; upon deletion, authentication records are permanently removed. You can instantly export all your stored profile and security settings in JSON format via the "Export My Data" button on the Account page. If a game save exists, it must first be removed from within the game before the account can be deleted.

Children. An account is not intended for anyone under 13; users aged 13–18 require parental or guardian consent. The site does not ask your age and has no way to check it. A parent can always request deletion of a child’s account at the address below.

Your rights. Data controller: LACUNATE (Türkiye). To ask for a copy of what is held, a correction, or deletion (KVKK Art. 11, GDPR Art. 15-20), write to support@lacunate.com. Nothing here asks you to accept anything: this is a description of what happens, and it is on this page whether you make an account or not.

If you email

The site lists three addresses: galaxyfusion@lacunate.com, support@lacunate.com and business@lacunate.com. Mail sent to them is read by one person. It is kept as long as it is useful and is not added to a mailing list, not sold and not shared. There is no newsletter to unsubscribe from because there is no newsletter.

Clicking an address sends nothing from this site. The address itself opens whatever handles email on your device, and nothing goes anywhere until you send it. The “Open in Gmail” link next to it takes you from this site to Google (mail.google.com) instead: Google sees the recipient, the pre-filled subject and text, your IP address and your Google session, and if you are not signed in to Google, its sign-in page comes first. It does not see the page you came from, because the link does not pass it on. From then on Google's privacy policy applies.

There is no supporter list

This site publishes no supporter list, no thank-you wall and no ranking — and none is planned. One was planned once; it was removed. The reason is twofold: appearing on a list means receiving something in return, and that runs against both the app stores' rules and this site's own position.

So there is no supporter data here to store, publish or take consent for. The support page collects nothing.

If someone writes offering to send something, it stays a message between two people: no name is written down anywhere, added to any list, or shown on the site. The email itself is held as described in the section above.

Hosting

The site is served by Firebase Hosting, a Google service. Like any web server, it processes the requests it receives in order to answer them.

Sign-in on the Account page is handled by Firebase Authentication, another Google service, described in section 02.

Questions about any of this: support@lacunate.com