Privacy Policy
Effective October 18, 2026 · Odd Omens LLC, Minnesota, USA
The short version. Salvo is a free browser game run by Odd Omens LLC. To run your account and keep matches fair and safe, we keep your username, a scrambled (hashed) copy of your password, your birth month and year (to check you're old enough), your game progress, what you write in chat and messages, and the IP addresses you play from. We don't ask for your real name, email address or phone number. We don't sell your information, and we don't use ads, analytics or tracking. You can delete your account at any time in Settings.
1. Who we are
Salvo (salvo.oddomens.com, "the game") is operated by Odd Omens LLC, a Minnesota limited liability company ("we", "us"). We decide how your information is used, which makes us the "controller" under European data protection law. To contact us about privacy, email support@oddomens.com.
2. What we collect
Information you give us
- Account: your username (and earlier usernames, if you change it) and your password. We never store the password itself. We keep a salted, one-way scrypt hash, which can check a password but can't be turned back into one.
- Age check: your birth month and year. We don't ask for the day. If you're under 13, no account is created and nothing you entered is kept.
- Agreement records: which version of the Terms of Service and Privacy Policy you accepted, and when.
- What you write and make: chat in matches, private messages to other players, friend requests, class names, reports you send about other players, and maps you make in the Map Maker.
- Choices you make: your loadouts, operator appearance and settings, and whether your name shows on the public rankings.
Information collected when you play
- Game data: XP, levels, unlocks, stats (kills, deaths, accuracy and so on), match history, Outbreak survivors and stash, and in-game items.
- IP addresses you connect from, with when we first and last saw each one.
- Sign-in sessions: when each session started and was last used, and your browser's user-agent text (the browser and device type it reports), so you can recognise your sessions.
- Fair-play signals: gameplay patterns our anti-cheat flags for review (for example, aim that looks automated), with the match they happened in.
- Server logs: technical records of requests and errors, which include IP addresses, usernames and security events such as failed sign-ins.
Information stored in your browser
We use one cookie, salvo_rt. It's a sign-in token that keeps you signed in for up to 30 days. It's strictly necessary for signing in, is only sent to our sign-in endpoint, and can't be read by scripts. The game also saves your settings and a few conveniences (such as the last menu tab you used and players you've muted) in your browser's local storage. None of this is used for tracking or advertising, and nothing is shared with third parties.
What we don't collect
We don't collect your real name, email address, phone number, postal address, payment details, precise location, contacts, camera or microphone. The game has no ads, no analytics and no third-party trackers, and its fonts and files are served from our own server.
3. How we use it, and why we're allowed to
| What we do | Why (legal basis, where the GDPR or UK GDPR applies) |
|---|---|
| Check that you're old enough to play (birth month and year), and keep a record of the Terms and Privacy Policy versions you accepted and when | Legal obligation (child privacy laws), and our legitimate interest in being able to show what you agreed to |
| Create and run your account, sign you in, save your progress, match you into games, show stats and rankings, deliver chat, messages and friend requests | To provide the game you signed up for (performance of a contract) |
| Keep the game secure: rate limits, blocking password guessing, protecting accounts, finding and fixing problems | Our legitimate interest in a safe, working service |
| Keep matches fair and the community safe: anti-cheat, handling reports, moderation, bans (including by IP address), stopping ban evasion and abuse | Our legitimate interest, and that of other players, in fair and safe play |
| Show your name on the public rankings | To provide the game; you can hide your name in Settings → Privacy |
| Keep records we need to deal with legal claims or meet legal obligations | Legal obligation, or our legitimate interest in protecting our rights |
We don't use your information for advertising, we don't build marketing profiles, and we don't make decisions with legal or similarly significant effects about you by automated means alone. Anti-cheat flags are reviewed by a person before anyone is banned for them.
4. Who can see it
- Other players see your username, rank, operator, in-game stats, chat messages and match scores. Your rankings entry shows "Hidden Player" if you turn that off. Private messages are seen only by you and the person you message.
- Our moderators and admins can see account details (including your birth month and year, and whether and when you accepted the Terms and Privacy Policy), reports, chat attached to reports, fair-play flags and moderation history so they can enforce the rules. Only admins can see IP addresses.
- Service providers who run parts of the service for us, under their own security and privacy terms:
- OVHcloud hosts our server in the United States (Virginia). All game data is stored there.
- Cloudflare provides DNS for our domain. It answers lookups for the game's address but doesn't carry game traffic.
- CrowdSec is security software on our server that blocks attacks. When an IP address carries out an attack (for example, password guessing or scanning for weak spots), that address and the kind of attack are shared with CrowdSec's community threat-intelligence service. Normal play doesn't trigger this.
- Signal, an encrypted messaging app, is how the game sends its owner private alerts about security events. Those alerts can include a username or IP address.
- Legal reasons: we may disclose information if the law requires it, or where it's reasonably necessary to protect someone's safety, investigate fraud or abuse, or defend our legal rights.
- If the business changes hands: if Odd Omens LLC or the game is sold or merged, player information may pass to the new owner, who must respect this policy or tell you about changes.
We do not sell your personal information, and we don't "share" it for cross-context behavioural advertising, as California law (CCPA/CPRA) uses those words.
5. How long we keep it
| Information | Kept for |
|---|---|
| Account, birth month and year, agreement records, progress, stats, settings, friends, private messages, map drafts | Until your account is deleted, by you or by us under the Terms |
| Age-check answers that show someone is under 13 | Not kept: no account is created |
| IP addresses linked to your account | 90 days after we last saw each address |
| Sign-in sessions | Until they expire (30 days) or you sign out everywhere |
| Inbox mail from the game | Shown for 90 days |
| Game server progress journal (XP events, used to recover progress after a crash) | 30 days |
| Reports about players, and the chat attached to them | As long as needed for moderation. If the account that sent or received a report is deleted, the link to that account is removed, but the report text and the names in it stay. |
| Moderation and admin action records, bans (including IP bans and chat bans) | As long as needed to enforce the rules and prevent ban evasion |
| Server logs | Rotated automatically; usually a few days to a few weeks |
| Backups | The 14 most recent nightly backups (about two weeks); older ones are deleted |
6. Deleting your account
You can delete your account at any time in Settings (your password is needed to confirm), even if you decline updated Terms. Our admins can also delete accounts, for example accounts of children under 13 or accounts removed under the Terms. Deletion permanently removes your account and the information tied to it: your profile, birth month and year, agreement records, progress, stats, match history, items, friends, private messages, map drafts, Outbreak survivors and linked IP addresses. A few things last a little longer, as listed above: report records (with the link to your account removed), moderation records, server logs, and backups until they rotate out (about two weeks). Maps you made that were published in the game may stay in the game under the licence in our Terms. If you can't sign in, email us from a channel we can verify, and we'll help.
7. Your rights
Depending on where you live (for example, the European Economic Area, the UK or California), you may have the right to:
- access the personal information we hold about you and get a copy, in a portable format where that applies. You can download it yourself any time in Settings → Privacy → Your data (a JSON file of everything tied to your account, without password or sign-in token hashes);
- correct information that's wrong;
- delete your information (most of it you can delete yourself, in Settings);
- object to or restrict some uses, such as those based on our legitimate interests;
- complain to your data protection authority (in the EU, your local supervisory authority; in the UK, the ICO).
To use any of these rights, email support@oddomens.com with your username. We may need to confirm the account is yours, for example by asking you to message us from the game while signed in, because we don't hold an email address for you. We'll answer within the time the law allows (usually one month). We won't treat you differently for using your rights.
8. Children
Salvo is for people 13 and older. Sign-up asks for your birth month and year, and if you're under 13, no account is created and nothing you entered is kept. Players who had accounts before this check are asked the same question at their next sign-in, and accounts of anyone under 13 are deleted. We don't knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we delete it. If you're a parent or guardian and think your child under 13 has an account, email support@oddomens.com with the username and we'll remove it. If you're under the age where your country lets you agree to data use yourself (up to 16 in some EU countries), you need your parent's or guardian's permission to play.
9. Where your information is kept
We're based in the United States, and our server is in the United States (Virginia). If you play from elsewhere, including the EEA or the UK, your information is transferred to and stored in the United States, where data protection laws may differ from yours. We rely on the transfer being necessary to provide the game you've asked to use, and our providers use appropriate safeguards (such as standard contractual clauses) where they process it.
10. How we protect it
Passwords are stored only as salted scrypt hashes. Connections to the game are encrypted with HTTPS. Sign-in is protected against password guessing with rate limits and temporary lockouts. Our server only accepts administrator access by cryptographic key, runs a firewall, and blocks attacking addresses automatically. Admin tools are limited to staff accounts. No system is perfectly secure, so please use a password you don't use anywhere else. If a breach affects your information, we'll tell you and the authorities where the law requires.
11. Changes to this policy
We may update this policy as the game changes. When we do, we'll change the effective date above, and you'll be asked to read and accept the new version the next time you sign in, before you can keep playing. If you don't accept it, you're signed out, and you can still delete your account. We keep a record of which version you accepted and when.
12. Contact
Odd Omens LLC · Minnesota, USA · support@oddomens.com