MEDDON LABS / ACCOUNT PRIVACY

Your account data.

Meddon Labs operates this arcade website. For questions about your personal data or to request account deletion, contact developer@meddonlabs.com.

Your account

Google Firebase Authentication handles your email address, password, email verification and password reset. Meddon Labs does not store your password in its game database. The Cloudflare D1 account database stores an internal identifier, your Firebase user identifier, private email address, public username and creation time to provide your account and game services.

Your username is public on leaderboards. Your email, crystal balance and run history are private to your account. We do not publish your email to other players or sell your account data.

Game records and saves

Neon Drift sends a server-issued run identifier and your gameplay control commands for verification. The server records verified scores and actual crystal pickups. Replay state is kept while a run is checked; after completion its detailed simulation state is discarded and a credit receipt remains. Scores and crystal receipts are retained with your account until deletion is requested. Unfinished receipts expire after 24 hours and are cleaned up when you next start a run.

The production arcade starts fresh on 25 October 2026. Earlier test scores, crystals and game progress are not imported. New records and progress are retained from this launch onward. Meteor Pop is currently unavailable. Existing account records and balances are retained. Clearing browser storage can remove local preferences and unsynchronized progress.

Guest play

You can play without an account. A Secure, HttpOnly, SameSite guest cookie identifies this browser for up to 30 days. Clearing browser data, session expiry or changing devices can remove access to guest history and your chosen name. Guest access cannot be recovered or transferred to an account. A completed, server-verified guest run may be published after you enter a nickname. That nickname and best score are public and may remain on the leaderboard after your browser session is lost. Guest runs never award account crystals. Unsubmitted verification state expires after 24 hours. Short-lived hourly hashes of the connecting IP address are used for guest rate limits, with counters retained for no more than two hours.

Browser storage and hosting

A Secure, HttpOnly, SameSite session cookie keeps your server session for at most one hour before renewal. Firebase remembers your sign-in in browser storage. Other local storage holds game progress, preferences and pending submissions until synchronization. Signing out clears this browser's sign-in session. These storage mechanisms provide the requested account and game functions.

Cloudflare delivers the website and API and may process technical request information, including IP addresses, for delivery and security. Google and Cloudflare process data under their own service terms; their infrastructure may process information outside your country. This arcade does not add advertising or optional analytics trackers.

Requests and deletion

You can request access, correction or deletion by contacting us from your registered email address. We verify ownership before changing account data. Deletion requests cover the Firebase identity and linked game account, scores, sessions and crystal receipts. Operational backups may retain a restricted copy for recovery until those copies expire or are replaced. There is no public account-deletion button yet; requests are handled by email.

Firebase privacy · Cloudflare privacy

Updated: 27 October 2026.