Privacy notice
This notice is a standalone account of how Blockforge processes personal data. It is given so you can decide, in clear terms, whether to consent. It is published under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
Data Fiduciary: Puneet Naliath, an individual. There is no registered company.
Website: https://digmake.thepuneet.online. This notice is always at /privacy.
Effective date: 24 October 2026.
How to contact us, withdraw consent, exercise rights, or complain
This project does not publish an email address. Use the data-rights request form on this page. That is how you withdraw consent, ask for access, correction or erasure, raise a grievance, or nominate someone. Withdrawal is a single form submission, comparable to ticking the consent box when you host, join, chat, or send a request.
Identifiers we may need to find your data: the player name you used, and the six-character room code if you played online.
You may complain to the Data Protection Board of India after using this grievance path. We respond to grievances within ninety days. The Board’s filing particulars are those the Board itself publishes. We do not invent a Board email or phone number here.
What we collect and why
Blockforge is a browser voxel game. There is no account, password, payment, or subscription. Personal data is processed only for the purposes below.
| Personal data | Purpose and the service it enables |
|---|---|
| Player name you type when hosting or joining | Online multiplayer: show you to teammates, label your avatar, and attribute chat. |
| World name you type when hosting | Online multiplayer: label the shared room. |
| Chat messages | Online multiplayer: deliver text you send to players in that room. |
| Live avatar state (position, look direction, held item, health, sleeping) | Online multiplayer: keep the shared world in sync while you are connected. |
| Temporary session id assigned by the game server | Online multiplayer: keep your WebSocket session attached to the room. |
| Room code and invite link you share or paste | Online multiplayer: put you in the correct room. A room code is not an identity by itself. |
| Solo world snapshot, inventory, and last online inventory kept in this browser | Solo play and rejoining a room on this device. This stays in your browser unless you host or join online. |
| Camera and audio settings in this browser | Remember look sensitivity, field of view, view distance, volume, and similar controls. |
| Name, contact method, player name, room code, request details, and nominee name on the data-rights form | Identify you and respond to access, correction, erasure, grievance, or nomination requests. |
| Short-lived rate-limit counters and timestamps on the rights form and game sockets | Security: slow abuse of the server. These are not used for advertising. |
We do not collect government identity numbers, payment card data, phone numbers, or a postal address. We do not run accounts. Connection metadata that any web server sees (such as IP address on the TCP session) is used only to keep the connection up and to apply rate limits; we do not store it in room saves or analytics.
Server room saves store block edits, containers, world name, seed and game mode. They do not store player names, chat, or inventory. Chat is delivered live and is not written to disk.
Consent
Hosting, joining, chatting, and sending a data-rights request each require an unticked checkbox that you must tick. The game server refuses those actions without that consent. You may withdraw by leaving the room (this stops live name, presence and chat processing) and by using the form for any retained record. Cookie and tracker preferences are separate and can be changed at any time in Privacy settings.
By ticking the online-play box you also confirm you are 18 years of age or older, or that you are the parent or lawful guardian consenting for a child.
Cookies, storage, and trackers
Essential storage on this device: this privacy-settings choice, solo saves, per-room inventory on this browser, and camera settings. These are needed for the game you asked to play and for remembering your privacy choice.
Non-essential trackers and analytics cookies are off until you opt in. Blockforge does not ship a third-party analytics, advertising, or social pixel. If a first-party analytics event is ever sent after opt-in, it will not include player names, chat, contact details, room codes, positions, or other personal data. Withdrawing analytics consent clears tracking identifiers stored by this site.
to change this. The same control is on the game page.
Data processors
- No advertising, analytics, marketing, or social-network processors are used.
- On the public game at digmake.thepuneet.online, Puneet Naliath operates the Node.js HTTP and WebSocket host that processes online-play data. That host is the Data Fiduciary’s own system, not a separate company.
- If someone runs
npm run lanon their own computer, that host processes the room on their machine. That person is a separate Data Fiduciary for that self-hosted room. - Your browser holds local saves and settings. Those stay on your device.
- Game art and the Three.js library run in your browser. They are not processors of your personal data.
Children’s data
Blockforge is not a service directed at children. We do not knowingly process personal data of a person under 18. Online play asks you to confirm you are an adult or a parent or lawful guardian. We do not track children, do not monitor their behaviour, and do not show them advertising. We do not collect identity documents or DigiLocker tokens. If a child has typed a player name or chat, a parent or lawful guardian should submit an erasure request on the form below.
Retention
- Live player name, presence and chat: only while you are connected to the room, then dropped from memory.
- Room world saves on the host: until that host deletes
server/saves/<ROOMCODE>.json. - Browser saves and settings: until you clear them, use “Clear game data on this device”, or the browser expires them.
- Data-rights requests: until the request is closed, and then only as long as needed to show we handled it.
- Security logs needed to detect unauthorised access (Rule 6 of the DPDP Rules, 2025): up to one year, unless a law requires longer.
When the purpose is over, we erase the personal data or make it such that you are no longer identifiable, unless a law requires us to keep it.
Your rights
- Access — a summary of personal data we hold about you and the processing activities.
- Correction — complete, correct, or update that data (for example a player name we still hold on a rights record).
- Erasure — erase personal data that we no longer need for the purpose you consented to, including a named room save where you were the host if you identify the room code.
- Grievance — complain about our handling. We respond within ninety days.
- Nomination — name one or more people who may exercise these rights on your death or incapacity.
Use the form below. There is no account username; give the player name and room code you used if you have them.
Personal data breach
If we become aware of a personal data breach, we will inform affected Data Principals without delay, in plain language, with: the nature, extent and timing of the breach; likely consequences for you; measures we have taken or are taking; steps you can take; and how to reach us (the data-rights form, because this project has no published email). We will also inform the Data Protection Board of India without delay, and send the Board a detailed report within seventy-two hours, as required by Rule 7 of the DPDP Rules, 2025.
Security
The host checks room codes, limits message size and rate, and does not write chat or live player names into room save files. Rights requests are stored only on the host that received them. Do not share a room code with people you do not want in the world. Self-hosted server/saves/ files should be kept private.
Changes
If the purposes or the itemised data change, we will update this notice and the date above, and we will ask for fresh consent where the law requires it.