Legal
Privacy
What this website collects, what the game can see, and one thing about peer-to-peer play that is worth understanding properly rather than being reassured about.
Last updated: 9 August 2026
Draft, pending legal review. This describes the project's actual behaviour and intent accurately. It has not been reviewed by a lawyer, and it must be before this site collects anything from anyone.
This website
breachprotocol.info is static. It has no accounts, no login, no comment system and no forms that submit anywhere.
- No cookies are set by this site.
- No analytics or third-party tracking scripts are loaded. There are no external scripts at all — no fonts, no libraries, no embeds. Every asset comes from this domain.
- The support search runs in your browser. Every help article is already in the page; typing a query filters what is on screen and sends nothing anywhere.
The web server that hosts these pages keeps ordinary access logs, as essentially every web server does. Those are used to keep the site running and are not combined with anything from the game.
The game
Breach Protocol stores your profile — operator name, level, progression, unlocks, settings — on your own machine. It is not uploaded to a central account service, because there isn't one.
Information leaves your machine in three situations, and only these:
- Matchmaking. To find and join matches, the game contacts a matchmaking service and exchanges what is needed to establish a connection to other players — necessarily including network address information. See the section below.
- In-match traffic. Once a match starts, your game talks directly to the other players in it: position, actions, voice if you use it, and your operator name.
- Reports you choose to send. The in-game report tool sends what you typed plus your operator name, player ID, build number, operating system, graphics adapter, the map you were on, and a screenshot if you attached one. It sends nothing unless you press submit.
Peer-to-peer play, and the part encryption cannot fix
Read this before playing online. Breach Protocol matches are peer-to-peer: one player in the lobby hosts the match and everyone else connects directly to them.
A direct connection between two machines works by each end learning where the other end is. That is not a side effect of the implementation — it is the mechanism. Consequently, playing an online match exposes your network address to the other machines in that match.
Encryption does not solve this. Encryption protects the contents of what is sent. The address is not contents; it is the envelope, and the envelope is how the packet arrives at all. A fully encrypted peer-to-peer match still tells both ends where the other one is.
What actually solves it is a relay: every packet routed through an intermediate server, so peers only ever see the relay's address and never each other's. That is a real fix and it is a real cost — bandwidth for every packet of every match, paid continuously. It is therefore a decision about what the project can afford to run, not a setting somebody forgot to enable, and describing it as a code change would be misleading.
Relayed matches are on the roadmap. Until they exist, this is the honest statement of what online play involves.
What is published about players
Nothing. This website publishes no player data of any kind: no names, no records, no presence, no addresses. There is no career lookup, and the reasoning behind that decision is written out in full — including what would have to be true before one could ship.
Specifically, and permanently: network addresses, contact details, lobby or session identifiers, and the hostnames or ports of any service the game uses will not be published on this site under any of the designs being considered.
Reports and appeals
When you submit a report from inside the game, what you sent is stored so it can be read and acted on. Reports about other players are used to assess that player's conduct; they are not shown to the person you reported as a document with your name on it.
Appeals necessarily involve you telling us who you are in the game. Send only what the appeal instructions ask for — there is no reason to include identity documents, and you should not send any.
Children
Breach Protocol is not directed at children. The game contains realistic weapons and violence and is not appropriate for young players.
Your data
Because your profile is stored locally, most of your data is already entirely in your hands — you can delete it by deleting the game's profile folder.
For anything held on the project's side — reports you sent, enforcement records — you may ask what is held and ask for it to be deleted, subject to keeping what is needed to enforce the Terms of Service. Ask through the routes on the support page.
Changes
This page changes when the game's behaviour changes. Material changes are noted in the update notes, and the date at the top of this page moves.
Who is responsible for your data
Breach Protocol is an independent project operated by a sole individual developer, publishing as ImBadDecisions, in the State of New York, United States. It is not a registered company. That person is the data controller for anything described on this page. Data requests go through the routes on the support page; there is no separate postal address for them, because there is no company to address them to.
The governing jurisdiction is the United States and the State of New York, matching the Terms of Service.
Still to be completed: defined retention periods for reports and enforcement records, and a qualified legal review. Those are genuinely undecided and are left stated rather than invented — a policy that describes handling the project does not actually do is worse than one that admits the gap.