Privacy and support

Joystick provides hosted game demos and phone-controller pairing, SDKs, and native iPhone, iPad and Android controller apps. Another game, signer, relay or self-hosted broker may have a separate operator and privacy practices.

Who operates it and how to contact us

Joystick is a ForgeSworn open-source project, operated by ForgeSworn.

For Joystick privacy, support, safety reports and complaints, email abuse@safety.forgesworn.dev. No app sign-in is required.

[INPUT: verify operational monitoring, responsible roles and delivery for Joystick reports.]

For a technical or safety report, describe the app or broker address, approximate time and problem. Include a session reference only if safe. Do not send private signing keys, live recovery credentials, or illegal images/videos. This draft does not promise an emergency response service.

What the hosted broker sees

ForgeSworn's controller broker is controller.pallasite.app (also served as controller.forgesworn.dev). It serves ForgeSworn's own games and controller apps. The Joystick SDK has no default broker, so another game has to name its own; a selected custom broker receives the connection instead. The web host and broker receive network addresses and request/connection information. The broker processes session identifiers, endpoint roles and the game traffic described next.

The broker carries controller inputs and game state only. From a phone to the game it forwards slot inputs (bounded integer values) and a context frame holding a tournament total and, optionally, three-letter arcade initials. From the game to a phone it forwards the controller layout, feedback, haptics, scores and spectator views. Every text field in those frames must be a member of ForgeSworn's closed vocabulary or a template whose only parameters are bounded integers, and a button picture is allowed only if it is one of the pictures ForgeSworn has listed (matched by the SHA-256 of the exact PNG). Text the broker does not recognise is replaced by a placeholder and is never forwarded. Binary frames between a game and a phone, phone text frames over 4 KiB, and any other message type are dropped. The broker therefore does not carry typed names, profile pictures, chat or other free text, and it does not carry signing requests. The streaming, publisher, subscriber and spectator-watching roles of earlier versions are removed. Lockstep peer play is unchanged and carries game inputs as integers only.

The hosted broker accepts a game screen (the host role) only from ForgeSworn's own sites, by checking the browser's Origin header. That stops other websites from using the broker as a game screen. It is a boundary between sites, not authentication: a program that is not a browser can send any Origin header.

HTTPS and WSS encrypt connections in transit. The broker can read the frames it forwards (inputs, initials, totals, scores and layouts); controller traffic is not end-to-end encrypted.

The Node broker holds active sessions, recovery state, hashed address rate counters and bounded recent peer-play replay in memory. Empty/orphaned sessions and disconnected owned state have cleanup timers, typically five minutes; active sessions may last longer. Restart discards Node memory. Hashing an address does not make all associated information anonymous. Server, proxy and system logs are a separate retention question.

The hosted Foregather pairing service is off by default in the broker code and is being switched off on the live service, and ForgeSworn's apps no longer offer it. Direct QR and code pairing is unaffected. The broker code mounts the Foregather gateway only when an operator sets both FOREGATHER_GATEWAY=1 and FOREGATHER_API_URL, and answers 410 Gone otherwise. A person who runs their own gateway is a separate operator. Earlier use of the hosted service left a SQLite database of short-lived room records on the server; expired access does not prove physical erasure of all database pages or backups. [INPUT: confirm the live gateway is stopped and the old database is removed or archived, and record the date.]

[INPUT: publish actual hosting/processor identities and countries, log fields, database cleanup and backup retention.] [DECISION: approve retention for support, privacy and safety records.]

The web controller

Players are named by arcade initials: exactly three letters, A to Z, entered on the controller like a cabinet. There are no typed names, profile pictures or other free text, and no word filter. The initials appear on the game screen as, for example, P3 · ABC, and to other players in the same game on leaderboards. Three letters chosen by a player can still spell something rude; they are limited to that format and nothing longer or free-form can be sent.

The PWA remembers account identity, your initials, tournament totals and preferences on your device. A guest account is only your initials: the pad creates no Nostr key for a guest, publishes no profile (name or picture) to any relay, and sends neither a name nor a key over the pairing. Signet login has additional login storage.

A tournament cookie containing your total and optional initials can be set for 30 days across .forgesworn.dev so the play hub can show your total. It accompanies matching web requests and is readable by matching subdomains. Resetting the total does not clear all site data. Browser site-data controls can remove local storage and cookies. The pad does not set automatic expiry for its stored identity/preferences.

[LEGAL REVIEW: confirm the device-storage exception and information/opt-out controls for each item, especially tournament mirroring and preferences.]

Camera scans and photo QR decoding happen in the browser. Motion is processed locally, and derived gameplay input goes to the broker. No camera-image upload path was found in the scanner. You can enter a code manually and use touch controls if camera or motion access is unavailable.

Other destinations in the web controller

• Signet sign-in uses a selected Signet origin or the installed login library's default, mysignet.app. Its default relay transport is relay.damus.io. Chosen signer/bunker methods can involve other services.
• Where a game screen offers Nostr sign-in, it uses your own signer (for example NIP-46) and that connection does not pass through the controller broker. The broker drops signing requests and signer announcements, so no screen can ask your phone to sign something over the pairing.

A Nostr profile that you publish yourself, or through your signer, is public and can be copied by others; Joystick does not publish one for you. Clearing device data cannot guarantee deletion of such copies. No advertising analytics, payment or AI/model calls were found in the inventoried application source. [INPUT: verify deployed additions, dependencies and operational services before approving that statement.]

Native iPhone, iPad and Android controllers

The native source stores your three-letter initials and tournament totals locally, then announces them through the broker to the paired host. These paths do not create PWA Nostr keys or grant signing authority. Native Signet/account and Foregather pairing parity are not included in this first direct-pairing implementation. [INPUT: the native inventory below predates the initials change; recheck it at the final integrated revision.]

QR camera decoding and motion processing happen locally in the inspected native paths, with derived control inputs sent to the selected broker. Each app shows the session and broker before you join. Manual entry and touch controls provide alternatives.

iOS stores resume credentials in device-only-when-unlocked Keychain entries. Android encrypts them using an Android Keystore key before storing them privately and disables backup. Explicit leave removes the current pairing's credential; app termination without leave may leave it stored. Initials and totals persist separately; iOS stores those in ordinary UserDefaults.

[INPUT: verify final signed apps, dependency traffic, camera/motion permissions, secure-storage failures, backup/uninstall behaviour and clearing controls on physical devices. Core tests and simulator/debug/unsigned builds are separate evidence.]

Why information is processed

Purposes include pairing/gameplay, requested identity and preferences, service security and availability, support and reports, and necessary legal obligations.

[DECISION: approve and publish the lawful basis for each purpose, and any legitimate-interest explanation, after legal review. A camera permission prompt or joining a game is not blanket consent to every purpose.] [LEGAL REVIEW: approve recipients, processor arrangements and international-transfer safeguards.]

Your privacy rights

You can ask for access, correction, erasure or restriction of your data, and where applicable portability or object to processing. If a purpose relies on consent, you can withdraw it. Anonymous/transient sessions may limit what can be located; reasonable verification may be needed. For requests and complaints, contact abuse@safety.forgesworn.dev. You can complain directly to the controller and to the Information Commissioner's Office.

[INPUT: verify chosen contact monitoring/delivery and the rights-request/complaint process before publication.]

Children and service limits

Children can plausibly access the games. No effective age assurance or approved minimum age is established. The broker carries no messages, names, pictures or files between players, so a stranger who joins a game cannot send a child anything through it beyond game inputs and three-letter initials; a pairing code still does not prove who is on the other end. [DECISION: complete children's assessments and approve the age/access and privacy design.]

We cannot remove data from a separate game, self-hosted broker or external relay. The hosted broker accepts game screens only from ForgeSworn's own sites, so a third party's game cannot run against it. The inspected broker can disconnect connections or restart, but no audited operator interface for selective session takedown or permanent user bans has been established. Transient content may already be unavailable when a report arrives.