Privacy Policy

This privacy policy describes how LostPhantom ("we", "us") handles information collected through the Slime Universe game accounts used by Slime Wars, Slime Merge and Slime Defense, through the anonymous play statistics every Phantom Studios game reports, and through our Roblox account verification service and community website.

Slime Universe game accounts

A Slime Universe account is optional. All three games are fully playable with no account at all, offline. An account exists so progress, friends and purchases follow you between devices.

What an account holds

• A username you choose, and a password (stored only as a scrypt hash — we never hold the password itself).
• A public friend code, and one secret key per device you sign in on.
• Your saves, achievements, shard and gem balance, match history and per-game stats.
• An optional recovery email address. It is never required, and accounts for players under 13 cannot have one at all.
• Whether the account predates our 13+ policy — see below.

Age: accounts are 13+

Creating an account asks for your birth year, once. If it shows the player is under 13, no account is created - the games remain fully playable without one, and progress stays on the device. Either way the year is discarded immediately: only the yes-or-no is stored, and the year itself is never written down.

Accounts created before this policy, under our earlier kid-safe rules, continue to work and keep their protections, enforced on our server rather than in the game:

• No email address can be attached to them.
• They are not listed when other players search by name. Friends add them by exact friend code instead.
• A sign-in from a place the account has never used cannot change the password, alter two-factor, or sign other devices out for 72 hours, while existing devices can act immediately.

Sign-in security information

When you sign in, we record a salted one-way hash of your IP address and a two-letter country code against that device and in your account's activity log.

• We do not store the IP address itself, in any form we can read back. The hash lets us tell "same place as last time" apart from "somewhere new", which is all this is for.
• The country is stored so your device list can say where a session came from. We deliberately do not store a city.
• This is used to warn you about a sign-in from somewhere new, and to answer "was that me?" if you think someone has got into your account.
• Activity log entries are deleted after 90 days, and only the most recent 200 are kept.

Email we send, and when

If — and only if — you have added and confirmed a recovery address, we email it when a new device signs in, when the password changes, when two-factor sign-in is turned on or off, when the recovery address itself is replaced, and when deletion is scheduled. Accounts under 13 have no address, so they receive none of these.

Passwords and a third-party check

When you set or change a password we check whether it appears in public lists of leaked passwords, using Have I Been Pwned's range API. Only the first five characters of a SHA-1 hash of the password are sent. That service cannot learn your password, the full hash, your account, or which answer matched.

Seeing it, and deleting it

• See everything: your account screen has an activity log, and you can request a full copy of everything we hold as a single file.
• Delete it: deletion is available in-game and on the site. It is scheduled with a seven-day grace period — signing in again at any point before then cancels it — after which the account and every record attached to it is removed, including saves, wallet, match history and the activity log.
• A parent or guardian can make either request on a child's behalf using the contact details below.

What we never do

• We do not sell, rent or share account data with anyone.
• We do not use it for advertising, and there is no advertising in any of the games.
• We do not build profiles for targeting, and we do not run third-party analytics or tracking SDKs in the games. We do collect anonymous play statistics of our own — see Game analytics for exactly what that is.

Game analytics

Every Phantom Studios game — Slime Wars, Smokestack Valley, Pencil and Paper, Winter Is Here, Dug Out, Slime Merge and FrostRot — reports anonymous play statistics. This is on by default, and there is a switch to turn it off: Share anonymous stats, on the Privacy tab of each game's settings. Turning it off stops the send completely — the code never runs — and a player who turns it off once stays off. It is separate from a Slime Universe account: it happens whether or not you have one, and it is not linked to one.

It exists for one reason. These games are made by one person, and the question "which parts of this do people actually play?" cannot be answered by guessing. There is no commercial use of any kind.

What is sent

About once a day, while you are playing, the game posts one small snapshot containing exactly this and nothing else:

• A random install id the game invents the first time it runs and stores on your machine. It is not derived from your Steam account, your hardware, a MAC address, or a hash of any of those — it is a random string, and it is the only thing tying two reports together.
• The game's version, so a crash-prone build can be told from a fixed one.
• The platform — Windows, Mac, Linux or Steam Deck. Nothing more specific than that.
• How many times the game has been opened, and how many minutes it has been played, in total.
• Minutes spent on each screen — menu, match, shop. This is the "which parts do people actually play" answer.
• A handful of counters the game chooses, such as waves survived. Numbers only.

What is not sent

• No name, username, email address or account of any kind. The server refuses a report carrying a field named like one of those, or any value shaped like an email address, and answers with an error saying so — because the only thing that could ever send one is one of our own games built wrong, and a loud failure is better than quietly storing something we promised not to hold.
• No IP address. There is no column for one in either table.
• Nothing you type. No chat, no search terms, and no bug-report or suggestion text travels on this path. (Bug reports you deliberately send from inside a game are a separate feature, and they carry what you wrote because that is the point of them.)
• Nothing from outside the game — no location, contacts, files, or other running programs.
• No third-party analytics or advertising SDK. There are none in any of these games, and none of this is sold, rented or shared with anyone.

What we can actually see

What it adds up to on our side is a chart, not a person. Per game, per day: how many installs were heard from and how many were new, total sessions and total minutes, which screens took the most time added up across everybody, which versions are still in the wild, and whether an install came back a day or a week later. There is no way to pull up an individual player from it, because there is nothing in the data to pull one up by.

How long it is kept

• A daily total is kept for two years, then deleted.
• An install that has not been heard from for 400 days is deleted entirely.

Roblox account verification

What we collect

• Your Discord user ID and username, when you use the /verify command in our Discord server.
• Your Roblox user ID and username, obtained through the Roblox OAuth 2.0 authorization flow with your explicit consent.
• The date and time the link was created.

How we use it

• To verify your identity for Roblox giveaways run in our community Discord server.
• To display your Roblox username to server moderators when delivering prizes.
• We do not sell, share, or transfer your data to any third party.

Data storage

Your Discord–Roblox link is stored in a private database hosted on Railway. Only the server owner (LostPhantom) has access to this database. You can request deletion at any time by running /unverify in our Discord server, which immediately removes your record.

Roblox OAuth

When you verify using Roblox OAuth, we receive a short-lived access token from Roblox and use it only to retrieve your Roblox user ID and username. We do not store the access token itself. We only request the openid and profile scopes — we cannot access your Roblox inventory, purchases, friends, or any other account data.

Contact

Questions? Message LostPhantom in our Discord server or email lostphantom03@gmail.com.

This service is an independent community project and is not affiliated with, endorsed by, or sponsored by Roblox Corporation. "Roblox" is a trademark of Roblox Corporation.