The top-level commitment: what this service protects, what it refuses to do, and what an acceptable use of it looks like.
27001 Clause 5.227001 A.5.127001 A.5.1027001 A.5.36Review. Reviewed whenever a control receipt records a change to a security control, and otherwise at least once every 90 days.
This service protects three things, in order: the integrity of the public evidence it publishes, the availability of the game to the people playing it, and the small amount of data held about players.
Confidentiality ranks last deliberately, because almost nothing here is confidential. The change record, incidents, logs, availability, spend and this policy set are all public by design. What is protected is that they are true and that they cannot be quietly altered.
A player profile holds a display name the player chose, a skin identifier, a best score, and a timestamp of when it was last seen. It is keyed by a random identifier generated in the player's browser and stored in a cookie. No email address, no password, no payment detail and no account exists.
Display names are sanitised on the server before storage: invisible and text-direction characters are stripped, because a name is echoed into the leaderboard, the tank list, the public log and the text export, and those characters allow one player to impersonate or reorder another.
The service action log is retained for 90 days. Per-tank capture logs are retained for 24 hours. Both are published with the retention window stated on the page.
It will not add accounts, passwords or payment. Any change that would introduce a credential store is out of scope for this policy and would require it to be rewritten first.
It will not raise the spend limit to keep the service up. If consumption reaches the limit the service stops, and the stop is recorded as an incident with a receipt.
It will not publish an operational figure it cannot evidence from a live route. A number without a route behind it is removed rather than estimated.
The game is open to anyone with no registration. Acceptable use is: play the game, read the public evidence, and report problems through the security report intake.
Unacceptable use is: automating play to distort the leaderboard, attempting to exhaust the spend limit, and submitting a display name intended to impersonate another player or to break a downstream export. The name policy enforces the last of these in code rather than by request.
There is no separate acceptable-use agreement to sign, because there is no account to bind one to. This section is that policy.
Conformance is checked by the register at /audit/, which records every clause and control of both standards against what the service actually does, including the gaps.
A control recorded as met must name a live route that demonstrates it. Where a control is met in the running service but the record is not yet issued, it is recorded as partial rather than met. Where nothing exists, it is recorded as a gap.