Security
Security, at a high level
Here’s how we protect players and the website — without sharing details that could help someone attack it.
Secure transport
barberz.lol is served only over HTTPS, with HSTS so browsers always use an encrypted connection.
Minimal data
The best-protected data is data that doesn’t exist. The game is designed to work without accounts or personal information, and saves stay on the device.
Access control
Only the people who need it can access our support mailbox and publishing tools, using strong authentication with multi-factor sign-in.
Secure storage
Game saves use a versioned, local format with safe writes so they don’t get corrupted. No secrets or keys are embedded in the app.
Hardened website
A strict Content Security Policy, no third-party scripts, no cookies, no forms that send data to our servers, and self-hosted fonts.
Monitoring
We keep dependencies up to date and watch for security advisories that affect the website and the game.
Incident response
We have a process to detect, contain, investigate, notify where required, fix and document security incidents.
Data deletion
You can delete game data at any time from the device. Support emails are deleted on request and after a set retention period.
Found a vulnerability?
Thank you for looking out for us. Please email support@barberz.lol with “[SECURITY]” in the subject. Please don’t access other people’s data, disrupt the service or publicly disclose the issue before we’ve had a chance to fix it.
We don’t claim any security certifications.