Legal and privacy
Whose game this is, and exactly what this site and the game server keep about you.
Legal
Not affiliated with Electronic Arts
Zero Hour Unbound is not affiliated with, endorsed or sponsored by Electronic Arts. It is a port of the game's engine made by its contributors in their own time.
Trademarks
Command & Conquer, Generals and Zero Hour are trademarks of Electronic Arts Inc. They are used here only to say which game the port plays.
No game data
The port ships none of the game's files: no models, maps, sounds, films or text. It reads them from your own copy of Command & Conquer Generals Zero Hour, from Steam, the EA app or the discs. The same holds for the game's translations: they come from your copy, never from us.
Non-commercial
The project is free and non-commercial, under EA's Command & Conquer modding guidelines. Nothing is sold, there are no advertisements, and no money changes hands on this site.
Privacy
This site has one purpose: the ladder, the server browser and the accounts that link a person to them. It keeps what that needs and nothing else. There are no analytics and no third-party trackers; the site loads one thing from elsewhere, the body font (Inter) from Google Fonts, so your browser fetches it from Google and Google sees that request and your address. Everything else comes from this site itself.
You can read the ladder, the server browser and this whole site without an account. An account is only for linking your name to the ladder and for signing in to the game from here.
What an account stores
One database file on the server that runs this site. Secrets are never kept in the clear: tokens only as hashes, the authenticator secret and the ladder token encrypted under the site's key. Of a passkey the site has only the public half, which signs nobody in.
| What | How it is kept | How long |
|---|---|---|
| E-mail address | As typed, lower-cased; whether it has been verified | Until you delete the account |
| Display name | As typed | Until you delete the account |
| Password | Only a hash (scrypt, N 2^15, a salt of its own); never the password itself | Until you change it or delete the account |
| Sessions | A hash of the sign-in token (SHA-256), the browser's user agent, its address, when it was made and last seen | 30 days; 15 minutes while the second factor is still to be given |
| Authenticator secret | Encrypted at rest (AES-256-GCM under the site's key); the last code's counter | Until you turn two-factor sign-in off or delete the account |
| Recovery codes | Only their hashes, and whether each was used | Until you make new ones, turn two-factor sign-in off or delete the account |
| Remembered devices | A hash of the device token and the browser's user agent | 30 days |
| Passkeys | For each: its credential id and public key (the private key never leaves your device), its signature counter, how the browser reaches it (built in, phone, USB...), whether it is synced, the name you gave it, when it was added and last used | Until you delete it, reset your password by e-mail, or delete the account |
| Passkey challenges | A hash of the random value a passkey signs, tied to your session (adding one) or to the sign-in cookie | Five minutes, or until used |
| Ladder link | Your ladder id and name, the ladder server, and your ladder token encrypted at rest | Until you delete the account |
| Players you follow | Each one's ladder id and the ladder name it had when you followed it, and when | Until you unfollow them or delete the account |
| Clan | The clan you founded or joined (its name, its tag, who leads it, when it was founded) and when you joined it | Until you leave it, are removed, it is disbanded, or you delete the account |
| Clan invitations | Which clan invited you and when (sent to you by its leader, by your account's name) | Until you accept or decline, it is withdrawn, or 30 days |
| Invitations declined | Which clan, so it cannot invite you again for a while | 30 days |
| Account events | What happened (signed in, and with which passkey; password changed, two-factor turned on, a recovery code used, a passkey added, renamed or deleted, linked to the ladder, your data downloaded, a bug report sent and its issue number; a clan founded, joined, left or disbanded, an invitation sent, withdrawn or declined, a member removed, the lead handed over) with the address and user agent it came from. What another account did to you (a clan's leader removing you, a member joining or leaving your clan) is noted without their address or user agent | One year, then swept |
| One-time codes | A hash of the six-digit code sent by e-mail, and how many tries it had | Ten minutes, or until used; five tries at most |
| Rate limits | A counter per address or account for sign-ups, sign-ins (with a password or a passkey), second-factor tries, downloads of your data, bug reports, follows, clan invitations and clans founded | 24 hours, then swept |
The address is the one your request came from, as the reverse proxy in front of the site passes it on. The account's owner sees the event log on their account pages; nobody else does. The user agent is cut to 200 characters.
E-mail is sent only to verify a new account's address, to reset a password and, when you choose it, as a sign-in code: a six-digit code that works for ten minutes. It goes through Resend, and only when the operator of this site has configured it; without that, the site runs without e-mail and says so. What Resend receives is your address, the subject and the code; nothing else about you.
Cookies
Three, all set by this site, all HttpOnly, none read by anyone else:
- zhu_s: your session, 30 days (15 minutes while the second factor is still to be given). Signing out removes it.
- zhu_d: a remembered device, 30 days, set only when you ask to skip the second factor on this browser. It stops working when you forget your devices or turn two-factor sign-in off (the security page).
- zhu_pk: set while the sign-in page is open in a browser that offers passkeys, and sent to the passkey sign-in only: a random token, signed by the site, that the passkey's challenge is tied to. Five minutes, renewed while the page stays open; it goes after a sign-in with a passkey, else it runs out.
Friends and clans
Following a player is one way and private: the player is not asked or told, and nobody but you sees whom you follow. The site compares the names of the players you follow with the names in the game server's list of open games, which is public, to show you what they are playing; nothing about it is sent anywhere. While you are signed in and a page of this site is open, your browser asks the site every thirty seconds how many open games have one of them in them.
A clan is public. The clans' list shows its name, tag, number of members and their average rating; its page shows each member by their ladder name, or by their account's name when their game is not linked, with the day they joined, their rating and their games, and who leads it. The tag stands beside a member's ladder name on the ladder and their player page. A leader invites an account by its name; whether that account is in a clan already is said to the leader, as it is public anyway.
The game server
The game server is the relay that carries the games and the ladder that rates them. The relay passes the game's traffic between the players and keeps counts (players, packets forwarded, packets refused); it does not keep the games' contents. The ladder keeps what the game reports when a game ends: the map, the players' names, their sides and teams, who won, and the game's length, and rates the people in it (Glicko-2). Games with computer players are kept but not rated. A game is kept under your ladder name, and it is public: the ladder pages, your player page and the recent games show it to everyone, and so does the server's own API.
While a game is on, the server browser shows the game's name, its map, the host's name and who is in it, to everyone looking. A game whose host invites the server to follow it is the one case where the server holds a game's contents: it takes the game's state and runs every frame with the players while it follows. Its live page, on the game server's own address and linked from the server browser, shows everyone the map with every unit and building (place, kind, health, owner) and each player's name, side, colour and money, about a minute behind the game; the same state, without the delay, goes to the thin clients that hold the game's key.
Bug reports
A bug report sent from the report page is not kept on this site: it becomes an issue in the developers' own project on GitLab, a service of GitLab Inc., which only the developers see. It holds what you typed (the title, what happened, the steps, what you expected), the platform, the version and the log you pasted, and your ladder name (else your account's name) with a link to your player page. Never your e-mail or your address. The name of your user folder is taken out of paths (/Users/…, /home/…, C:\Users\…) before it goes; anything else you paste goes as it is.
The site sends it under the project's own account; this site notes in your account's event log that a report was sent, and its number. To have a report removed, ask us through the report page.
Your data
On the security page, Download my data gives you a JSON file of everything in the table above that is about your account: your name, your e-mail and whether it is verified, the second factor's state and how many recovery codes are left, the ladder link, every session and remembered browser with its dates, user agent and address as kept, your passkeys (their names, dates and how the browser reaches them), the players you follow, your clan, the invitations waiting for you and those you declined, the event log, the codes waiting and the rate limits counted against the account.
Left out, and the file says so and why: the password's hash, the hashes of the tokens, the authenticator secret, the recovery codes' hashes, the ladder token (Ladder.json on the account's game page holds it, for your game), a passkey's credential id, public key and user handle, and the counters kept by address, which others may share. Five downloads an hour; each is noted in the event log.
Deleting your account
On the security page. Deleting an account removes everything in the table above at once: the account, its sessions, recovery codes, remembered devices, passkeys, the players it follows, its place in a clan, the invitations waiting for it, its event log and the rate limits counted against it. It is not undone. A clan you lead goes to the member who has been in it longest (noted in their event log), or is disbanded when you were its only member. Other members' event logs keep what you did in their clan (joined it, left it), without your name. A passkey stays on your device until you remove it there; the site no longer takes it.
It does not remove games from the ladder's public history: a game was played with other people, and it stays in their record and on the ladder under the name you played it with. Nor does it remove the bug reports you sent: ask us to remove those.
Questions
Send them through the report page.