The first tank game I played was on an Interton TV Console as a teenager. It was 2D, top-down, deceptively simple. Hunt your opponent, dodge their fire, navigate obstacles that changed every level. I was hooked, and that fascination with how games work has continued to fuel my coding curiosity, making me hungry to learn whichever tools each business software challenge required.

When I mastered C# in 2006 — co-leading a large-scale migration from Magic eDeveloper — I finally had a language that made DirectX approachable. By 2008 I’d designed and built a tank game with procedurally generated terrain and a computer-controlled opponent. But it never left my machine. No easy way to publish it, no audience.

Fast-forward to now. As a Svelte developer I discovered Threlte, which lets you define 3D scenes in markup, HTML for Three.js. The old project finally had a home. I rebuilt it for the web, playable in any browser, added multiplayer, and consulted Claude Code to save time on several tasks. It’s a work in progress (always something to refine) but instead of sitting on a hard drive gathering dust, Tank Supremo is out in the world and playable.

The hardest problem: hosting

Multiplayer required a WebSocket server — a long-running process — which ruled out serverless hosting entirely. My existing VPS runs cPanel, which has a Node.js app manager, but it turned out to be a dead end: CloudLinux isolates each Passenger-managed app inside its own network namespace, so Apache can’t reach it. The support team couldn’t find a way around it.

The solution was to run the relay outside that sandbox, as a background service on a separate port, with Apache forwarding WebSocket traffic to it. That meant writing a systemd service file, configuring Apache’s WebSocket proxy manually, and deploying via root SSH — none of which cPanel exposes through its UI. I could have spent days on this kind of infrastructure problem, if I hadn’t sought help.

Claude Code as pair programmer

So I found a pair programming partner. I had a clear vision of what the game should be. Claude Code helped me find the best approach to each new challenge, then wrote the code. But I didn’t just accept its output: I read everything, pushed back when I thought a better solution existed, and tested that it behaved the way I expected. The learning went both ways, and understanding the code kept me in control of the direction.

The details that came from playing

Several of the finer details came from playing the game and noticing what felt wrong. For example:

• The opponent bot would miss a shot and then aim at exactly the same spot and miss again. This was because the ballistic math assumed level ground, and the terrain almost never is. Adding shot-correction biases made it behave more like a human player, which was a happy side effect of making the bot smarter.

• The terrain deformation came from wanting the world to carry the memory of the battle. Changing blast-site colour to black was the obvious first step, but then I added rocks flying from the impact, and it felt natural to also sink the ground where the shell landed, distributing the displaced “earth” where the rocks fell. This small detail made the landscape feel like it was really being fought over.

• Surviving a page refresh mattered most in multiplayer. You shouldn’t lose your game because of an accidental F5. Claude suggested seeded random terrain generation as the elegant solution: store just the seed, regenerate the whole terrain identically on reload, then layer on only the deformed vertices on top. Minimal storage, and the world picks up exactly where it left off.

Why it matters to me

Throughout my career, the software I’ve built has been used by employees at client companies. It has been valuable work, some for very large companies, but with a limited audience. There’s something different about putting something out into the world that anyone can find and play. I’ve set up Cloudflare, partly for performance, but also for the usage stats. Watching that counter go up for Tank Supremo would make me happy. After decades of coding, this is the first thing I’ve built that a stranger might stumble across and enjoy.

👉 tanks.tiyal.com — give Tank Supremo a try and let me know what you think.

See the opportunity in the GDPR

I hope you had a peaceful and relaxing Easter. For us, it was a welcome time to catch up on some important things at our own pace. Looking forward, we now have eight weeks to finish preparing for significant data protection changes that affect us and all our clients. 25 May 2018 will see the coming into force of the GDPR (General Data Protection Regulation):

“Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Made by European Parliament and Council” Journal L119, 4/5/2016, p. 1–88

Believe it or not, we’re excited about this. Why? Because, in this case, compliance is not just a chore; it’s an opportunity. For what? For positive client contact and improving our relationship with our clients and our website visitors.

Protecting the individual’s data better is a good thing (we’re all individuals, after all); it’s good for business too.

By respecting your clients’ and readers’ data, you give them another reason to trust you. You also clean and strengthen your contact lists, and avoid data protection issues. Who doesn’t want a productive mailing list filled with up-to-date data about people who want to be on it?

To act on this opportunity, you may need answers to a few questions… but first, please note that this blog post is not legal advice. Also, see our Disclaimer regarding data processing below.

Who, me? Why me?

Do you collect, hold and use the contact data of EU individuals for the purposes of describing, selling, or delivering to them your products and services? If so, you are a “Controller” of the data of individuals (“data subjects”) in the European Union (EU).

The data controller determines the purposes for which and the means by which personal data is processed. So, if your company/organisation decides ‘why’ and ‘how’ the personal data should be processed it is the data controller. Employees processing personal data within your organisation do so to fulfil your tasks as data controller.

For more detail, see The European Commission’s answer to What is a data controller or a data processor?

This applies no matter how or when you acquired the data, and even if only names and email addresses. And yes, even if you operate from outside the EU, if any part of your target market includes EU individuals. You must now check and document your legal reasons for storing the data of all your EU “data subjects”.

Even if you’re not a business owner, do you process the data of EU individuals by automated or non-automated means? Clue: yes, you probably do. The European Commission definition of data processing is extremely comprehensive: What constitutes data processing?

Are any EU data subjects excluded?

According to the European Commission online legal resource:

(The GDPR) doesn’t apply to the processing of personal data of deceased persons or of legal entities. … (Nor does it apply to) …data processed by an individual for purely personal reasons or for activities carried out in one’s home, provided there is no connection to a professional or commercial activity. When an individual uses personal data outside the personal sphere, for socio-cultural or financial activities, for example, then the data protection law has to be respected.

If you do use such data “outside the personal sphere”, then the law applies even if you hold only a company name (legal entity) but with an associated email address of an identifiable person.

Do my data sources matter?

You may have websites where people can contact you via contact forms or blog comments. This data is collected in databases associated with your websites. Or a Newsletter signup form enables people to add their data to an email marketing list, e.g. on MailChimp.

You may have mailing lists in Excel or Access, built up painstakingly over the years, or which you bought or otherwise acquired. Perhaps you store your newsletter and marketing contacts in a Contacts application, alongside your personal contacts.

Most people who market anything online have a mix of all these. No matter the data source, this law applies to you if the data subjects are EU individuals.

Establish the legal bases of your lists

The good news is… it’s quite possible that you DO actually have at least one lawful reason to approach at least some of your contacts, even if they have not yet bought from you.

There are two main legal bases for marketing to your contacts:

1. You have their explicit consent to your holding their data and using it for specific purposes made clear to them at the time of consent. (Advantages: unequivocal; usually provable; marketing recipients already favourably disposed towards you.)
2. OR: It is appropriate for you to hold and use their data due to your “legitimate interests” in doing so. Your legitimate interests include your need to offer to your market your products or services. (Advantage: Allows you more flexibility as to who is on your list; Disadvantage: Requires you to assess and balance each data subject’s interest in privacy against your legitimate interests, for every action you take with their data.)

In the case of legitimate interests, as I understand it, as long as the marketing is unlikely to surprise or unusually inconvenience the recipients, and does not unduly threaten their legitimate interests in preserving the security and privacy of their own data, you can use existing or obtain (limited) new personal data in order to do so.

However, if you previously asked those same people to consent to receive marketing from you, and they did not reply in the affirmative, you implied that the basis you relied on was “consent”, and you didn’t get it. You cannot then rely on the “legitimate interests” basis.

The e-Privacy Directive

This is particularly so for email and SMS marketing, where another EU directive comes into play as well, as explained by Phil Lee on the Field Fisher law blog:

Marketing regulation under the e-Privacy Directive

Marketing regulation under the GDPR is only half the story, however. Europe also has a separate law — the Privacy and Electronic Communications Directive (or e-Privacy Directive) that contains supplemental rules governing consent requirements for e-marketing, i.e. marketing sent over electronic communication channels (such as phone, fax, e-mail and SMS, for example). When sending e-marketing, these supplemental consent rules apply in addition to the need for businesses to identify lawful processing grounds under the GDPR.

Put as simply as possible, these rules require opt-in consent for e-mail and SMS marketing, unless an individual’s contact details were collected in the context of a sale and the individual was given the ability to opt-out at that time.

The ePrivacy Directive is still in force. The ePrivacy Regulation is apparently due to replace it soon, according to The Drum. However, the content is likely to be similar.

Warning

Must I do anything before 25 May?

Yes, definitely.

How much you must do depends on whether your original data acquisition processes and the ways you currently store and use it comply with the GDPR.

This differs for each Controller, and for differently sourced data held by the same Controller.

The minimum you need to do is:

1. Read up on the new law to understand your responsibilities (see resources below).
2. Check your data and its acquisition, storage and usage processes.
3. Decide whether you need to do any of the following:
   • Modify your online Privacy Policy and your website Cookie Law app.
   • Modify your Contact Form and Newsletter Signup processes to ask contacts explicitly to consent to your using their data for specific purposes.
   • Ask existing Contacts for their consent regarding the use of their data. But BEWARE! See the Warning above.
   • Locate and be able easily to produce proof that all your contacts have given consent where necessary.
   • Delete any contacts for whom you cannot prove this consent and where your other legal basis (e.g. “legitimate interest”) is absent or uncertain.
   • Ensure that new online and offline contacts are added to your list/s only via informed opt-in processes (failure to object or opt out is not implied consent).

Where can I find more GDPR info?

• The source of it all

The original European Commission document is, of course, well-meaning and worthy, if just a tad long: GDPR Full Text

WIRED offers a more digestible summary of some key points, including fines, the difference between “personal data” and “sensitive personal data”, whether Brexit matters (not much) and links to relevant documents: What is GDPR? The need-to-know guide

• ICO guidance on steps to take

The UK Information Commissioner’s Office provides a useful 12-step guide and a checklist: Guide to the General Data Protection Regulation.

The steps are likely to be similar no matter in which country you are based. Obviously, you should check your own country’s online resources to make sure you don’t miss any nuances.

• Websites

Iubenda provides website privacy policies for over 30,000 customers in 100+ countries. Read their summary here: GDPR: The new EU privacy law in short… and in-depth

• Blogs

The GDPR applies to individual bloggers as much as to companies, although some requirements differ. Blogger Nyomi has done some in-depth research and shared the steps that she is taking in her article GDPR for bloggers – does it apply to you and how to comply

• Mailing lists

MailChimp offers a good summary of how the GDPR affects email marketing: Collect Consent with GDPR Forms

If I must take action, who can help me?

1. We recommend iubenda.com as a reliable provider of regularly updated, legally compliant Privacy Policy and Cookie Law software. If your website has fewer than 25 000 page views per month, you can use the FREE option to create a Privacy Policy immediately. If you choose FREE, you will have to find a separate Cookie solution, but there are several options. See pricing.
2. Get IT Write International cannot give you legal advice (see Disclaimer). However, when you know what you want to do, you can ask us to help you:
   • Update related website and email policies, messages and processes on your website.
   • Modify your MailChimp newsletter templates. Again, BEWARE! See above.
   • Install or update Iubenda applications
   • Install or update other Cookie Law applications.
   • Delete data that do not comply with the law.
3. We recommend engaging a lawyer who specialises in EU data protection law to review your website, mailing lists, any other data collecting software, and related processes.

Act Now

Eight weeks can go by more quickly than you think. But even if you haven’t started yet, you’ll get there if you act now. We will be completing many of these things ourselves over the next few weeks. You are welcome to use our GDPR-related messages in emails or on our website for inspiration. However, please treat these as starting points only — they will not suit you perfectly. Also, see our Disclaimer below.

Feel free to share thoughts or questions on the GDPR in Comments below. If you need us to research or implement something for you, please Contact us.

Disclaimer