Privacy
Your privacy and safety come first. We only collect what the site needs to work - to log you in, keep your account, and run the daily game and its leaderboard - and nothing more. We never sell your data.
What we collect
- A fingerprint of your email, not the address. When you log in with an Email, Discord or Google, we convert the email to a one-way cryptographic fingerprint and never store your Email. We will never send you any marketing emails.
- Your Discord or Google account number. We only use your account number and email, to correctly identify your account.
- Your Display Name, which you choose. It is the only name anyone else ever sees, on the leaderboard and on your runs.
- Your game activity: what you do in the game, such as your delves and their scores, and anything you build or manage as the game grows. This is what your progress and the leaderboard are built from.
- A login cookie, a random token that keeps you logged in on that browser. It holds nothing about you and ends when you log out.
- Google Analytics. We use Google Analytics to count visits and see how the game is used. It never receives your email, your Display Name or your account number, and we do not use it for advertising.
What we don't do
- No advertising, and no selling or renting of your data.
- No marketing email. The only email we ever send is the login code you asked for.
- No passwords. There is nothing of yours for us to leak.
- No keeping your email address. We couldn't show it to anyone, or send you anything you didn't ask for, even if we wanted to.
How we protect your data
- Email hashing: your email is turned into a fingerprint with HMAC-SHA256 and a secret key that is kept apart from the database. Even if our database were copied, your email address could not be recovered from it.
- Session security: we don't keep your IP address or browser details with your account at all. Your login cookie is a random token that scripts on the page cannot read.
- Login codes: no passwords to leak. Codes are six digits, expire after 10 minutes and allow only a few wrong tries.
- HTTPS: all connections are encrypted in transit.
- Delete Account: you can permanently delete your account from Settings (the cog at the top right). This removes your email fingerprint, your Discord or Google link, your Display Name and all of your game activity, and it cannot be undone.
Changes
If we change what we collect or how we use it, we will update this page.