We keep as little as the game needs to work.
To let visitors vote without an account we store a hash of a browser-generated id, salted with a key that rotates daily. Raw IP addresses are not stored, and yesterday’s hash cannot be linked to today’s.
For an account we hold your name, email address and a hashed password. Your moves, wallet ledger and payments are kept as long as the account exists, because they are financial records.
We use strictly necessary cookies only: the one that keeps you signed in, and the form-security (CSRF) one. No advertising, analytics or third-party tracking cookies — the site loads no analytics or ad scripts at all. So that you can vote without an account, a device identifier is kept in your browser; that is browser storage rather than a cookie, and only a hash of it, salted with a key that rotates daily, ever reaches the server. Clearing your browser data clears it. Blocking the necessary cookies means you cannot sign in. We do not ask for consent for them because the service cannot function without them.
Payments are processed by Stripe, which receives the data needed to take the payment. Traffic is served through Cloudflare. Both may process data outside your country.
You can ask for a copy of your data or ask us to delete your account. Financial records that we are required to keep will be retained for as long as the law requires.