Accounts · early access

Account privacy

Batkin Consulting, United States, operates this account service. Contact ceo@batkinconsulting.com about access, correction or deletion of account data.

What the account service stores

Your unique public player name, an internal account identifier, Google's stable account identifier, the accepted terms version, and account/session timestamps. The service checks your age for eligibility but does not store your exact age or date of birth. It does not request your Google email, profile photo or contacts.

Google handles its own sign-in page under Google's privacy policy. This service stores hashes of browser session credentials. Cookies keep you signed in, bind sign-in requests to your browser and protect requests from forgery; they are not advertising cookies.

Chat and moderation

Your public name, online presence and messages are visible to other participants in the same subscribed channel; the current-location roster separately shows people physically on your floor. Messages include their author, channel and time and expire after 30 days. You can remove your own messages. Blocks are stored on the server; mute preferences stay in your browser and are separated by account and project.

A report stores your explanation and the server-selected message or profile evidence shown in the preview. Message evidence can include two accessible neighboring messages on either side. The owner can review reports, remove messages and apply temporary chat restrictions. Open reports remain for review; closed reports and moderation access/action records are retained for 90 days. Restriction records remain until 90 days after their scheduled expiry. Owner authentication stores an encrypted MFA secret and temporary verification state.

The owner can place an account on hold for security, moderation, eligibility or another stated reason. Holds remain until lifted. Held accounts can sign in to read the reason, manage sessions, export data or request deletion; other online features are unavailable. If a held account is deleted, a minimal keyed fingerprint of the Google identity and a hold reference remain until the owner lifts the hold. Creating another account with that identity carries the hold over. Deletion clears the hold’s explanatory text, private notes and actor reference. Released hold notes expire after 90 days.

Exports, diagnostics and lifetimes

You can download your server account data from the Account page. Export files expire after 24 hours. Job metadata remains for seven days after expiry once file cleanup finishes; download-access records remain for 90 days. Exports exclude other people's messages, private moderation evidence and credentials.

Every service API attempt and outcome is recorded for reliability and security. Declared private fields are redacted; message text, credentials and provider tokens are not ordinary log contents. Operational records can include operation names, times, result codes and internal identifiers. Completed exported records and log files expire after 30 days; unfinished or unexported calls remain until resolved.

Sign-in attempts and pending identities are short-lived, normally ten minutes. Sessions expire after seven days unless revoked sooner. Expired sessions are cleaned up periodically. Account-creation retry records are removed after the corresponding session can no longer authorize them.

Sign-in is optional. Chat and presence are enabled for signed-in accounts unless access has been restricted. You can delete this project’s hosted data or your entire account from the account page. Deletion revokes affected sessions immediately, cancels exports and removes hosted messages; whole-account deletion also removes your profile and provider identity. A private progress receipt remains for seven days. Keyed identity fingerprints remain briefly to reject delayed sign-ins, and until any existing temporary restriction expires (up to 24 hours) to prevent restriction evasion. Moderation evidence and security/access records follow the retention periods above. Encrypted local database snapshots expire after seven days. Private deletion records remain for 30 days so restoring an older snapshot applies subsequent deletion requests before access is enabled. Backup job metadata remains for 30 days after expiry. Production snapshots are copied to a dedicated Hetzner Storage Box and expire after seven days. The operator may retain an additional encrypted copy in the United States under the same expiry policy. Contact the operator above for access, correction or removal. Local game saves are not uploaded and are not removed by account operations.

The public service is hosted in Finland. The operator accesses it from the United States. Encrypted off-host backups use a dedicated Hetzner Storage Box, with an optional additional copy in the United States. Local development previews run separately on the operator’s computer. This page does not describe separate game telemetry or an external website's analytics.

Back to account