Your data, exporting it, and deleting your account

This page is the practical companion to the privacy policy. The policy is the formal statement; this is the plain one.

What is stored against an account

• Identity. Your email address, your display name, and a hash of your password. The password itself is never stored and cannot be recovered by anybody, including us.
• Preferences. Text size, contrast, motion, subtitles, hints and the other settings.
• Progress. Which rooms you have entered, which evidence you have found, which deductions you have made, which puzzles you have solved and how many attempts each took, which choices you made and which endings you reached.
• Achievements, with the time each was earned.
• Rankings entries, only if you opted in.
• Security events. Sign-in attempts, password changes and similar, with a one-way hash of the IP address rather than the address itself. These are kept because an account with no record of how it was accessed cannot be protected.

What is not stored

• Your real name, address, date of birth or phone number. We never ask.
• Your IP address in a readable form anywhere in the game database.
• Payment details. Nothing is currently for sale, and when it is, card details will go to the payment processor and never touch this server.
• Any advertising profile. Advertising on this site is contextual, and the game view carries no advertising at all.

Playing as a guest

A guest save lives in your browser and is never sent to the server. Clearing your browser's site data for this domain removes it completely, and there is nothing on our side to delete.

Exporting

Account → Settings → Export my data. The export is prepared and offered as a single JSON file containing everything in the list above, in a readable form.

The export deliberately does not include your password hash. There is no use for it, and putting a hash into a file that gets emailed around is a bad idea.

Deleting

Account → Settings → Delete account.

Deletion is scheduled rather than instant, with a grace period during which it can be cancelled from the same page. This exists because account deletion is the one action nobody can undo for you, and an accidental click at two in the morning should not be final.

When it runs, it removes your identity, preferences, progress, achievements and ranking entries.

Two things survive, and here is why:

• Aggregate counts. If two hundred people reached Ending B, that number does not go down when one of them deletes an account, because the number is not about them — it contains no identifier and cannot be traced back to a person.
• Security event hashes, for a limited retention period, because a record of abuse that vanishes the moment the abuser deletes their account is not a security record.

Neither of those can be used to identify you or to reconstruct anything you did.

Asking us instead

If you would rather not use the buttons, the contact form reaches a person and we will do it for you. We will need to confirm you control the account's email address first, which is not obstruction — it is the only thing standing between your account and somebody else asking us to delete it.