Privacy
The short version: we keep what’s needed to run your account and nothing else. No ads, no analytics, and no third-party scripts, fonts or trackers on any page.
Playing without an account
The card game at /cards needs no account. Game rooms exist only in the server’s memory and are forgotten an hour after everyone leaves. Nothing about a game you play signed out is stored.
If you open an account
We store:
- your username and display name;
- your password, as a salted scrypt hash (never the password itself);
- when you opened the account and when you were last seen;
- the flashcards and decks you make, and trades you take part in;
- the mind maps you make;
- your game results, used for your stats page and the daily Battle board.
Your display name is shown to other players. Other members can also see the front of any card you offer for trade, but never the back.
This is kept in a single file in Cloudflare R2 storage. The site runs on Render. The site’s admin can see account details in order to fix problems and deal with abuse.
Cookies and browser storage
There is one cookie: a session cookie that keeps you signed in, which lasts 30 days. It’s only set when you sign in. We don’t use any other cookies.
Your browser also keeps a few things on your own device. None of them is ever sent to us, and clearing your browser’s site data removes them all.
| Name | What it holds | How long |
|---|---|---|
thievery:name | The name you last played the card game under | Until you clear it |
thievery:session | The room you’re in, so a refresh puts you back in your seat | Until the tab is closed |
thievery:notes:… | Your private notes on the cards in a round | Until the tab is closed |
thievery-tips | Which game tips you’ve already seen | Until you clear it |
thievery-motion, thievery-cards, thievery-haptics | Your choices for banner animations, card size and vibration | Until you clear it |
thievery-card-draft | A flashcard you started but didn’t finish | Until you make or clear it |
thievery:fc:lastTrade | The last trade you were told about | Until you clear it |
thievery-mm-sort | How you like your mind maps sorted | Until you clear it |
How long we keep things
- Game rooms: in memory only, gone an hour after the last person leaves.
- Your sign-in: 30 days, or until you sign out.
- The daily Battle board: two weeks.
- Your account, cards, decks, maps and stats: until you ask us to delete them.
Your IP address
To stop people guessing passwords or opening accounts in bulk, the server counts failed sign-ins and new accounts per IP address. The counts are kept only in the server’s memory, are never written to disk, and are cleared whenever the server restarts.
Deleting your account
You can close your account yourself, under Account settings. It deletes the account and everything attached to it straight away: cards, decks, maps, stats and your place on the daily board. If you can’t sign in any more, write to admin@thievery.co.uk with your username instead.