Noillirk / Field notes
Game identity and privacy
What this game stores, what stays on this device, and the current limits of retention.
A browser identity, not an account
The game creates a random browser credential in an HttpOnly cookie, secure on HTTPS, with a 90-day lifetime. The server stores a hash of its secret and uses that identity to authorize access to your games and submissions. This is pseudonymous game data, not a claim of complete anonymity. Clearing cookies loses access to the old identity and does not delete its server records. Account and administrator features, if used separately, have their own sign-in session.
Server records
We store game modes and dates, fixed question versions, deadlines, submitted raw and normalized answers, command results, scores and rate-limit receipts. If you actively report an answer, a separate feedback record contains the reason and a copy of that submitted input. Local editors can review it and record a resolution. Do not submit personal, confidential or sensitive information as an answer.
This device
Session storage temporarily keeps pending requests, including typed answers, so interrupted submissions can be recovered. Local storage keeps device score summaries and theme preference. Score summaries contain no question text, answers or credential. The statistics control clears local score history only; it does not delete cookies or server data. Browser controls can clear cookies and other local storage.
Sharing and analytics
Score sharing is initiated by you and excludes answers, raw input, identity credentials and private game IDs. When configured in a production build, Google Analytics loads to measure traffic and engagement and may use analytics cookies. It can collect page URLs, referrers, browser and device information, and interactions enabled in the Google Analytics data stream. We do not explicitly send typed answers or game identity credentials as analytics events. Session-replay and chat widgets are not initialized. Allowlisted game views, successful copy actions and share landings are also recorded with a coarse device class in our own service. Server events are deduplicated into aggregate counts. External delivery of those aggregates is optional and disabled by default. Cloudflare provides the hosting and database runtime; request processing can involve network information used by that infrastructure.
Scheduled retention
Daily UTC jobs remove settled, non-writable raw and normalized inputs and input hashes after 30 days, and remove game records and their feedback after 90 days. Feedback can be removed earlier when its parent game is deleted; feedback text and editorial resolutions have a 90-day limit of their own. Unresolved durable commands retain evidence until recovery or the game retention limit, with an operational alert for overdue evidence. Work runs in small resumable batches, so backlogs can delay cleanup. Expired identities are removed after their game references are gone. Aggregated counts contain no game or visitor IDs and are kept for up to 365 days. Self-service server-data deletion is not implemented. Operational and release review must still be completed before public release.