What changed on 1 October 2026

Your sign-in — your email address, and which methods you use to sign in. This is held by Firebase Authentication and . Your email is the only place your email livesnever written into the game's own records.

Your public profile — @handle, display name, bio, avatar, the cards you choose to show off, and whether your email has been verified, your achievements, your standing on the Ranks boards, and tags such as Alpha tester or a staff rank. Other signed-in players can see all of it.

Your game — your progress, your collection, your scores, your Skyth and your scoresrelics.

Your purchases — what you bought, when, and what it cost, so Settings → Billing can show them. Never your card details: those go to Stripe and never reach us.

What you write — posts, threads and replies, shown to signed-in players with your name, handle and avatar beside them, and the posts you like.

Your settings — the preferences you set, so they follow you between devices.

In your browser — part of each save (the world it was played in, and where you stood) is kept in the browser rather than with us. If more than one account plays in the same browser, each account's is kept apart and comes back when that account signs in again.

Your email address is never displayed to other players — not on your profile, not on leaderboards, nowhere.

It is not merely hidden. It is never written into your profile record at all, so there is no version of a bug or a permissions mistake that exposes it to another player. It exists in the sign-in system, and it is visible to the developers, only for running the service.

It leaves that system twice, each time for one job: to Resend when we send you an email, and to Stripe when you buy something, for the receipt.

Google (Firebase) — sign-in and, the database everything else is stored in, and the live connection online rooms run on.

Cloudflare — hosts the avatar images, and runs the human check on the sign-in and play pages that keeps automated traffic out.

Resend — sends account email. It sees the address a message is going to.

Stripe — takes payments in the Shop's Treasury. It handles your card details, and is told which account is paying and your email address, for the receipt. We never see your card.

Vercel — runs the site itself.

That is the whole list. There is no analytics service, no advertising network and no tracking beyond what these fourfive need to work.

After the seven days: your progress and collection, your Skyth, relics and purchase history, your settings, your avatar image, your display name, your bio, your showcase, your achievements and standing, every post, thread and reply you wrote (and the replies inside your threads), your likes, and every follow relationship — including the copy of it held on the profile of everyone who followed you.

Then the sign-in record itself, which is what removes your email address. It is not disabled or flagged; it stops existing, and the address is free to make a new account with.

One thing survives on purpose: a record holding your @handle, your account's internal id, and the date. It keeps the handle from being taken by somebody claiming to be you, and it stops every reference elsewhere from pointing at nothing. It contains nothing that identifies a person — your email was never in it, and the record that held your email is gone.

Two things are outside our reach. Stripe keeps its own record of any payment, as payment providers must. And what a browser keeps for your saves stays in that browser until its data for the site is cleared.

In an online room, the other players (up to four) see your display name, where you are, and the fights you're in, as it happens. It travels over Firebase's live database and is removed when you leave the room.

Progress in the online world is kept with the rest of your game.

Your display name, bio, avatar, showcase and preferences are editable in Settings, and your profile page shows you exactly what other players see.

Every purchase is listed in Settings → Billing.

Pausing and deletion are in Settings → Account → Danger zone.