Privacy Policy

In shortYour sign-in, public profile, game, purchases, writing and settings, plus part of each save in your browser.

Your sign-in — your email address, and which methods you use to sign in. This is held by Firebase Authentication. Your email is never written into the game's own records.

Your public profile — @handle, display name, bio, avatar, the cards you choose to show off, whether your email has been verified, your achievements, your standing on the Ranks boards, and tags such as Alpha tester or a staff rank. Other signed-in players can see all of it.

Your game — your progress, your collection, your scores, your Skyth and your relics.

Your purchases — what you bought, when, and what it cost, so Settings → Billing can show them. Never your card details: those go to Stripe and never reach us.

What you write — posts, threads and replies, shown to signed-in players with your name, handle and avatar beside them, and the posts you like.

Your settings — the preferences you set, so they follow you between devices.

In your browser — part of each save (the world it was played in, and where you stood) is kept in the browser rather than with us. If more than one account plays in the same browser, each account's is kept apart and comes back when that account signs in again.

In shortYour email is never shown to other players or written on your profile. Only Resend and Stripe receive it, each for one job.

Your email address is never displayed to other players — not on your profile, not on leaderboards, nowhere.

It is not merely hidden. It is never written into your profile record at all, so there is no version of a bug or a permissions mistake that exposes it to another player. It exists in the sign-in system, and it is visible to the developers, only for running the service.

It leaves that system twice, each time for one job: to Resend when we send you an email, and to Stripe when you buy something, for the receipt.

In shortSigning in with Google gives us your email and nothing else. Your Google name and photo are never copied unless you ask.

Signing in with Google gives us your email address and nothing else. Your Google display name and your Google profile photo are not copied, not stored, and never become your Skylith identity by default — those are frequently your real name and your real face, and that is your decision to make, not a default to discover later.

You choose a display name and a picture yourself when you set up your account. If you want your Google photo, there is a button that asks for it plainly.

In shortFive services handle data: Google (Firebase), Cloudflare, Resend, Stripe and Vercel. No analytics, ads or trackers.

Google (Firebase) — sign-in, the database everything else is stored in, and the live connection online rooms run on.

Cloudflare — hosts the avatar images, runs the human check on the sign-in and play pages that keeps automated traffic out, and forwards email sent to our addresses (such as support@skylith.io) to the team's inbox.

Resend — sends account email. It sees the address a message is going to.

Stripe — takes payments in the Shop's Treasury. It handles your card details, and is told which account is paying and your email address, for the receipt. We never see your card.

Vercel — runs the site itself.

That is the whole list. There is no analytics service, no advertising network and no tracking beyond what these five need to work.

In shortYour avatar is a public image: anyone with its address can open it.

Avatar images are stored on a content network and served from an ordinary web address, so that a page showing thirty faces loads thirty images instead of reading thirty database records.

The practical consequence is worth stating plainly: anyone holding that address can open the image, whether or not they can see your profile. Replacing your avatar replaces the file, and deleting your account deletes it.

In shortPausing hides your profile and keeps everything. Deleting waits seven days, and you can cancel at any point before then.

Pausing hides your profile and signs you out of the game while keeping everything. Restoring it puts you back where you were.

Deleting waits seven days first. Through all seven you can cancel from the sign-in screen in a single click, and the countdown is on the screen every time you sign in. Deletion is the only decision here that cannot be walked back, so it is the one given the most time.

Pausing, restoring and deleting each ask you to confirm through a link sent to your email address, valid for ten minutes. Cancelling a deletion never does — the fire exit does not get a lock.

These actions are limited to a few a day. The limit protects a shared email allowance, not you, and cancelling a deletion is never refused by it.

In shortEverything we hold goes, except a record of your @handle kept so nobody can take it. Stripe keeps its own payment record, and a browser keeps its part of your saves until you clear it.

After the seven days: your progress and collection, your Skyth, relics and purchase history, your settings, your avatar image, your display name, your bio, your showcase, your achievements and standing, every post, thread and reply you wrote (and the replies inside your threads), your likes, and every follow relationship — including the copy of it held on the profile of everyone who followed you.

Then the sign-in record itself, which is what removes your email address. It is not disabled or flagged; it stops existing, and the address is free to make a new account with.

One thing survives on purpose: a record holding your @handle, your account's internal id, and the date. It keeps the handle from being taken by somebody claiming to be you, and it stops every reference elsewhere from pointing at nothing. It contains nothing that identifies a person — your email was never in it, and the record that held your email is gone.

Two things are outside our reach. Stripe keeps its own record of any payment, as payment providers must. And what a browser keeps for your saves stays in that browser until its data for the site is cleared.

In shortThe players in your room see your name, where you are and your fights, while you're in it.

In an online room, the other players (up to four) see your display name, where you are, and the fights you're in, as it happens. It travels over Firebase's live database and is removed when you leave the room.

Progress in the online world is kept with the rest of your game.

In shortWe don't sell your data or show ads.

We don't sell your data. We don't show ads against it. We don't collect more than the service needs to run.

In shortEdit your profile in Settings, see purchases in Billing, and pause or delete in Account.

Your display name, bio, avatar, showcase and preferences are editable in Settings, and your profile page shows you exactly what other players see.

Every purchase is listed in Settings → Billing.

Pausing and deletion are in Settings → Account → Danger zone.

In shortWrite to support@skylith.io, from the address you sign in with.

Questions about your data, or a request about it: support@skylith.io. Write from the address you sign in with, so we can find your account without asking you for anything else.