Privacy Policy

In shortYour sign-in, public profile, game and saves, purchases, writing and settings, plus a copy of your saves in your browser.

Your sign-in — your email address, and which methods you use to sign in. This is held by Firebase Authentication. Your email is never written into the game's own records.

Your public profile — @handle, display name, bio, avatar, the cards you choose to show off, whether your email has been verified, your achievements, your standing on the Ranks boards, and tags such as Alpha tester or a staff rank. Other signed-in players can see all of it.

Your game — your progress, your saves (the world each was played in, and where you stood), your collection, your scores, your Skyth and your relics.

Your purchases — what you got in the Shop, when, and what it cost, so Settings → Billing can show them. We never receive card details.

What you write — posts, threads and replies, shown to signed-in players with your name, handle and avatar beside them, and the posts you like.

Your settings — the preferences you set, so they follow you between devices.

In your browser — a copy of each save, so the game doesn't wait on the network. When you play signed in, it's brought together with the copy kept with your account. If more than one account plays in the same browser, each account's copy is kept apart and comes back when that account signs in again.

In shortYour email is never shown to other players or written on your profile. The only other service that receives it is Resend, which sends our emails.

Your email address is never shown to other players: not on your profile, on the Ranks, or anywhere else.

It isn't stored with your profile at all, so a mistake in what profiles show can't reveal it. It's kept in the sign-in system, and the people who run Skylith see it only when running the service requires it.

The only other service it's passed to is Resend, when we send you an email. While the Shop's Treasury was open, Stripe also received it when you bought something, for the receipt.

In shortSigning in with Google gives us your email and nothing else. Your Google name and photo are never copied unless you ask.

Signing in with Google gives us your email address and nothing else. Your Google name and profile photo aren't copied or stored, and they don't become your Skylith name or picture unless you choose them. They're often a person's real name and face, so that choice is left to you.

You choose a display name and a picture yourself when you set up your account. If you want to use your Google photo, there's a button that asks for it.

In shortGoogle (Firebase), Cloudflare, Resend and Vercel handle data to run Skylith, and Stripe will when the Shop sells things for money. No analytics, ads or trackers.

Google (Firebase) — sign-in, the database everything else is stored in, and the live connection online rooms run on.

Cloudflare — hosts avatar images, runs the human check on the sign-in and play pages that keeps automated traffic out, and forwards email sent to our addresses (such as support@skylith.io) to the team's inbox.

Resend — sends account email. It sees the address a message is going to.

Stripe — takes card payments for the Shop's Treasury. The Treasury is closed, so nothing is sent to Stripe at the moment. When it's open, Stripe handles your card details and is told which account is paying and your email address, for the receipt. We never see your card.

Vercel — runs the site itself.

There is no analytics service, advertising network or tracking beyond what these services need to work.

In shortYour avatar is a public image: anyone with its address can open it.

Avatar images are stored on a content delivery network and served from an ordinary web address, so pages that show many players' pictures load quickly.

This means anyone with that address can open the image, whether or not they can see your profile. Replacing your avatar replaces the file, and deleting your account deletes it.

In shortPausing hides your profile and keeps everything. Deleting waits seven days, and you can cancel at any point before then.

Pausing hides your profile and signs you out of the game while keeping everything. Restoring it puts you back where you were.

Deleting waits seven days. During that time you can cancel from the sign-in screen with one click, and the countdown is shown every time you sign in.

Pausing, restoring and deleting each ask you to confirm through a link sent to your email address, valid for ten minutes. Cancelling a deletion never needs a link.

These actions are limited to a few a day, because the emails come out of a shared daily allowance. Cancelling a deletion is never limited.

In shortEverything we hold goes, except a record of your @handle kept so nobody can take it. Stripe keeps its own payment records, and a browser keeps its copy of your saves until you clear it.

After the seven days: your progress, saves and collection, your Skyth, relics and purchase history, your settings, your avatar image, your display name, your bio, your showcase, your achievements and standing, every post, thread and reply you wrote (and the replies inside your threads), your likes, and every follow, including the copy held on the profile of everyone who followed you.

Then the sign-in record itself, which holds your email address. It is deleted outright, and the address can be used to make a new account.

One record is kept: your @handle, your account's internal id and the date. It stops anyone else from taking your handle. Apart from the handle, it holds nothing about you: your email was never in it, and the record that held your email is gone.

Two copies are outside our reach: the record Stripe keeps of any payment, which payment providers are required to keep, and the copy of your saves in a browser, which stays there until that browser's data for this site is cleared.

In shortThe players in your room see your name, where you are and your fights, while you're in it.

In an online room, the other players (up to four) see your display name, where you are and the fights you're in, as they happen. This travels over Firebase's live database and is removed when you leave the room.

Progress in the online world is kept with the rest of your game.

In shortSkylith isn't for children under 13. If we learn that an account belongs to one, we delete it.

You must be at least 13 to make a Skylith account (Terms of Service, Section 2), and we don't knowingly keep information about children under 13.

If we learn that an account belongs to a child under 13, we'll delete it and everything it holds. If you're a parent or guardian and think your child has an account, write to support@skylith.io.

In shortWe don't sell your data or show ads.

We don't sell your information or use it for advertising, and we only collect what Skylith needs to run.

In shortEdit your profile in Settings, see purchases in Billing, and pause or delete in Account.

Your display name, bio, avatar, showcase and preferences can be changed in Settings, and your profile page shows you exactly what other players see.

Every purchase is listed in Settings → Billing.

Pausing and deletion are in Settings → Account → Danger zone.

In shortWrite to support@skylith.io, from the address you sign in with.

Questions about your data, or a request about it: support@skylith.io. Write from the address you sign in with, so we can find your account without asking you for anything else.