What changed on 9 October 2026

What Skylith stores, where it goes, and what leaving actually deleting your account removes. This describes the service as it is builtworks today. Questions about your data go to support@skylith.io.

Your game — your progress, your saves (the world each was played in, and where you stood), your collection, your scores, your Skyth and your relics.

Your purchases — what you boughtgot in the Shop, when, and what it cost, so Settings → Billing can show them. Never your We never receive card details: those go to Stripe and never reach us.

What you write — posts, threads and replies, shown to signed-in players with your name, handle and avatar beside them, and the posts you like.

Your settings — the preferences you set, so they follow you between devices.

In your browser — a copy of each save, so the game doesn't wait on the network. When you play signed in, it's brought together with the copy kept with your account. If more than one account plays in the same browser, each account's copy is kept apart and comes back when that account signs in again.

Your email address is never displayedshown to other players —: not on your profile, not on leaderboardsthe Ranks, nowhereor anywhere else.

It is not merely hidden. It is never written into your profile record at all, so there is no version of a bug or a permissions mistake that exposes it to another player. It exists in the sign-in system, and it is visible to the developers, only for running the service.

It isn't stored with your profile at all, so a mistake in what profiles show can't reveal it. It's kept in the sign-in system, and the people who run Skylith see it only when running the service requires it.

It leaves that system twice, each time for one job:The only other service it's passed to is Resend, when we send you an email, and to . While the Shop's Treasury was open, Stripe also received it when you buybought something, for the receipt.

Signing in with Google gives us your email address and nothing else. Your Google display name and your Google profile photo are notaren't copied, not or stored, and never they don't become your Skylith identity by default — those are frequently your name or picture unless you choose them. They're often a person's real name and your real face, andso that is your decision to make, not a defaultchoice is left to discover lateryou.

You choose a display name and a picture yourself when you set up your account. If you want to use your Google photo, there isthere's a button that asks for it plainly.

Google (Firebase) — sign-in, the database everything else is stored in, and the live connection online rooms run on.

Cloudflare — hosts the avatar images, runs the human check on the sign-in and play pages that keeps automated traffic out, and forwards email sent to our addresses (such as support@skylith.io) to the team's inbox.

Resend — sends account email. It sees the address a message is going to.

Stripe — takes card payments infor the Shop's Treasury. It The Treasury is closed, so nothing is sent to Stripe at the moment. When it's open, Stripe handles your card details, and is told which account is paying and your email address, for the receipt. We never see your card.

Vercel — runs the site itself.

That is the whole list. There is no analytics service, no advertising network and noor tracking beyond what these fiveservices need to work.

Avatar images are stored on a content delivery network and served from an ordinary web address, so that a page showing thirty faces loads thirty images instead of reading thirty database recordspages that show many players' pictures load quickly.

The practical consequence is worth stating plainly:This means anyone holdingwith that address can open the image, whether or not they can see your profile. Replacing your avatar replaces the file, and deleting your account deletes it.

Pausing hides your profile and signs you out of the game while keeping everything. Restoring it puts you back where you were.

Deleting waits seven days first. Through all sevenDuring that time you can cancel from the sign-in screen in a singlewith one click, and the countdown is on the screenshown every time you sign in. Deletion is the only decision here that cannot be walked back, so it is the one given the most time.

Pausing, restoring and deleting each ask you to confirm through a link sent to your email address, valid for ten minutes. Cancelling a deletion never does — the fire exit does not getneeds a locklink.

These actions are limited to a few a day. The limit protects a shared email allowance, not you, and cancelling, because the emails come out of a shared daily allowance. Cancelling a deletion is never refused by itlimited.

Called “What Deletion Actually Removes” before.

After the seven days: your progress, saves and collection, your Skyth, relics and purchase history, your settings, your avatar image, your display name, your bio, your showcase, your achievements and standing, every post, thread and reply you wrote (and the replies inside your threads), your likes, and every follow relationship —, including the copy of it held on the profile of everyone who followed you.

Then the sign-in record itself, which is what removesholds your email address. It is not disabled or flagged; it stops existingdeleted outright, and the address is free can be used to make a new account with.

One thing survives on purposerecord is kept: a record holding your @handle, your account's internal id, and the date. It keeps the handlestops anyone else from being taken by somebody claiming to be youtaking your handle. Apart from the handle, and it stops every reference elsewhere from pointing at nothing. It containsholds nothing that identifies a person —about you: your email was never in it, and the record that held your email is gone.

Two thingscopies are outside our reach. Stripe keeps its own record: the record Stripe keeps of any payment, aswhich payment providers must. And are required to keep, and the copy of your saves in a browser keeps, which stays in that browserthere until its that browser's data for thethis site is cleared.

In an online room, the other players (up to four) see your display name, where you are, and the fights you're in, as it happensthey happen. ItThis travels over Firebase's live database and is removed when you leave the room.

Progress in the online world is kept with the rest of your game.

You must be at least 13 to make a Skylith account (Terms of Service, Section 2), and we don't knowingly keep information about children under 13.

If we learn that an account belongs to a child under 13, we'll delete it and everything it holds. If you're a parent or guardian and think your child has an account, write to support@skylith.io.

We don't sell your data. We don't show ads against it. We don'tinformation or use it for advertising, and we only collect more than the servicewhat Skylith needs to run.

Your display name, bio, avatar, showcase and preferences are editable can be changed in Settings, and your profile page shows you exactly what other players see.

Every purchase is listed in Settings → Billing.

Pausing and deletion are in Settings → Account → Danger zone.