Privacy

What DANKGAME keeps, where, and for how long. Your progress lives in your own browser. The game’s server keeps three things, each only after you ask for it: a run you post to the Daily board, a save you move to another device, and a duel you play with a friend. None of the game’s services ever writes an e-mail address, a password or an IP address to disk. Each line below describes what the server code does today.

Sign-in is not switched on yet

There is no account to make and nothing to sign in to on dankgame.com today. The account service (guest accounts, passkey and Google sign-in) is written and tested, but sign-in is not switched on yet: it is not running on the live server, so it holds no one’s data. The account record below is what it will keep once it is switched on, and this page will say so on the day it is.

In your browser

At most ten keys in this site’s storage on your device (localStorage). They are written by the game on your device and read back by it; none of them is sent anywhere except as described under the Daily board and moving a save. About DANKGAME spells out every field inside each one.

• dankgame.settings.v1: sound, volume, motion, battle speed and the other settings you changed.
• dankgame.people: the people you last picked, vale or peatholm.
• dankgame.battle: the quick battle in progress, as its dice number, field, two armies and moves so far.
• dankgame.conquest: the Conquest match in progress, as its map, its number and every action so far. Removed when the match ends.
• dankgame.best: your best won Conquest score (and one for the Large map).
• dankgame.warpath: the highest Warpath level opened and a best score per level.
• dankgame.daily: your Daily streak and best score; once you post to the board, also a random device id (32 hex digits) and the name you typed.
• dankgame.duel: the practice duel against the computer in progress.
• dankgame.hold: your Stronghold’s materials, stages, trophies, bestiary counts, banner, title and veteran marks.
• dankgame.account: only once sign-in is switched on and you post a Daily run, the guest account id and token the account service gave this device; nothing while it is off.

Clearing this site’s data in your browser removes all ten. Nobody else, including us, can see or delete them.

On the game’s server

The Daily board: each run you post, for 30 days

Nothing is sent until you tap Post to today’s board. The server replays your moves and, for a run it accepts, appends one line to that day’s file holding: the name you typed, the people you led, the score, the days taken, the lairs cleared, the troops lost (the last four worked out by its own replay), the list of moves, a sha-256 hash of your device’s random id (never the id itself) and the time it was accepted. Once sign-in is switched on, a run posted while signed in also carries your account’s id and whether it counted as official. Each day’s file is deleted 30 days after that day. Your address is used only to count posts per hour, in memory, and is gone when the server restarts. The board shows each run’s name, people, score, days, lairs and troops lost to anyone who opens it.

Moving a save: one file, at most 24 hours

Move my save to another device in Settings uploads a copy of up to eight of the browser keys above (all but dankgame.battle) and gets back an 8-character code. The server keeps the copy as one file named after the code. The file is deleted the moment the code is claimed on the other device, and a code nobody claims is deleted after 24 hours.

A duel with a friend: until it ends

While a friend duel runs, the server keeps one file for it so that a restart of the match server does not end it: the map’s number, the rules version, each seat’s people and a sha-256 hash of its seat key (never the key), every move both players made, and the time left on the clocks. No name, no address, no account. When the duel ends the file is marked over and deleted at the server’s next sweep once 30 minutes pass without a move (4 days for a Correspondence duel), or at its next restart, whichever comes first; an abandoned duel is deleted the same way. A practice duel against the computer never reaches the server.

The account record (once sign-in is switched on)

One small file per account, holding exactly these seven fields and nothing else; the code writes these seven whatever else it is sent:

• id: 32 random hex characters made by the server. It is not derived from anything about you.
• name: the display name you choose (the Daily board’s name rules), or empty until you pick one.
• providers: each sign-in attached to the account, as a provider and a subject: for Google, the account’s sub number from Google’s id token (your e-mail, name and picture in that token are dropped before anything is written, and the sign-in asks Google for no e-mail scope); for a passkey, its credential id.
• tokens: sha-256 hashes of the device tokens that sign in as this account, at most 20 (a 21st device drops the oldest). The token itself is handed to your device once and never written down on the server.
• created: the time the account was made.
• friendCode: an 8-character code of random letters and digits, made only the first time a signed-in player asks for one so a friend can add them; empty until then. It is not derived from your id or anything about you.
• friends: the account ids of the friends you have added, at most 200. Adding is mutual (each friend’s record lists you back) and removing a friend takes the id out of both records.

Beside it, an index file maps each token hash, each provider subject and each friend code to the account id so that a sign-in or an add-a-friend is one lookup, and a passkey adds one file holding its credential id, its public key and signature counter (the half that cannot sign anything) and the account id. A guest account starts with no name and no provider: just an id, one token hash and a time. The account service counts requests per address per hour in memory only.

Never on disk

No service of the game writes an e-mail address, a password or an IP address to disk. There are no passwords at all: a sign-in is a passkey on your device or Google, and the game never sees either secret.

Delete my account

The game shows no Delete my account button yet, because there are no accounts to delete. What it will call is the account service’s delete route, which needs the account’s own device token and removes, at once: the account’s file with its name, provider links, token hashes, friend code and friends list; every index entry naming it; its id on every friend’s list; and the key file of every passkey attached to it. The test for it reads every file the service keeps afterwards and finds neither the id, the hashes, the subject nor the name. One honest limit: a Daily run already posted while signed in keeps its account id until its day’s file is deleted, at most 30 days later, because delete does not reach the board yet. Your browser’s ten keys are untouched by it; clear the site’s data to remove those.

Page counts

Page visits are counted by a GoatCounter instance at stats.dankdev.com, which records the page opened, where the visit came from, and the browser, screen size and country of the visit. It sets no cookie. There is no advertising on the site.