Privacy

What DANKGAME keeps, where, and for how long. Your progress lives in your own browser. The game’s server keeps three things, each only after you ask for it: a run you post to the Daily board, a save you move to another device, and a duel you play with a friend. None of the game’s services ever writes an e-mail address, a password or an IP address to disk. Each line below describes what the server code does today.

Sign-in is not switched on yet

There is no account to make and nothing to sign in to on dankgame.com today. The account service (guest accounts, passkey and Google sign-in) is written and tested, but sign-in is not switched on yet: it is not running on the live server, so it holds no one’s data. The account record below is what it will keep once it is switched on, and this page will say so on the day it is.

In your browser

At most twelve keys in this site’s storage on your device (localStorage). They are written by the game on your device and read back by it; none of them is sent anywhere except as described under the Daily board and moving a save. About DANKGAME spells out every field inside each one.

• dankgame.settings.v1: sound, volume, motion, battle speed and the other settings you changed.
• dankgame.people: the people you last picked, vale or peatholm.
• dankgame.battle: the quick battle in progress, as its dice number, field, two armies and moves so far.
• dankgame.conquest: the Conquest match in progress, as its map, its number and every action so far. Removed when the match ends.
• dankgame.best: your best won Conquest score (and one for the Large map).
• dankgame.warpath: the highest Warpath level opened and a best score per level.
• dankgame.daily: your Daily streak and best score; once you post to the board, also a random device id (32 hex digits) and the name you typed.
• dankgame.duel: the practice duel against the computer in progress.
• dankgame.duel.live: only while a duel against a friend is on, its id, your side, the seat token the Duel server gave you and when it was written, so a reload can offer Back to your duel. Removed when the duel ends or you leave it.
• dankgame.hold: your Stronghold’s materials, stages, trophies, bestiary counts, banner, title and veteran marks.
• dankgame.account: only once sign-in is switched on and you post a Daily run or tap a way to sign in, the guest account id and token the account service gave this device (and, during a Google sign-in only, its one-time state code); nothing while it is off.
• dankgame.funnel: the names of the first steps this device has already counted (see Counts), so each is counted once. Never sent.

Clearing this site’s data in your browser removes all twelve. Nobody else, including us, can see or delete them.

Counts

The game counts, without any id, how many players reach each of six first steps: opening the game, starting a first match, walking a first tile, starting a first lair battle, ending it (won or lost), and finishing a first match. It also counts every match started and finished. Each count is a bare event name such as dg-first-move added to the site’s own visitor counter (stats.dankdev.com): no cookie, no device id, no name, score or map. It is never sent from a test browser or a local copy of the game.

On the game’s server

The Daily board: each run you post, for 30 days

Nothing is sent until you tap Post to today’s board. The server replays your moves and, for a run it accepts, appends one line to that day’s file holding: the name you typed, the people you led, the score, the days taken, the lairs cleared, the troops lost (the last four worked out by its own replay), the list of moves, a sha-256 hash of your device’s random id (never the id itself) and the time it was accepted. Once sign-in is switched on, a run posted while signed in also carries your account’s id and whether it counted as official. Each day’s file is deleted 30 days after that day. Your address is used only to count posts per hour, in memory, and is gone when the server restarts. The board shows each run’s name, people, score, days, lairs and troops lost to anyone who opens it.

Moving a save: one file, at most 24 hours

Move my save to another device in Settings uploads a copy of up to eight of the browser keys above (all but dankgame.battle) and gets back an 8-character code. The server keeps the copy as one file named after the code. The file is deleted the moment the code is claimed on the other device, and a code nobody claims is deleted after 24 hours.

A duel with a friend: until it ends

While a friend duel runs, the server keeps one file for it so that a restart of the match server does not end it: the map’s number, the rules version, each seat’s people and a sha-256 hash of its seat key (never the key), every move both players made, and the time left on the clocks. No name, no address, no account. When the duel ends the file is marked over and deleted at the server’s next sweep once 30 minutes pass without a move (4 days for a Correspondence duel), or at its next restart, whichever comes first; an abandoned duel is deleted the same way. A practice duel against the computer never reaches the server.

Move alerts: only if you switch them on

The game page registers a small service worker, /sw.js. It does exactly two things: show a notification when the match server pings this browser, and open the Duel page when you tap that notification. It has no fetch handler and never uses the browser’s cache, so it stores no page and can never serve an old copy of the game. Until you switch an alert on it is never woken. (Add to Home Screen reads /manifest.webmanifest, the game’s name, colours and icon; it stores nothing.)

On a Correspondence invite the Duel panel shows Tell me when it’s my move, but only once the match server has alerts set up; today it does not, so the switch is not shown. Notification permission is asked only when you tap it, never on load. If you allow it, your browser makes a push subscription and the server keeps exactly these fields, in one file beside that duel’s own file:

• endpoint: an address at your browser maker’s push service (Google, Mozilla, Apple or Microsoft) that delivers to this browser;
• keys: the two keys (p256dh, auth) that go with it;
• zone: your device’s time zone name, such as Europe/Paris, so an alert due between 22:00 and 08:00 your time waits until 08:00;
• at: when it was saved.

No name, no account, no address. It is deleted when you switch the alert off, when the duel ends, when your seat is claimed, when the push service says the subscription is gone, or with the duel’s file. Each alert is empty: it carries nothing about the duel, and your device shows the fixed sentence It is your move in your dankgame Duel. Alerts come at most once for each new duel day, and once when the final battle needs your move.

The account record (once sign-in is switched on)

One small file per account, holding exactly these seven fields and nothing else; the code writes these seven whatever else it is sent:

• id: 32 random hex characters made by the server. It is not derived from anything about you.
• name: the display name you choose (the Daily board’s name rules), or empty until you pick one.
• providers: each sign-in attached to the account, as a provider and a subject: for Google, the account’s sub number from Google’s id token (your e-mail, name and picture in that token are dropped before anything is written, and the sign-in asks Google for no e-mail scope); for a passkey, its credential id.
• tokens: sha-256 hashes of the device tokens that sign in as this account, at most 20 (a 21st device drops the oldest). The token itself is handed to your device once and never written down on the server.
• created: the time the account was made.
• friendCode: an 8-character code of random letters and digits, made only the first time a signed-in player asks for one so a friend can add them; empty until then. It is not derived from your id or anything about you.
• friends: the account ids of the friends you have added, at most 200. Adding is mutual (each friend’s record lists you back) and removing a friend takes the id out of both records.

Beside it, an index file maps each token hash, each provider subject and each friend code to the account id so that a sign-in or an add-a-friend is one lookup, and a passkey adds one file holding its credential id, its public key and signature counter (the half that cannot sign anything) and the account id. A guest account starts with no name and no provider: just an id, one token hash and a time. The account service counts requests per address per hour in memory only.

Never on disk

No service of the game writes an e-mail address, a password or an IP address to disk. There are no passwords at all: a sign-in is a passkey on your device or Google, and the game never sees either secret.

Delete my account

The game shows no Delete my account button yet, because there are no accounts to delete. On the day sign-in is switched on it appears in Settings, beside Erase all progress, whenever this device holds an account. It asks you to confirm, then calls the account service’s delete route, which needs the account’s own device token and removes, at once: the account’s file with its name, provider links, token hashes, friend code and friends list; every index entry naming it; its id on every friend’s list; and the key file of every passkey attached to it. The test for it reads every file the service keeps afterwards and finds neither the id, the hashes, the subject nor the name. One honest limit: a Daily run already posted while signed in keeps its account id until its day’s file is deleted, at most 30 days later, because delete does not reach the board yet. On your device it then removes dankgame.account; the other keys are untouched by it, so clear the site’s data to remove those.

Page counts

Page visits are counted by a GoatCounter instance at stats.dankdev.com, which records the page opened, where the visit came from, and the browser, screen size and country of the visit. It sets no cookie. There is no advertising on the site.