Privacy
What this Cribbage server keeps about you, and why. It is a small game server: it keeps as little as it can.
What is stored
- Your account: your username and nickname. There is no password.
- Your email address. It is how you sign in: it is used only to send you sign-in codes, links to confirm a new address or deleting your account, and a notice if the address on your account changes. It is stored encrypted, with a key kept apart from the database, so a copy of the database or a backup does not reveal it. It is never shown to other players, shared, or used for anything else.
- Passkeys, if you add any: each one's public key, the name you gave it, and when it was added and last used. The private key never leaves your device or password manager.
- Your games: the players, the moves and the result of each game, for your history and your record against each opponent.
- Invites you send or receive, until they are answered or expire.
- Sessions: while you are signed in, a random token (stored only as a hash) lets your device reconnect. It lasts 90 days from the last time you used that device, or until you sign out, sign out your other devices, or the server's admin recovers your account.
What other players see
Your nickname, whether you are online, and the games you play with them. Anyone who knows your username can send you an invite. Nobody else sees your email address.
Your device
The web page keeps your session token and your settings (theme, sounds) in your browser's local storage. There are no cookies, ads, analytics or tracking, and the page loads nothing from other sites. The desktop app keeps the same things in its settings file.
Network addresses
Your IP address is used while you are connected, to connect the game (WebRTC) and to limit login attempts and connections. It is not stored with your account. It may appear in the server's logs in rare cases, such as a connection dropped for not keeping up.
The web page itself is served by Cloudflare Pages, which, like any web host, sees your IP address when it sends you the page.
Messages are sent through an email provider, which handles the address and the message like any email it delivers.
How long things are kept
- Your account, email address and games: until you delete your account.
- Sign-in codes and links: 15 minutes, and only once. They are kept only in the server's memory, never in the database.
- Other links in emails: an hour (deleting) or 48 hours (changing your address), and only once.
- Backups of the database are kept for up to a week, so for a week after you delete your account it may remain in a backup, with your email address encrypted.
Deleting your account
Open Settings → Account… and choose Delete account. If your account has an email address, a link is sent there and your account is deleted when you open it and confirm. Your unfinished games end (you resign those in progress), and your account, email address, passkeys and invites are removed. Games you finished stay in your opponents' history, shown as “Deleted player”. If you can't sign in, ask whoever runs the server to delete it for you.
Questions
Use the “Report a bug” link in the game, or ask whoever runs this server.