SeventidePrivacy policy
In short
- Solo and private rooms require no account. Optional ranked play uses Sign in with Apple to keep a recoverable rating. There are no ads or tracking tools.
- Playing against bots or passing one device around works entirely on your device. Nothing is sent anywhere.
- Online rooms keep a room code, the names players type, the match itself and the room's chat on our server, and delete them after a few days of inactivity.
- In the iOS app, if you allow notifications, your device's push token is kept with your seat so we can tell you when it's your turn. Signed in, your online seats are linked to your account so you can continue on another device.
- We do not sell data or share it for advertising, and we do not use it to track you across other apps or websites.
What stays on your device
The game saves in your browser's or app's local storage so you can resume: your in-progress local match, the name you last typed, display preferences (view mode, bot pace, and similar), whether you have seen the introduction, and, for online rooms you joined, a secret seat token that lets you return to your seat. It also keeps a small buffer of gameplay events (such as rolls and builds) for debugging. In the released game this buffer is never uploaded; it only exists on your device. You can remove all of it by clearing the site's data in your browser, or by deleting the app.
What online play stores on our server
Only when you create or join an online room, the server (hosted on Fly.io, in a SQLite database) stores:
| Data | Why |
|---|---|
| The room code and its status | So players can find and rejoin the room. |
| The names players type (any name; no real name is required) | To show who is who at the table. |
| A one-way hash of each seat token (the token itself is not stored) | To recognise a returning player without accounts. |
| The match's moves and current state | To run the game and resume it after a restart. |
| Chat messages written in the room (the latest 100), with the name shown beside each and, for someone watching, a one-way digest of a random key their device made | To show the room's chat to the people in it. Crude words are replaced before a message is stored. You agree to the chat's code of conduct before you can read or write, and you can turn chat off in Settings. |
| Chat reports: the reported message, up to ten messages before it, the room code and the reporter's display name | So we can look into a report. Kept for up to 90 days, even after the room is deleted. |
| iOS app, if you allow notifications: your device's Apple push token, the seat it belongs to and whether you also want chat notifications | To tell you when it's your turn, someone offers you a trade, or (if you choose) someone writes in the chat, while you're in another app. Deleted with the room, or when you turn notifications off. Your page also tells the server whether it is on screen (this is not stored) so notifications only come while you're away. |
| If you're signed in (Sign in with Apple, as for Ranked): which account each of your seats belongs to | So you can continue an online game on your other signed-in devices. Removed with the room, or when you delete your account. |
Your display name, seat credential and game actions are linked together within that room so the game can recognise your seat and resume your match. No real name is required; choose a nickname. This information is used for gameplay, not advertising or tracking across apps.
Rooms are deleted automatically after inactivity: lobbies that never start after 1 day, matches that nobody plays for 3 days, and finished matches 7 days after they end.
Optional ranked accounts
When ranked play is enabled, Sign in with Apple supplies a verified, app-specific identifier. We do not request your Apple name or email. We store a one-way identity binding, an internal account reference, a generated public sailor name, your rating, game totals, ranked match moves/results, and any reports or blocks you submit. This information is linked to your ranked account for gameplay, recovery, moderation and abuse prevention, not advertising.
The app stores its ranked refresh credential in the iOS Keychain on that device; short-lived access credentials stay in memory. The website uses an HttpOnly authentication cookie and a temporary sign-in cookie. The server stores credential hashes and encrypts the Apple refresh credentials needed for verification and revocation. Rated match state lives in PostgreSQL; ordinary invite rooms continue to use their separate room storage.
Ranked match records, detailed rating events and reports are retained for up to 90 days. An active account's aggregate rating, games and wins remain until the account is deleted. Choose Ranked → Account & privacy → Delete account to remove the profile, sign-ins and identity bindings and request revocation of Apple access. If Apple is unavailable, encrypted revocation work is retried. An unfinished match continues with its original account reference; a one-way identity hold prevents opening another account while it remains active. That hold is removed after the activity ends. Remaining match-linked records expire within 90 days. Our Fly Managed Postgres database keeps encrypted backups on a ten-day recovery window. Temporary encrypted recovery copies are deleted after verification and are never retained longer than 30 days.
Deleting the app alone does not delete a ranked account or necessarily remove its Keychain sign-in. Use the in-app account deletion control. Signing out clears this app's saved ranked refresh credential; signing out all devices revokes the account's server sessions.
Server logs and network data
When you connect, your IP address is visible to the server and to Fly.io's network proxy, as for any website. For invite rooms, the game server uses it in memory to limit room requests. Ranked stores a keyed one-way digest for shared rate limits, removed within one day; it does not store the raw IP address in its database or application logs. The server's own log lines contain room codes and error messages. Fly.io may keep standard infrastructure request logs under its own policies. The game itself contains no third-party scripts, fonts, trackers or advertising, and uses Apple’s authentication service only when you choose ranked sign-in. The Share button creates a public result link containing the players’ display names, final scores, mode, island and points target, and opens your device’s share sheet. Anyone with that link can read the summary; our server renders its preview when the link is opened or previewed. It contains no private hands, account credentials, game seed or rating history. Shared links are not stored as database records, but recipients and messaging services may keep copies.
Children
Solo and private rooms require no account. Seventide does not ask for a real name or email address and shows no ads or purchases. Online rooms have a chat between the people in the room: crude words are hidden automatically, anyone can be muted or reported, and chat can be turned off in Settings. Ranked requires a recoverable Apple sign-in and uses a generated public sailor name. Online play stores the display name and game information described above. A display name is visible to others in the same room; use a nickname rather than personal details.
Your choices
- Play solo or pass-and-play and no data leaves your device.
- Clear the site's data to remove browser-local saves. In the app, sign out of ranked to clear its Keychain credential; deleting the app removes its ordinary local saves.
- To ask about, or have us delete, an online room, contact us with the room code (below). Rooms also expire on their own as described above.
Changes and contact
If this policy changes we will update the date at the top. Questions: aj8uppal@gmail.com. See also the support page.