Privacy Policy

What stays in your browser

The game uses local storage for your saved one-screen match, backup saves, display name, remembered multiplayer seats, tutorial progress and audio or motion preferences. Session storage also holds seat access tokens and the page to return to after a tutorial. Local play does not require an account. When you sign in, an essential, HTTP-only session cookie keeps you signed in for up to 30 days. Temporary cookies secure Apple and Google sign-in.

What the multiplayer server stores

Starting or joining a remote game sends your display name and game actions to the server running this game. Its local SQLite database stores lobby seats, match setup, moves, timestamps, turn deadlines and game results. The server stores a cryptographic hash of each seat token; the usable token is kept by your browser. The person running the server controls that database.

What other players see

The lobby shows display names, open seats and game progress. Players can see the public board and turn history. Private hands, deck order and missions are hidden from other seats during play; missions are revealed for final scoring. The server operator can access the underlying records.

Connections and sharing

This build loads its game assets from its own server. If you sign in with Apple or Google, that provider authenticates you and sends a stable account identifier and, when available, your verified email address. Email-code sign-in uses Resend to deliver the code. We store provider identifiers, your chosen player name, email addresses, preferences and sessions; Apple refresh tokens are encrypted so we can revoke access when you delete your account. We do not automatically merge accounts with matching email addresses. The server receives ordinary connection information when your browser requests pages or submits moves. This version has no application access-log feature. Any separate hosting or proxy logs are controlled by the person running that infrastructure.

Phone notifications

If you enable phone notifications, we store an encrypted device delivery token linked to your signed-in account. Apple Push Notification service or Google Firebase Cloud Messaging delivers turn alerts and final-score notices. Notifications contain your player name and a game link, never your private hand or sign-in token. Firebase Analytics is not included. You can turn notifications off in account settings or your phone’s settings. Signing out or deleting your account removes that session’s notification registration.

Delete your Uneasy Crowns account

Open Account settings, sign in, then select Delete account and confirm. You can do this on this website without installing the app. If you cannot sign in, email [email protected] from your account email address to request deletion.

Browser saves and preferences remain until you clear this site’s data or overwrite them. Clearing site data also removes remembered seat tokens, so you may lose access to those seats. Multiplayer records remain in the server database; clearing your browser does not delete them. Deleting your account removes your account, linked sign-in methods, sessions, cloud saves and account access to remote seats. Shared game history, including player names recorded during the game, remains for the other players. Local saves remain until you clear this device’s site data. Backups are retained for 14 days.

To remove a cloud save without deleting your account, open your account, find the game under Saved one-screen games, and select Remove.

Cloud saves and security

Saving a local game to your account uploads its setup and moves. Further moves sync while you are signed in; changing devices requires opening the latest cloud save. Remote matches run on the server and are linked to your account. Sign-in attempt counters use keyed hashes of email addresses and connection addresses; expired codes and counters are periodically removed. Codes expire after 10 minutes and have limited attempts.

Optional usage analytics

You can opt in to Google Analytics on public website pages. It helps us understand page use and performance. It is off by default, does not run in the native app, and does not receive account identifiers, email addresses, private game content or URL query strings from us. Cloudflare and the hosting provider also process connection information to deliver and protect the site.

Changes and questions

This policy describes the current build. If its storage or services change, this page should be updated too. For privacy questions, contact [email protected].