Privacy

Local game data

CreditQuest works without an account. The browser stores save progress and preferences on your device so that you can resume the game and keep settings such as audio, display, tutorial, and control choices. This information stays in browser storage unless you use a network feature described below. Clearing site data removes it from that browser.

Optional free accounts and cloud saves

Creating an account stores your username, email address, a salted password hash, session-token hashes, and a copy of your adventure progress on the CreditQuest server. Signup carries over both browser save slots, backup checkpoints, chapter unlocks, and tutorial progress. Your username is public on the relay. Your email address, password, and cloud saves are not shown on the relay and are not sent to product analytics.

A necessary HttpOnly session cookie keeps you signed in for up to 30 days. On HTTPS it is marked Secure and SameSite=Strict. Signing out revokes that session and keeps your local browser progress. Cloud saves update while you are online; offline progress stays local until it can sync. Conflicting browser and account saves require a choice before either is replaced, and restoring an account save keeps a previous-browser recovery copy on your device.

Account data and cloud progress remain until you request deletion using the contact address below. Keep your password in a password manager; this version has no automated password reset. On a shared device, download your backup and clear site data after signing out to remove the local copy.

Shared relay features

A free account is optional for playing and required to participate in the shared relay. While you are signed in and actively playing online, the relay feature may send your account runner identifier, public username and color, current map, approximate in-game position, facing direction, appearance, weapon, and game state to the CreditQuest server. This allows nearby ghost runners and the online count to appear. Guests can read the relay board.

Presence is kept in server memory and expires after roughly 12 seconds without a heartbeat. The server keeps at most 80 recent relay messages in memory. Messages include the runner identifier, display name, color, text, and time, are visible to other connected players, and disappear when the server process restarts. Do not put personal or sensitive information in a relay message.

Hosting and network delivery

The hosting and network providers necessarily process ordinary connection information—such as IP address, request time, requested path, browser headers, and security signals—to deliver and protect the site. The CreditQuest application does not maintain its own persistent access-log database. Provider-level logging and security retention are controlled by the hosting account and infrastructure.

Analytics design

CreditQuest uses a first-party analytics service on the game's hosting infrastructure. Events travel through the game's own server to a private reporting database. No third-party analytics SDK is loaded. The adapter creates one random identifier in memory for the current page only; it is not written to cookies or browser storage and changes when the page is reloaded. The collector hashes session and event identifiers with a private salt before storage. Reports count anonymous sessions, not identifiable people or cross-visit retention.

The event set is limited to the first rendered frame, run started or resumed, tutorial progress, qualified first play, selected progression milestones, chapter completion, map entries, defeats and coarse recovery paths, game over, and coarse active-play thresholds. We also collect a rounded time to the first frame and one coarse gameplay smoothness sample after 30 seconds of visible active play. These measurements contain no device model, hardware details, or browser fingerprint. Collection runs only on the secure production site and fails closed for Global Privacy Control, Do Not Track, automated testing, local development, or an invalid configuration.

Data that analytics must not receive

• Runner names, relay identifiers, relay messages, or other free text.
• Save files, browser-storage contents, quest objects, or dialog text.
• Exact in-game coordinates or frame-by-frame combat activity.
• Full URLs, raw query strings, advertising click identifiers, email addresses, or full referrers.
• Console logs, arbitrary errors, or automatically captured page content.

Campaign attribution

Approved campaign tags may be read into memory after strict validation and attached to the game-loaded event. The reported fields are source, medium, campaign, and content; they describe the promotion link, not a person. An external referrer may be reduced to its hostname. These fields let us compare meaningful play within the same anonymous page session. Keyword terms, raw query strings, full referrers, and advertising click identifiers are not retained, and campaign or click parameters are removed from the visible URL.

Retention and choices

Local saves and preferences remain until you clear them. Relay presence and messages follow the short-lived limits above. Native analytics events are retained for up to 90 days, with a maximum of 500,000 events; older events are removed as those limits are reached. Historical PostHog data remains separate in the existing project under its prior retention settings and is not copied into the native database.

You can prevent optional analytics collection by enabling Global Privacy Control or Do Not Track in a compatible browser. These choices do not stop necessary local saves or relay requests that you actively use.

For privacy questions, objections, or deletion requests, email ianwalmsley@ianlan.net. Because the analytics identifier is random, page-scoped, and not retained in your browser, CreditQuest may be unable to associate a past event with you; that limitation is intentional and prevents cross-visit profiling.

Changes to this notice

Updated October 25, 2026: creating an account now stores an email address with the account. The address is not shown on the relay and is not sent to product analytics. Guest play and local saves remain available without an account.

Updated October 17, 2026: optional free accounts add cloud saves and an authenticated relay identity. Guest play and local saves remain available without an account.

Updated September 6, 2026: coarse active-play checkpoints may include the current Chapter 1 story step for first runs, helping identify where players lose the route. This adds no recordings, coordinates, text input, or persistent identifiers. Material changes to analytics or network behavior will be documented here before those changes are enabled.

Updated October 17, 2026: native reports now include campaign-to-play conversion, actual map entries and defeats, and coarse first-frame and gameplay smoothness measurements. Collection continues to respect browser privacy signals. This adds no recordings, coordinates, text input, advertising pixels, or persistent visitor identifiers. New measurements begin when deployed; older PostHog history remains separate.