Privacy Policy
Applies to the game "Swords and Coins" and the website swordsandcoins.com. For any question, write to support@swordsandcoins.com.
What data we store
| Data | Why |
|---|---|
| Login (username) | Signing in, and showing your name to opponents in a match. |
| Password hash (never the password itself) | Verifying sign-in. Only a salted hash is stored; the plaintext password is never written to disk or to any log. |
| Email address — if you provided one | Address confirmation and password reset. Also used for a "turn computed" notice, but only if you turn that on yourself — see below. |
| Game saves (solo games and multiplayer lobby games) | So you can continue playing. |
| IP address | Written to the server's technical log on failed sign-ins and when a rate limit is hit, and to the web server's own access log for every request — both exist to slow down abuse (password guessing, spam registrations), not to track you. |
| Server technical log | Diagnosing failures and abuse. Passwords, session cookies, access tokens, and save contents are stripped out programmatically before anything is written — see "Cookies" below for what the session cookie itself is. |
How long we keep it
Account data and game saves are kept for as long as the account exists; delete the account and they're deleted with it. The server's technical log rotates automatically by size (a handful of capped files; old entries fall off as new ones are written) — we don't keep it longer than that rotation allows. The web server's own access log (which is where request IP addresses also end up) follows the ordinary rotation of the hosting system, not a fixed number of days we can promise here.
Who we don't share it with
We do not sell or share your data with third parties, with one exception: outgoing email is sent through the mail provider Amazon SES (EU region), so the recipient address and message text pass through it, as with any email service — undeliverable-mail and spam-complaint notices from SES are routed back to our own support address. Nobody else receives anything.
How to delete your account and data
Email support@swordsandcoins.com from the address on your account (or tell us your login) and ask for deletion. This is done by hand by an administrator, not automatically or instantly — we don't have a promised turnaround time to give you. It removes the account, its game saves (solo and multiplayer), and any mail/session data tied to it; if you're mid-game in a multiplayer lobby with other people, your seat is handed to the bot the same way it would be if you'd simply left, so the other players' game isn't broken.
Cookies
We use a single session cookie to keep you signed in. It's valid for up to 30 days and gets renewed while you're active, so it doesn't force a fresh login every month if you keep playing — but it isn't a permanent cookie either, and stops working if you don't return within that window. It's marked HttpOnly, meaning page scripts can't read it. There are no advertising, analytics, or tracking cookies on the site or in the game — we don't use Google Analytics or any other analytics or ad network.
"Turn computed" email — off by default
For multiplayer games with a long turn timer, we can email you when a turn has been computed. This is off by default: you have to turn it on yourself, with a checkbox in your account or lobby settings, and every such email includes a one-click unsubscribe link.
Guest play
You can play without registering: a guest game is tied to a random access token, and the server only stores its hash — no email or login required.