Privacy

Satoshi.game · last updated 21 October 2026 · material changes will be announced in-game, and by email if you linked one.

Satoshi.game is a solo project. There are no third-party analytics. This page describes everything the game stores, and who else sees what along the way.

Playing without an account

The game runs entirely in your browser and saves to your browser's local storage. If cloud saves are not configured in the build you are playing, nothing ever leaves your device.

Your account

With cloud saves on, the game creates an anonymous account for you automatically — no sign-up, no email. It is a random identifier held by our hosting provider, Supabase, and it exists only to tell your save apart from someone else's.

If you choose to link an email address so you can move your game to another device, that address is stored by Supabase and used to send you sign-in links. Linking an email means your account is no longer anonymous to us.

Other emails are opt-in, one topic at a time. There are two, and each is a separate choice — saying yes to one is not saying yes to the other:

Major updates — major releases and new seasons, a few times a year at most.
Offers — new paid packs, sales and store promotions, a few times a year at most.

We send them only if you ask us to, by switching the topic on under Email preferences in Settings, either when you link an email or any time after. Both start off. We keep a record of each choice, when you made it and the exact wording you agreed to, so we can show what you said yes to. You can switch either off in Settings at any time, or use the unsubscribe link in any such email, which lets you leave one topic or both; either way, they stop.

Account and legal notices are not optional. If you linked an email, we will also use it to tell you about material changes to these terms or this privacy policy, whatever your topic choices — you have a right to know about those while you hold an account. Such notices carry no promotions. If you play as a guest, you see the same announcement in-game instead.

Your game save

While you play, the game uploads your save roughly every five minutes, and once more when you close the tab. We store:

The save itself — your complete game state, including anything you write in the terminal's NOTES tab. Notes are stored as plain text with the rest of the save, so keep passwords and personal details out of them.
A history of every upload: when it happened (by our server's clock), how large it was, and a checksum. It contains no copy of your game — only those checksums, which is how we detect that a save has been altered or corrupted. Entries older than 14 days are deleted.
Anti-cheat data — the game sends a log of the actions you took since the last upload, and the server re-runs them to check the result matches. The verdict is stored with your save.
Your player code — a random 12-character address you can share with other players. It is deliberately not derived from your account identifier, so sharing it reveals nothing about your account.

We also analyse saves to improve the game. Save data is used to find bugs and crashes, and to see where the game is too hard, too slow or broken — questions about the game, not about you. Like the progression data below, it is tied to your account identifier, not to your name or email, and it is not shared with anyone.

Invite links

If you open the game through someone's invite link, we store which account invited you — two account identifiers and the player code from the link, nothing else. Both of you receive 1 GP once you link and confirm an email. Nothing about you is shown to the person who invited you: they see a count of how many invites have been rewarded, never who accepted, and never your email or player code.

The record is kept even after one of the accounts is deleted, with the deleted side's identifier removed. Two reasons, and both are about fairness rather than record-keeping: it is what stops the reward being farmed by deleting and re-inviting, and it is what keeps your record of GP you legitimately received from disappearing because somebody else closed their account.

You are never sent an email because of an invite link. We do not email anybody on anybody else's behalf.

Country

Our host tells our server the two-letter country code your request came from, and we store that so we can see roughly where players are.

We do not store your IP address. Vercel, Supabase and Sentry necessarily see it in order to route your request, as any web host does. It is never written to our database.

Your device

Every browser sends a line of text with each request describing itself. We read it and keep three coarse labels from it: the operating system (Windows, macOS, iOS, Android, ChromeOS or Linux), whether you are on a phone, a tablet or a computer, and which browser you use. That tells us what the game has to run well on — whether the mobile layout is worth the work, and which browsers a new feature has to support.

The line itself is never stored. It also contains version and build numbers, which together can help identify a specific device; we discard all of it and keep only the three labels above, with no version anywhere. If we cannot recognise one of them, we store “unknown” rather than guessing.

How you found us

The first time you open the game, your browser tells the page which site you arrived from. We reduce that to one word — Reddit, Discord, YouTube, Twitch, itch.io, galaxy.click, Hacker News, X, a search engine, “other”, or “direct” if there was nothing to read — and store that word. If we linked to the game with a campaign tag of our own (something like launch-post-1, naming the post or ad, never the person), we store that tag too. It tells us which places are worth posting in, and which send people who actually stay.

The address itself is never stored. A full referring address can contain a page, a search term, or a link only you were sent; your browser discards all of it before anything is sent to us, and only the single word above ever leaves the page. It is written once, on your first visit, and not updated afterwards.

Progression data

With each upload we record a snapshot of how far you have got: block height, BTC mined, cash earned, soft forks, playtime, peak compute, and which achievements, technologies, unlocks and buildings you have. We use this to find where the game is too hard, too slow, or broken. It is tied to your account identifier, not to your name or email.

Purchases

Payments are taken by Stripe, which sells to you as merchant of record. You type your card or other payment details into Stripe's own checkout page; they never pass through our server and we never see them. Stripe handles them under its own privacy policy.

When a payment completes, Stripe tells us what was bought. We record that with the amount and currency, Stripe's order number and your account identifier. The record holds no name, address or email: whatever you enter at the checkout stays with Stripe. We keep it so that a purchase can be refunded, a disputed payment answered, and a missing item restored.

Advertising

The game shows advertising in a panel beside the play area. Ads are chosen without your save, your account or your email: nothing the game stores about you is passed to an advertiser.

Error reports

When the game crashes, an error report goes to Sentry, our error-tracking provider. It includes the error, your browser and version, a snapshot of your progress, and a video-style replay of roughly the 30 seconds before the crash.

A short report also goes to Sentry when a request to our server fails on the hosting side (a timeout, for example). It names the failure, the part of the game's server it hit and the host's request number, plus your browser and a snapshot of your progress. It carries no replay, and only a limited number are sent per visit.

Replays are captured only when there is an actual error — never during normal play — and only we can see them. The game screen is generated by the game itself and contains no personal content; the two places where personal data could appear on screen (the email field and your player code) are masked out of replays.

These reports carry no account identifier — we don't attach your account to them, which is why they aren't linked to you, and also why they can't be individually located and removed on request. They age out on Sentry's own schedule (currently 90 days).

How long we keep things

Your current save, progression snapshot, device labels and the word for how you found us: as long as your account exists.
Upload history (checksums only): 14 days.
Encrypted backups of the database: 14 days. They are kept outside the database and can only be read with a key that is not stored with them.
An invite record: kept even after either account is deleted, with the deleted side's identifier removed — see Invite links above.
A purchase record: kept after your account is deleted, with your account identifier removed, because a payment can be refunded or disputed long after it was made.
Which days you played: kept while your account exists. One row per day, with no detail beyond the date.
Sentry error reports and replays: on Sentry's own schedule, currently 90 days.
A scheduled deletion: removed together with your account when the 30-day purge runs.
Your email topic choices: as long as your account exists. While you are opted in to at least one topic, your address is also held on Resend's mailing list with the topics you chose; opting out of both or deleting your account removes it from there the next time we send.

Deleting your account

Sign out on this device in Settings removes the game and account from that browser only — your cloud save stays. It is not deletion.

Delete account in Settings schedules your account and your game data — your save, its upload history, your player code and your progression snapshot — for permanent deletion, and wipes this device right away. After 30 days it is removed for good. Our encrypted database backups are kept for 14 days, so within two weeks of that it is gone from those as well.

You have those 30 days to change your mind: sign in again with a link and the deletion is cancelled. A guest account has no email attached, so it cannot be signed into again — which means a guest cannot cancel their own deletion. If you might want to, link an email before deleting. As a last resort a guest can email us their player code before the 30 days are up to ask for a reversal; without that code there is no way to tell which account was yours.

Who processes your data

Vercel — hosting and request routing (sees your IP)
Supabase — database and account storage (sees your IP)
Sentry — error reports and crash replays (sees your IP)
Resend — sends sign-in links, account and legal notices and, if you opted in, update and offer emails (sees your email address)
Stripe — payments, as merchant of record (sees your IP, your payment details and the email you buy with)

Terms

The rules for using the game — including the fact that no real cryptocurrency is involved — are in the terms.

Contact

Questions, or a deletion request: support@satoshi.game