Privacy Policy

Account

When you create an account we store your email address, a hashed password (not the password itself), a username, whether your email is verified, your role, and whether the account is active or closed. We also store the times the account was created and updated. Verification and password-reset links use short-lived tokens that are cleared after they are used or expire.

An account that is never verified is removed automatically. If you delete your account from Profile, it is closed, you are signed out, and the account is permanently removed after 60 days. A closed account cannot sign in.

Profile

You can optionally save a birthday, country, gender, language, and street address. These stay on your account until you change them or delete the account. The address field can suggest places through Google Maps when that feature is configured. If it is not configured, it is an ordinary text box and nothing is sent to Google.

Todos, messages, and scores

Todos store the task text, whether it is done, and which account owns it. Messages store the text, the sender, the receiver, and whether the message was read. They are available to the two accounts in the conversation.

Snake stores a username and a score. The public leaderboard shows the top scores with a shortened username.

Image conversion

When you convert an image, your browser sends the file to api.drunkwallaby.com and downloads the result. This website does not keep the image. The conversion service is not designed to retain the file after it returns the result. The result is a new image file, so the original EXIF metadata — including camera location — is not included.

Logs

The site records client logs so problems can be diagnosed. A log can include a message, a level, extra context, a stack trace, the page URL, your browser's user agent, and your account id if you are signed in. Page views are logged as the path you opened. These logs are deleted after 14 days.

Cookies and storage on this device

The site sets three cookies so the account can stay signed in. None of them is an advertising cookie, so there is no cookie banner. The access token is not stored in local storage.

• accessToken is httpOnly, Secure in production, and SameSite=Lax. It lasts 15 minutes. The site sends it automatically with requests to this site.
• refreshToken is httpOnly, Secure in production, and SameSite=Lax. It lasts seven days and is used to issue a new access token.
• csrfToken is not httpOnly, so the browser can send it on requests that change data. It is Secure in production, SameSite=Lax, and lasts seven days.

Your theme choice (light, dark, or match the system) is kept in local storage. That is functional storage, not a cookie.

Other services

• Google Maps may receive the address text you type on Profile, and the place you pick, when address suggestions are enabled. Choosing a suggestion can fill the address and country stored on your profile.
• Stripe handles checkout and the billing portal if you upgrade or manage a plan. We store a Stripe customer id, the plan name, and the subscription status. Card details are entered on Stripe, not on this site.
• Resend sends verification and password-reset email to the address on the account.
• Pusher can deliver messages in real time between signed-in people.
• Vercel Web Analytics and Speed Insights measure pages and performance. They are provided without cookies.
• Account data, messages, todos, scores, and logs are stored in a database hosted for the site.

Your choices

You can update your profile and password from Profile, and you can delete the account there. An active paid subscription has to be cancelled in billing before the account can be deleted. Questions about this policy can go to the operator linked on the home page, tbellenger.

Back to home