Privacy Policy

1. Information we collect

Nothing about you. TapSlayDie does not collect your name, email address, phone number, postal address, contacts, photos, camera or microphone input, calendar, health data, precise or coarse location, advertising identifiers, browsing history, or any other information of that kind. It asks the operating system for permission to access none of them, with one exception that only you can set off: on iPhone, if you save a character's shared picture with Save Image, iOS asks whether the game may add it to your Photos — to add that picture, never to see what is there. Beside those, it asks one question that gives it nothing about you: whether it may show notifications — see Notifications, below. On Android the game holds the permissions to use the internet, to show notifications and to set its notifications again after the phone restarts, and Google’s Firebase Messaging code, which receives a guild's notifications, adds its own: to receive them from Google, to see whether the phone is online, and to keep the phone awake long enough to show one. Apart from what proves a guild action came from the real game — on iPhone the id and public half of a key the phone makes for it, and on Android a token from Google Play, both described under Guilds — and the notification address described under Guild notifications, the one thing it reads from the operating system is the device identifier described under One thing about your device below, and that is hashed before anything leaves the phone. There is no account system, so there is nothing for any of it to be attached to. The only ways any of it could reach us are if a player types it in themselves: into a character's name, a guild's name or a guild's chat — see The names are yours to choose and Guilds, below.

One thing about your character. The game sends the character you are playing to our leaderboard, so they can be listed on our website. That happens at two moments: on the way out of a fight, and when the run ends — they die, they beat the final boss and retire, or you decide you are done with them. If a finished run cannot be sent — no signal, say — it waits on your phone and goes out the next time the game can send it, which may be when you next open the app.

That record is exactly this and nothing else:

• The character's name, as you typed it, and their race
• A small picture of their face — the pixel-art portrait you built when you made them, drawn from the game's own artwork
• Their level, experience, the gold they were carrying and the gold they earned in all, how far through the map they got, and the area they were in when the run ended
• How many enemies they killed, how many times you tapped and how many of those taps came from a held finger, damage dealt and taken, and how many allies they lost
• How long the run lasted, and when it ended
• How it ended — died, retired, or you stopped playing them — whether they beat the final boss, and what killed them and at what level
• Any titles they earned
• Their luck: a hidden number the game rolled for them when they were made, which decides how generously their numbers grow
• The gear they were wearing at the end — each worn piece's in-game name, rarity, level and the stat it gave. Only what was equipped: the rest of their bag never leaves the device

Nothing in that record says who you are. It does travel with the device fingerprint described below, so on our server the characters posted from one phone can be told apart from everyone else's — that is what lets us remove a cheater's entries and keep them off the boards. The fingerprint never appears on the website, and nothing anywhere connects it, or the characters it groups, to you as a person. A character who is still being played carries one more thing: a random code the game invents for them, so that each time they are sent we can update their row rather than add another, and so that a guild knows them as its member for as long as they are in one. It is made from nothing about you or your phone, it never appears on the website, and it is deleted when the run ends.

A character in a guild also sends it what is described under Guilds, below — which is not this record — whenever they use it, and each time you open the game.

Apart from guilds, the game asks our server one question, and it is about places rather than people. Once, when it starts up, the game asks how each area has gone for everyone else — how many characters died in it and how many got through — so it can show both counts beside each place on the map. Nothing about you or your character is sent to ask it, and the answer is a pair of numbers per area. The device report described below goes out at the same moment, beside it. What reaches our server is the request itself, which means your IP address reaches the access log described below — the same one the leaderboard page reaches.

One thing about the app itself. The game keeps a running count of how many times each of its screens has been opened — the tavern, the shop, the forge and the rest — and sends those counts along with the character it was already sending. It is a total per screen and nothing else: there is no record of when you opened anything, in what order or how long you stayed, and nothing is kept beside the number that could tie it to you, to your phone or to a character. It tells us which parts of the game get used. It cannot tell us anything about who used them.

Achievements are counted the same way. When an achievement reaches a new rank, the game adds one to a running total for that achievement and rank — and sends the totals along with the character it was already sending. Which achievements you have stays on your phone: what leaves is how many players have ever reached a rank, with nothing attached to it. As with the screen counts, there is no record of when anything was earned, in what order, or by whom, and nothing is kept beside the number that could tie it to you, to your phone or to a character. It tells us whether an achievement is set where we meant it to be. It cannot tell us who earned it.

Most notifications are scheduled on your phone, and nothing about them is sent to us. Just after you make your first character, the game asks whether it may show notifications; say no and the game plays exactly the same. If you allow them, each time the game closes it works out, on your phone, what to warn you of while it is away — a poison or a bleed taking your character's health below 40%, and their death if it would follow; new daily quests; a bounty you have taken, half an hour before it runs out; reminders three days, a week and three weeks later; and, for a character in a guild, a day before a role or a place in the guild would lapse for being unseen, and a day before an unfinished guild bounty ends — and hands those to your phone's own notification system, which shows each at its time. They are worked out afresh each time the game closes, and taken away each time it opens. You can turn them all off under Menu › Settings, and on Android turn off any one kind in your phone's own notification settings.

One count about them leaves the phone. The reminders go out at one of four hours of the day, and the next time the game opens it notes which reminders had been shown and whether the game was opened from one, and sends those counts along with the character it was already sending — a number per hour and nothing else, with nothing kept beside it that could tie it to you, to your phone or to a character, exactly as the screen counts are. It tells us which hour brings players back. It cannot tell us who came back.

Guild notifications. A few things that happen in a guild can only be known by our server — your character removed from it, their rank raised or lowered, its leadership passing to them, their request to join it approved, and, for a leader or co-leader, someone asking to join — so our server sends those. For that, when your character establishes a guild, joins one or asks to join one, and you have allowed notifications and left them on in Settings, the game sends our server your phone's notification address: a token Apple or Google gives this install of the game so that notifications can reach it, which says nothing about you. It goes with the action, and again on its own if it ever changes. Our server keeps it with your character's place in the guild, or with their request to join, and deletes it with them — when your character leaves the guild, is removed, their run ends, they go thirty days unseen or the request is answered or runs out — and as soon as Apple or Google says the address no longer works. Turning notifications off in Settings sends our server word to delete it at once. It is used for nothing but those notifications, never shown to anyone, and our server limits how many a phone is sent in a day. To deliver one, our server hands the address and the notification's words to Apple's push service on iPhone or to Google's Firebase Cloud Messaging on Android, and nothing else: the words are the game's own, fixed in advance, and never name a player, a guild or anything a player typed. The game asks Apple or Google for the address only once you have allowed notifications, and only while they are on in Settings; on Android, that is also when Google’s Firebase Messaging code in the game first makes an id of its own for this install, which it sends to Google to be given the address — see section 4.

One thing about your device. So that we can remove cheaters from the leaderboard and keep them off it, the game sends a fingerprint of your phone: a one-way code derived from the device identifier your operating system gives this app. The identifier itself never leaves your phone, and the code cannot be turned back into it or matched with anything outside this game. The fingerprint travels with each character you post and with everything the game sends a guild, and once each time the game opens it is sent on its own with which platform you play on, the app's version, how many characters you have made and how long you have played — enough to tell one device's submissions from another's, and to block a device that abuses the boards. It is never shown on the website or to other players, never given to anyone but the companies that host our server for us, named in section 4 — though a finished run carries it while it waits to be sent, so a Cloud Save copy made then, as one is when a run ends, holds it too, in your own Apple or Google storage — and used for nothing but keeping the boards and guilds honest and keeping a phone out of a guild that has removed it. No setting in the game stops it. It is not the only thing about your phone we hold: on iPhone, a guild action also carries the id of a key the phone makes for it, joined to nothing else we hold, the fingerprint included — see Guilds, below.

There is no switch any more. Earlier versions of the game had one in the menu that stopped all of this. It was taken out when guilds arrived, because a guild depends on what the leaderboard is sent: it is what a member's donations and level are checked against, and what takes a character out of their guild when their run ends. So every character is posted, and the map's question, the screen counts, the achievement counts, the reminder's counts and the device fingerprint with its report each go out at the moment this section describes, if there is a connection then. A player who had the switch turned off is told so once, on the Title Screen. If you would rather a character were not on the leaderboard, section 6 says what you can do: we delete a finished character on request, without asking why, and a character you stop playing comes off the board of characters still being played on its own.

What our server records automatically. Like any server on the internet, ours logs the IP address of the connections it receives. We do not use it to identify anyone and we do not combine it with the character record; it exists because web servers write access logs. The log is kept for fourteen days and then deleted. In some jurisdictions an IP address counts as personal data — as do the device fingerprint described above, the key an iPhone proves its guild actions with, described under Guilds, and the email address the feedback form below asks for.

The leaderboard web page contacts that same server. When you open the leaderboard on our website, your browser asks our leaderboard for the current boards — and for a guild's own page when you open one, and, if you search the collapsed guilds, for what you typed — exactly as the game does when it posts one, so your IP address and the guild whose page you open reach the same access log described above. What you typed into a search is left out of it. The page itself comes from our website's host, Namecheap, which logs the requests for it as it logs every page of this website — see section 4. That is the whole of it: no cookie is set, no script from anyone else runs, and nothing about you is stored beyond those two logs and the visit statistics section 4 says our website's host builds from the second. You do not need the game to read the page, and you do not need the page to play the game.

The names are yours to choose, and they are published. A character's name appears on a public web page, and so does the name of a guild — beside every character in it, and on its own page with the name of the character who established it, for as long as the guild is listed. Please do not put your real name, anyone else's, or anything you would not want read by strangers into either. The game filters some words when a character or a guild is named, but that is a filter and not a guarantee, and a name other players report may be replaced by us with a placeholder.

The feedback form on our website. The support page carries a form for sending the developer feedback, and it is the one place we ever ask for anything about you: it takes an email address, so a reply has somewhere to go, and your message. Both go to the same server we operate for the leaderboard and are kept in its database, hosted for us as section 4 describes, until dealt with — used only to read and answer what you sent, shared with nobody but those hosts, never used for marketing, and deleted when you ask. Using the form is entirely optional; every question it answers can be asked by plain email instead, and neither the game nor this website ever fills it in for you.

Guilds

A guild is the one part of the game shared with other players. A character can establish a guild or join one, and its members share a bank, a Guild Shop and a chat. A guild is kept on our server rather than on anyone's phone, so everything a character does in one is sent there, and the guild's other members see some of it. A character that never opens the guild screens sends nothing about guilds at all.

What a guild is sent. Establishing a guild sends its name, its banner and who may join it, with your character's name, level, how far through the map they have got and the area they are in; joining one, or asking to join a Private one, sends the same about your character. Donating sends the gold, or the whole piece of gear, that was given. Buying from the Guild Shop, changing a member's role or the guild's settings, reporting, muting, and every message in its chat are sent there too. Each of these carries your character's random code and the device fingerprint described above, and each but a chat message carries a proof that it came from the real game, described below. Opening the list of guilds sends the random code and the fingerprint too, so the game can learn whether a guild has let your character in.

How a guild knows your character is still playing. While your character is in a guild, the game tells our server each time you open it or come back to it, with their level and the area they are in; the leaderboard record sent on the way out of each fight does the same with their level, and so do most things they do in the guild. That is how the guild knows when they were last seen, and it keeps the level and area the guild shows up to date. The record sent when a run ends — whenever it reaches us, even if it waited on your phone for a connection — takes your character out of their guild, and for a death or a retirement writes a line saying so into its chat. Nothing else you do in a guild waits on your phone to be sent later: with no connection, it does not happen. The exceptions are establishing one — if the answer never arrives, the game asks our server the next time you open it whether the guild was made, so the gold it cost is not lost — and the kills your character counts toward a guild's weekly bounty and the guild chests it is owed, which wait for the next time you open the game.

What the rest of the guild sees. A guild shows its other members your character's name, role and level, the area they were last in, when they joined, when they were last seen, and the gold and gear they have donated; a piece in the Guild Shop carries the name of the character who gave it. The guild's chat also carries a line for what happens to your character there: joining, leaving, retiring, being removed after thirty days unseen, becoming its leader, a change of role, donating, and a death, with what killed them and at what level. Once your character has left, the messages they wrote are shown with how they went — died, retired, quit, left or removed. A guild's leader and co-leaders see a request to join with the asking character's name and level. Nobody in a guild is shown your character's random code or the device fingerprint.

The chat. A guild's chat is free text its members write, and every member of the guild reads it — anyone who joins while a message is still there included — except a member who has muted the writer. We do not filter it, so please do not put anything into it that says who or where you are. The game asks our server for new messages every few seconds while the chat is open. Each message is deleted seven days after it is posted, and every message a guild holds is deleted when the guild collapses. A message its writer deletes disappears for everyone at once, with nothing left where it stood. One removed after reports from three different members, or deleted by an officer, loses its words for everyone at once, and the chat shows the writer's name with a note that it was removed. The text of any message taken down — by reports, by an officer or by its own writer — is kept only for moderation, and deleted after thirty days, even where that is longer than the seven days it would otherwise have lasted. The lines recording gold donated and levels bought are the exception to the seven days: they are the guild bank's record, and they are kept, out of sight after seven days, until the guild collapses. Whom a member has muted is kept on our server with that member's place in the guild, and goes when it does. Agreeing to the chat's rules is kept on your phone and never sent to us.

Reports. From inside the game, a member can report a message in their guild's chat or another member's name, and a character in no guild can report a guild's name from the list of guilds; anyone can report one by email. A report of a message keeps which message it was, not its words, which go when the message does; a report of a name keeps the name as it stood. Each keeps a one-way code made from the reporting character's random code, so that one character counts once, and never the fingerprint. That code can be matched to a character only while their random code is still on our server — which it stops being once their finished run reaches us, or at the latest thirty days after they were last sent — and while it can be, it leads to that character's leaderboard row and the fingerprint stored with it. Nothing happens to a name by itself: we read the reports, and a name we judge unacceptable, a guild's or a character's, is replaced by us, by hand, with a placeholder. Reports are kept for a year.

Silences and bars. An officer can silence a member of the guild for a time, and a silence lasts even if that member leaves and joins again — so when a silenced member leaves or is removed, the guild keeps a one-way code made from their character's random code, for no longer than the silence has left to run. When a guild removes a member, the device fingerprint is kept on that guild's list of phones barred from rejoining it, with the character's name and the date, until the guild lifts the bar or collapses. The guild's leader and co-leaders see the name and the date, never the fingerprint.

Checks against cheating. A guild's bank buys bonuses for every member, so our server checks the gold each member donates against what their character reports having earned, and their level against their kills, reading the leaderboard record sent on the way out of each fight. Anything that does not fit is kept as a flag for us to review: the guild, the character's place in it and the numbers that did not fit — no name, random code or fingerprint, though their place in the guild ties it to the name the guild's records hold. It is kept for ninety days after it was last raised, even after the character leaves or the guild collapses. It is a record about a character, kept for moderation, and it can lead to what that character gave being taken back.

Proving a guild action came from the real game. For the same reason, almost everything a character does in a guild — establishing or joining one, donating, buying, a change of role or of the guild's settings, leaving, reporting, muting and the rest — carries proof that it was sent by the real TapSlayDie on a real phone rather than by a script. A message in its chat does not, nor does anything the game only reads, nor the word that your character is still playing, nor the kills counted toward a guild's weekly bounty. Nothing in a proof says who you are, and none names an Apple or a Google account. It is made one way on iPhone and another on Android.

On iPhone, the proof is Apple's App Attest, which is part of iOS and which the game reaches with code of our own. The first time the game proves an action, your phone makes a key in its own secure hardware, from which it cannot be copied, and asks Apple, once, to vouch that the key belongs to this game; after that the phone signs each action with the key and our server checks the signature, without Apple being asked again. Our server keeps the key's id, its public half, a count of how often it has been used, which of Apple's environments vouched for it, and when it was vouched for and last used — with nothing else beside it: no device fingerprint, no character and no IP address — and deletes all of it ninety days after the key was last used. Apple hands back a receipt with the key, which could be exchanged for Apple's own estimate of fraud; we neither keep it nor ask for that. The phone signs each action together with a random code it asks our server for, which it uses for up to ten minutes and our server keeps for as long, with nothing beside it. On your phone the key's id is kept in a file of its own, never in your save, so Cloud Save never copies it; a key does not survive the app being deleted, and a reinstalled game makes a new one.

On Android, the proof is Google Play Integrity. Before each such action, Google's Play Integrity code, which is in the game, asks Google Play on your phone for a token saying whether this is the real game as Google Play distributes it, on a phone that passes Google's integrity checks. To answer, Google Play sends Google what its check needs: which app is asking, its version and signing certificate, whether Google Play has the game licensed to the Google accounts signed in on the phone, and attestation from the phone's own hardware and from Google Play services. That collection is Google's, under Google's own terms, like Play Games' for Cloud Save. The token also carries a one-way code of the action it proves, made on your phone, from which nothing in the action can be read back. When our server checks a proof, it sends the token back to Google, which alone can read it, and Google answers with its verdict on the app and the phone; our server keeps nothing of that verdict but the line in its log described below, and remembers the token itself only as a one-way code, in memory, for at least eleven minutes and past that only until another token arrives or the server restarts, so that it cannot be used twice. The game keeps nothing about Play Integrity on your phone.

A phone that cannot prove itself is not locked out. One without App Attest or Google Play, or whose check failed or could not be made, sends no proof — or sends one our server cannot check at the time — and its action goes through all the same; if the character is in a guild, their place in it may be marked for us to review — a flag like those above, holding the guild, the character's place in it, which kind of action it was and why no proof came or could not be checked, and no name, random code or fingerprint — kept ninety days after it was last raised. A proof that arrives and does not check may be refused, and the action then does not happen. What our server writes of a proof to the log it keeps of its own work — why one was refused or could not be checked, and, while we only watch the checks rather than act on them, whether each one passed — has nothing beside it that names a character, a phone or an address.

How long a guild keeps it. Your character's place in a guild — their random code, the device fingerprint and the roster's entry for them — is deleted when they leave, when the guild removes them, when their run ends, or after thirty days in which they are not seen. Some things outlast it, as described above: the messages they wrote and the lines about them stay for the rest of their seven days; a removed character's fingerprint, name and the date stay on the guild's bars; a silence that has not run out stays as a one-way code; and if they established the guild, their name stays on it as the one who did. What they gave stays with the guild for as long as it stands: their gold donations are recorded under their name in its chat, the gear they gave in its Guild Shop's records, and what they bought from it or took out of it by their place in the guild. A request to join a Private guild is deleted after seven days, or sooner once it is answered or the character joins a guild. When a guild's last member goes, it collapses: its members, bars, chat, Guild Shop and requests to join are deleted, and what is left is the record the website lists — its name and banner, its level, the gold it held, the gear left in its Guild Shop, when it was established and when it collapsed, the most members it had, and the name of the character who established it — kept for good, with how many reports of its name were still waiting. Reports and flags are not deleted with it.

What the website and the game show of guilds. The leaderboard shows, beside each character, the guild they were in when they were last sent, by the name that guild has now, and a finished character keeps that for good — our server adds it from its own records, and the game does not send it. While a character is in a guild, the name the boards show is the one the guild holds, which is the name you typed unless we replaced it after a report. The leaderboard also lists guilds, with each one's banner, name, level and number of members, and every collapsed guild, searchable by name, with the record described above; each guild has a page naming the character who established it. Apart from that, and the guild beside each character on the boards, the website does not list a guild's members. Inside the game, the list of guilds shows any player the same about each guild with a seat free, and whether it is Private and the lowest level it takes.

The access log sees guilds too. A guild's requests reach the access log described above like any others. Most of their addresses name the guild and the member, message, piece, request or bar an action is about — so the log shows which member a player muted or unmuted, silenced, removed or gave a role, and which message they reported, though a report of a name carries its target in the request's body, which is not logged — and they carry a guild code typed to join one. Anything typed into a search of the guilds, and the filters a search of the list uses, your character's level among them when only the guilds they can join are asked for, reach our server with the request and are left out of the log. An open chat adds a line every few seconds.

2. Information stored on your device

The game saves your progress so you can close it and come back. That save is written to the app’s own private storage area on your device, which no other app can read. The save itself is never sent to us, and we never see it — what goes to the leaderboard is the short character record in section 1, and what goes to a guild is what section 1 describes under Guilds, each built fresh when it is sent, and not this file. Unless you turn off Cloud Save, a copy of the file goes to your own Apple or Google storage and still not to us; see the note on it below.

None of this is linked to you as a person. None of it leaves your device except what section 1 describes — the character record, what a guild is sent, and the two play totals the device report carries: how many characters you have made, and how long you have played, none of which a setting keeps back — and what you share yourself, a picture of a character or a guild's name and code, which goes only where you send it, as section 4 describes. With Cloud Save on — and it is on unless you turn it off — a copy of the whole save also goes to your own Apple or Google storage, never to us, as the note below describes. The map's question about how each area has gone for other players sends none of this — it sends nothing at all beyond the request.

3. What the game does not do

• The game plays offline. Every part of it but guilds works with no connection at all. What does use one is what section 1 describes — the leaderboard, the map's counts, the device report and guilds — and with no signal a finished character simply waits and the rest is skipped. A guild is kept on our server, so using one needs a connection; without one your character plays on, and their guild's bonus keeps working for up to thirty days. Nothing else about the game stops working.
• No advertising. There are no ads, no ad networks and no ad identifiers (IDFA/AAID). The app does not present App Tracking Transparency prompts because it does not track you.
• No analytics or crash-reporting SDKs. No Firebase Analytics, no Crashlytics, no Unity Ads, no AppsFlyer and nothing of that kind is bundled with the app. Apart from the Godot engine the game is built with, its third-party code does four jobs and nothing else. For Cloud Save, open-source plugins reach Apple’s Game Center on iPhone and Google’s Play Games on Android, with Google’s own Play Games libraries on Android. For Share, godot-share, an open-source plugin, opens your phone’s share sheet; it sends nothing itself, and all it hands back to the game is how the sheet closed, which is never saved or sent. For guilds, on Android, Google’s Play Integrity library proves that an action came from the real game, as section 1 describes; on iPhone the same proof is Apple’s App Attest, which is part of iOS and is reached by code of our own. For guild notifications, on Android, Google’s Firebase Messaging library receives them from Google — Firebase's messaging alone, with none of its analytics; on iPhone they come through Apple's own push service, part of iOS, reached by code of our own. The leaderboard is our own code on a server we run, with its database hosted for us, as section 4 describes. What we count for ourselves — how often each screen is opened, how many players reach each achievement’s rank, and which hour the reminders were answered at, all described in section 1 — goes to that same server with everything else it is sent.
• No in-app purchases and no payments. The gold in the game is fictional in-game currency earned by playing, and cannot be bought. We never ask for payment details.
• No multiplayer, and one social feature inside the game: guilds. A guild shares a bank, a Guild Shop and a chat among its members, as section 1 describes. There is no friend list and no private messaging, and nobody outside your character's guild can contact you through the game. The leaderboard is a list of characters — finished ones, and ones still being played — and of guilds, on a web page, and nothing more. Share is the one way out of the game: it hands a picture of a character, or a guild's code, to your phone's own share sheet, for you to send to any app you like, a social network among them. The game shares nothing to another app by itself, and nothing comes back in but word of how the sheet closed.
• No accounts and no tracking of you. There is no account, and the game asks for nothing that says who you are. What does exist is the device fingerprint described in section 1: on our server, characters posted from the same phone are linkable to each other for moderation, and a phone a guild has removed is kept from rejoining it — and to nothing and nobody else. On iPhone there is also the key section 1 describes under Guilds, an identifier of one install that we keep joined to nothing. No advertiser and no data broker is involved in any of it, and no company holds any of it but the ones that host our server for us, named in section 4 — and Apple or Google, in a Cloud Save copy made while a finished run waits to be sent, as section 1 says.
• No sale of data. We do not sell, rent or trade anything we hold, and we disclose it to nobody beyond what this policy describes: what the leaderboard publishes, what a guild shows its own members, what the companies named in section 4 hold for us as our hosts, the token an Android phone proves a guild action with, which goes back to Google to be read, and a guild notification, which goes to Apple or Google to be delivered.

4. Third parties

Our server is hosted for us by service providers, and what the game sends us goes to no one else but for one token an Android phone sends, which goes back to Google, and a guild's notifications, which Apple or Google deliver, as below. The leaderboard runs on a virtual machine we rent from Google Cloud, in the United States, and administer ourselves: it runs our own code and the web server in front of it, and the access log described in section 1 is written there. What the server keeps — every record section 1 describes but that log, and what the feedback form sends — is stored in a database that MongoDB Atlas, a service of MongoDB, Inc., hosts for us on Amazon Web Services' servers in the United States. They are service providers acting for us: they hold that data so our server can run, under their terms with us, and we give it to them for nothing else. There is no analytics provider, no advertising network and no crash reporter in the path.

Our website is hosted for us by Namecheap. Every page of tapslaydie.com, this one included, is served from Namecheap's web hosting, which keeps its own log of the requests the website receives, as web hosts do — typically the IP address a request came from, the page it asked for, when, and the browser that sent it. That log is kept by our website's hosting, and it is not the access log section 1 describes, which is our server's. It is processed once a day and archived in our hosting account, and each month's archive is deleted at the end of the following month, so a request is kept for about two months at most. The hosting also builds visit statistics for us from it — how often each page was visited, and from where, with every address that visited in each month and when it last did — which stay in our hosting account with no set end. Nothing the game sends goes to Namecheap, and neither does what the feedback form sends: both go to our server.

One exception is Cloud Save, which you can turn off. Your save copy goes to Apple’s Game Center, which keeps it in your iCloud, or to Google’s Play Games — services you already have an account with, holding your own data under your own account settings. They are not acting for us and we receive nothing from them: we are not told your name, your account, or whether you signed in at all. What they do with your storage is governed by their policies, linked at the end of this page. With Cloud Save turned off, your save goes to neither and nothing is read back from them — though on Android, Google’s Play Games code, which the game sets up as it starts whatever the setting, still makes its own attempt to sign you in to Play Games each time the game opens.

Share sends what you choose, to whoever you choose. The Share buttons — on the card shown when a character dies, on each past character's card on the Stats page, when the final boss falls, and Invite friends in a guild — hand your phone's own share sheet a picture and a line of text, or a guild's name and code, and they go to whichever app you pick, under that app's policy rather than ours. The picture shows the character — their face, name and level, how long they lasted, what killed them or the title they earned, and their guild — and nothing that says who you are. The game sends nothing to us or to anyone else when you share; the sheet is opened by godot-share, an open-source plugin that does nothing but open it and say how it closed. On iPhone, choosing Save Image asks your permission for the game to add the picture to Photos; it never asks to see them.

Apple and Google vouch that a guild action came from the real game. On iPhone, your phone asks Apple once to vouch for the key section 1 describes under Guilds; App Attest is part of iOS, and what Apple learns from being asked is governed by Apple’s policy. Our server sends Apple nothing. On Android, Google’s Play Integrity code in the game has Google Play check the app and the phone before each such action, and Google is sent what that check needs, as section 1 describes, under Google’s own terms; when our server checks a proof, it sends Google the token that check made, which only Google can read, and nothing else — not the fingerprint, not a character and not the action itself, only the one-way code of it the token already carries.

Apple and Google deliver a guild's notifications. When our server sends one of the guild notifications section 1 describes, it hands your phone's notification address and the notification's fixed words to Apple's push service, for an iPhone, or to Google's Firebase Cloud Messaging, for an Android phone, and they deliver it to your phone. They act for us in doing so, under their terms with us, and are given nothing else — not the fingerprint, not a character's name and not anything a player typed. On Android, once you have allowed notifications and while they are on in Settings, Google’s Firebase Messaging code in the game makes an id for this install of the game, a Firebase installation id, and sends it to Google with the app's own details to be given the notification address; it is made from nothing about you, is not an advertising id, and is handled under Google’s own terms. The game carries Firebase's messaging alone and none of its analytics, so nothing from the game reaches Google Analytics.

One thing worth stating plainly: the app stores you download the game from are separate from the game. Apple (App Store) and Google (Google Play) collect their own information about downloads, purchases, subscriptions, crashes and app usage as part of running their platforms. That collection is governed by their policies and your own device and account settings, not by us. Where Apple or Google share aggregate reports with developers — such as anonymous download counts or crash summaries — those reports contain no information that identifies you.

• Apple Privacy Policy
• Google Privacy Policy

5. Children’s privacy

The TapSlayDie app does not collect personal information about who anyone is, including children under 13 (or the equivalent minimum age in your country). It does not ask for a name, an email address or an account, it reads no advertising identifier, and it asks the operating system for no permission that would give it one. What the game does send is described in section 1 — the made-up character being played, the counts of screens, achievements and the reminder's hours, the device fingerprint, and what a character in a guild does there — and none of it asks who is playing. The fingerprint identifies a phone, not a person: a child's character reaches us attached to no name, no age and no identity, exactly as an adult's does. The game contains no advertising and no in-app purchases. It has one way to talk to other players: the chat of a guild the character joins, which is free text we do not filter, read by the members of that guild and deleted seven days after it is posted, or kept thirty days for moderation if it is taken down, its writer's own delete included.

A child could give something away about themselves in three places: the name they type for a character, which is published on our leaderboard page; the name of a guild they establish, which is published too; and what they write in their guild's chat, which its other members read. The warning in section 1 applies to a child more than to anyone: please do not put a real name, or anything that says who or where you are, into any of them. No setting keeps a character's name back: every character is posted, a child's as much as anyone's.

We comply with the Children’s Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code and the GDPR’s provisions on children’s data by the simplest means available: we do not ask who is playing, and nothing the game asks for tells us. There is no account to create, no advertising to target, and no profile of a person — the one thing profiled is the device, for moderation, as section 1 describes, and in a guild a character's donations and level are checked for cheating — so a child using the game is in the same position an adult is — anonymous to us. Guild chat is the exception: it is free text we do not filter, so a player who writes in it can show what they type to the other members of their guild. TapSlayDie is not directed at children under 13, and if we learn that a child under 13 has written something about themselves in a guild's chat, or in a character's or a guild's name, we delete it. No message stays in the chat longer than seven days, and members can report and mute. The one place on our website that asks for anything about you — the support page's feedback form — is not directed at children and stores only what is voluntarily sent. If you believe a child has given us personal information through the form, or has put something into a character's name, a guild's name or a guild's chat that should not be there, contact us and we will delete it.

6. Your rights and your choices

Privacy laws such as the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and similar state and national laws give you rights to access, correct, delete, port and restrict the processing of your personal data, and to opt out of its sale or sharing.

From the game, we hold no account and ask for nothing that says who you are. What we do hold is the device fingerprint described in section 1 — an identifier of your phone, not of you — and the character records it travels with, and, for a character in a guild, their place in it while they are there and what section 1 says a guild keeps after them. We cannot look a fingerprint up from your name or email, because nothing connects them; if you want a device's profile and entries deleted, tell us one of its characters' names and roughly when that run ended, exactly as in the removal paragraph below, and we will delete the profile and everything that traces to it. Nothing in the game stops the report, though, so a phone that goes on playing begins a new profile the next time the game opens with a connection, and its characters are posted as before. On iPhone we may also hold the id and public half of the key section 1 describes under Guilds; they are joined to nothing else we hold, so we cannot find yours for you, but they are deleted on their own ninety days after the key was last used, and a key is never used again once the game is deleted from the phone that made it. Nothing we hold has ever been sold, and nothing is shared beyond what the leaderboard publishes, what a guild shows its own members, what our hosts, named in section 4, hold for us, and the token Google reads for an Android phone's guild action, as section 4 says. The other thing we may hold is feedback you have sent through the form on our website: we hold the email address and message you chose to send, and an email naming the address you used is enough to have them deleted.

The leaderboard has no switch

Earlier versions of the game had a switch in the menu that stopped everything it sent us. It was taken out when guilds arrived, as section 1 describes, so there is nothing to turn off: every character is posted, and a player who had the switch turned off is told so once, on the Title Screen. What you can still decide is what a character is called, and whether they stay on the leaderboard once their run is over — the next paragraphs say how to have one removed.

Removing a character from the leaderboard

Because nothing in an entry names you, we cannot look one up for you — but you can tell us the character's name and roughly when the run ended, and we will find it and delete it. Contact us using the details below. We do this on request and do not ask for a reason. The same goes for a name a guild shows: tell us the guild, and we will replace its name, the name of the character shown as having established it, or a character's name on what they gave it, with a placeholder.

A character who is still being played can also simply be left. They are sent again each time they walk out of a fight, so their row stays on the board of characters still being played for as long as you play them; stop, and it comes off on its own thirty days after the last time they were sent. If their run ends instead — they die, they retire, or you put them down — their finished record is sent like every other, and the paragraph above is how to have it removed.

Deleting your data

Your save lives on your device and, if Cloud Save has been on — as it is unless you turn it off — in a copy in your own Apple or Google storage. To remove it completely, delete that copy first, with Delete Cloud Copy in the game's Settings, as the Cloud Save note in section 2 describes — otherwise a reinstall brings a character still being played back from it — then delete the app from your phone in the usual way; the operating system removes the app’s private storage, including your save, along with it. If you also keep device backups, delete or overwrite those backups through your Apple or Google account settings. Deleting the app does not remove leaderboard entries already posted — use the paragraph above for those. Nor does it take a character out of their guild at once: a member nobody has seen for thirty days leaves on their own, and what they gave stays with the guild, as section 1 describes.

7. Security

Your save is held in the app’s private storage area, protected by the sandboxing and device encryption your operating system provides, and it is never sent to us. With Cloud Save turned on, a copy also goes to your own Apple or Google storage, protected by that account.

What is transmitted is described in section 1, and it is sent over an encrypted HTTPS connection to a server we operate, on the machine we rent from Google Cloud, which stores it in the database MongoDB Atlas hosts for us — both described in section 4. They hold nothing but what section 1 describes: no accounts, no passwords and no payment details. The identifiers in it are the device fingerprint described in section 1, which identifies a phone to this game and nothing else; the random code of a character still being played; the id each character is given inside a guild; on iPhone, the id of the key a phone proves its guild actions with, joined to nothing else we hold; and the one-way codes that reports and silences keep. A guild's chat holds whatever its members wrote. We have tried to make it the kind of thing that would be dull to breach.

One copy of the database is kept apart from it. MongoDB Atlas keeps no backups of our database on the plan we use. We made one ourselves on 23 September 2026, and it is kept on the developer's own computer and nowhere else. It is not kept up to date, so it holds what our server held that day and nothing since, and anything we delete at your request we delete from it too.

8. International users

The game works identically wherever it is played. What section 1 describes is sent to our server and kept in its database, and both are in the United States — the server on Google Cloud, and the database with MongoDB Atlas on Amazon Web Services, as section 4 describes — so if you play from anywhere else, it is transferred to the United States, and so is what the feedback form on our website sends. The game asks for no name, no contact detail and no account, though a guild's chat holds whatever its members wrote; its identifiers are the device fingerprint described in section 1, which some laws treat as personal data even though it says nothing about who you are, a character's random code, the id of the key an iPhone proves its guild actions with, and the ids and one-way codes a guild keeps. So, plainly: whatever the game sends us goes to that one server and its database, in the United States, wherever you play from, and to no company but the ones that host them for us — but for the token an Android phone proves a guild action with, which goes back to Google, as section 4 describes.

9. Changes to this policy

If the game ever changes in a way that affects your privacy, this policy will be updated before that version ships, and the “Last updated” date at the top will change. Every such change so far is already written into the sections above. Material changes will also be described in the app’s release notes on the App Store and Google Play. Continuing to use the game after an update means you accept the revised policy.

10. Contact us

Questions about this policy or about privacy in TapSlayDie are welcome:

• Email: dev@tapslaydie.com
• Developer: Jake Motta