Privacy policy
tetramental.com is run by h4rdw1r3d, the publisher of Tetramental. This page explains what the site collects, why, and what you can do about it. Questions: use the contact form.
What we collect
- From Google, when you sign in: your name, email address, profile picture and Google account ID. We don’t receive your password and don’t ask for access to anything else in your Google account.
- If you sign up with email: your name, email address and password. Your password is never stored as you typed it: we keep only a salted, one-way scrypt hash of it. When you choose a password, we check it against Have I Been Pwned’s list of passwords exposed in data breaches by sending only the first five characters of a one-way (SHA-1) hash of it; your password and its full hash never leave our server.
- Your early-access request: when you asked, that you acknowledged the early-access notice, and whether it was approved (by the author, or automatically when you support development). If you signed up with email, also how you found us and your note to the author, if you chose to give them.
- Reading: the chapter and paragraph you bookmark, how far you’ve read in each chapter, and your reading display settings, so they follow you between devices.
- Music: the soundtrack tracks you like and the ones you star as favorites. Other readers see only how many people liked each track, never who. Whether you play only your favorites is kept in your browser.
- Your player name (chosen at sign-up, or the first time you need one): public. It appears on the high scores, on challenges and in multiplayer; it’s never your real name. If a name is reset for breaking the rules, we keep it on a list of names that can’t be chosen again. Multiplayer games are recorded (who played whom, who won, how long), and during a live game your moves pass through our server to your opponent. When you agree to the game terms while signed in, we record which version you agreed to and when.
- The game: if you save a high score, the score, the mode and the date. These appear publicly on the high-score board under your player name (never your real name). To check a score is real, the moves of your best run in each mode are kept as a replay (the moves only, nothing about your device); it isn’t published. If a run can’t be verified, we keep it, with the score your browser showed, for 30 days to find out why, then delete it. Your progress on the Path is kept in your browser and, when you’re signed in, with your account so it follows you between devices.
- Challenges: if you send one, we keep the score, the round’s settings and its moves (to replay it). Anyone with its link sees your player name, score and the replay; if you choose to show it on Recorded challenges, they’re public there too. If you take one, we keep your score and moves: the leaderboard shows your player name and score to anyone with the link, and your replay is visible only to you and the challenger unless you let others watch.
- Messages you send through the contact form: your name, email address, topic and message, and a one-way hash of your IP address, used only to limit how many messages one visitor can send.
- Sign-in sessions: a session record with your IP address and browser user agent, kept to keep you signed in and to protect your account, and short-lived counts of sign-in and sign-up attempts by IP address, used only to stop password guessing and abuse.
- Server logs: our hosting provider, Cloudflare, processes standard request data (such as IP address) to deliver and secure the site.
Payments
If you unlock multiplayer, you pay through Stripe’s checkout, and Link (part of Stripe) sells the unlock to you as the merchant of record. Stripe and Link collect your payment details, email address and billing address (to work out tax) under their own privacy policies (Stripe, Link); we never see your card or bank details. We send Stripe your account’s email address (to fill in the checkout) and an internal account ID (so the payment unlocks the right account). Stripe sends us back, and we keep with your account: the amount you paid, the tax, the currency, the date, Stripe’s payment reference, and whether the payment was later refunded or disputed. Supporters get a small mark beside their player name wherever it’s shown, and may choose to show their player name on the public supporters’ wall (off unless they turn it on).
How we use it
Only to run the site: to sign you in, decide and record early access, show your name and picture while you’re signed in, remember your reading position, open multiplayer to those who have unlocked it, and keep the service secure. The site’s operator sees requesters’ names and email addresses in order to approve them.
We don’t sell your data, share it for advertising, or use advertising or third-party tracking. We don’t send marketing email.
Cookies
The site uses only the cookies needed to keep you signed in. There are no analytics or advertising cookies.
Bot protection
The contact form, email sign-up and sign-in, saving a high score, and sending or saving a challenge use Cloudflare Turnstile to check that a person, not a bot, is using them. It runs invisibly in your browser and processes information about your browser and device to make that check, as described in Cloudflare’s Turnstile Privacy Addendum. It isn’t used for tracking or advertising.
Where it’s stored
Data is stored with Cloudflare, our hosting provider. Google sign-in is provided by Google under Google’s own privacy policy. Payments are handled by Stripe and Link, as described above. The breached-password check uses the Have I Been Pwned Pwned Passwords service, which receives only the partial hash described above.
How long we keep it
Account, request, reading and high-score data are kept while your account exists. Purchase records are kept while your account exists and deleted with it (as the merchant of record, Stripe and Link keep their own records of the sale under their policies). Challenges and their replays are deleted 30 days after they’re sent (a record that an expired challenge existed, with its challenger’s name and score, is kept for a year so its link can say it has expired). Contact messages are kept so we can follow up, and deleted on request. Expired sign-in sessions are deleted.
Your choices
You can ask us to show you, correct, or delete your data at any time through the contact form (choose “Privacy or data request”), giving the email address on your account. Deleting your account removes your profile, password hash, request and reading data, your player name, scores, challenges and their replays, your music likes and favorites, and your purchase records (Stripe and Link keep their own record of a sale). You can also remove the site’s access from your Google account at myaccount.google.com/connections.
Children
The site is not directed at children under 13, and we don’t knowingly collect their data.
Changes
If this policy changes, the date at the top will change with it.