The fine print · what we keep

Privacy

Digger Derby is operated by The Digger Derby operator. Questions or requests to access or delete your saved game: digger@crodar.xyz.

What we save

Anonymous play creates a random guest id and a generated digger name. We store your game progress, discovery and boost history, the cosmetics you own and wear, and creation and last-seen times in a local SQLite database. Session tokens are stored only as SHA-256 hashes; the raw bearer token stays in your browser's local storage. Keep it private: it opens your saved shaft.

Sign in with X asks for read-only access. X gives us your user id and handle in the sign-in itself; we save those two values to attach your shaft and restore it on another device. The access token is discarded without being used. We never post or read your timeline or messages. The only server cookie is a Secure, HttpOnly OAuth state cookie, scoped to /auth/x and expiring after ten minutes. Sign-in and payment handoffs expire after ninety seconds and can be redeemed once.

Public game information

Your digger name or linked X handle, depth, online status, tool levels and equipped cosmetics are visible to other players in standings and the shared world. Sharing is voluntary. An invitation permanently captures those public details and nearby players as an immutable snapshot and image; it does not publish a live view or post to X for you.

Payments and network data

When enabled, optional cosmetic purchases are processed by Stripe on its own checkout page. We store the checkout reference, the item bought, its verified amount, currency and verification time, and the cosmetics it grants, not card details. X and Stripe apply their own privacy policies. IP addresses are used transiently in memory for rate and stream limits, not saved in game records. A hosting proxy may have its own operational access logs, controlled by the operator.

There are no advertisements, analytics trackers, third-party fonts or gameplay calls to X. All game assets are served by this deployment.

Retention and deletion

Sessions expire after 180 days; action replay records are retained for 24 hours. Expired OAuth and handoff records are removed hourly. Unpaid checkout references expire after 30 days. Unlinked guest shafts without purchases, below about 3 feet (one metre) and unseen for 30 days are deleted with their sessions and action records. Other game saves, immutable invitations and verified purchase records remain until an operator deletion request or the deployment is retired. Backup copies expire after 14 days under the configured backup policy; deletion reaches those copies as they expire. Browser storage may be cleared by you, but clearing it alone does not delete the server record.

Do not enter private information into public game names. This game is not intended for children under thirteen.