Privacy

The short version: the games are free and work without an account. No ads. No third-party trackers. We count visits with our own cookie-free, anonymous analytics: no cookies, nothing stored on your device, nothing shared. We store only what a feature you use needs, and you can download or delete all of it at any time.

Counting visits (our own analytics)

To know which pages and games people use, this site counts visits itself. There's no Google Analytics or any other outside service, and no consent banner, because nothing is stored on your device and nothing can follow you around.

• No cookies and no browser storage: the counting script sets no cookies and writes nothing to your browser's storage. It sends no ID of any kind.
• How we tell visitors apart, for one day only: our server mixes your IP address, your browser's name and version string and our site's name with a random secret that changes every day (at midnight UTC), and keeps only the scrambled result (a one-way hash). The secret is held only in memory for at most 48 hours and never saved, so after that day nobody, including us, can work out who a hash belonged to or link it to your visits on another day. Your IP address and browser string themselves are never stored.
• Visits: page views from the same daily hash with less than 30 minutes between them count as one visit.
• What we count per visit: the page address without anything after the "?" (except the campaign tags utm_source, utm_medium and utm_campaign, when a link has them); the name of the site that sent you (e.g. reddit.com, never the page); whether you're on a phone, tablet or computer; the browser and operating system family (e.g. "Firefox", "Android", no versions); a screen-size range (e.g. "1024 to 1439 pixels wide"); and your country, as Cloudflare reports it (no city, no location lookups).
• Clicks and steps we count: Play, the Microsoft Store button, Share, opening the screenshot gallery, opening a daily challenge, starting and finishing joining, linking a game, and ticking "get notified" or "playtest". These are counted the same anonymous way: never with your account, email or name.
• Not counted at all: browsers that send Do Not Track or Global Privacy Control, known bots, the admin pages, and our admins.
• Nothing shared: the counts stay on our server; we never sell or give them to anyone.

Playing in your browser

• Standing Orders, UpMass and One Small Fact save your progress in your browser's own storage, on your device. While you're signed out, nothing about your play is sent to us. Standing Orders keeps your career, a tour in progress and your Patrol and Tactical bests. UpMass keeps upmass-save-v2 (the Program, your Daily Lift results and streak, and a bay you packed but haven't launched) and upmass-run-v1 (Colony Run stars and a run in progress).
• One Small Fact keeps onesmallfact-save-v1 (your points, rank, day streak, Daily Five results, Mission Map stars, Fact Cards, review deck, badges and Hotter Than Venus bests) on your device, a recovery copy onesmallfact-save-v1-prev and this device's settings onesmallfact-prefs-v1; only the first is ever synced. Signed in, it posts your Daily Five score with your local date and how many you got right and solo, your best Hotter Than Venus run, and your total points.
• Voice answers in One Small Fact (off unless you turn them on): the speech model (about 67 MB) is downloaded once from this site and runs on your device, in your browser. Your audio never leaves your device: the microphone is open only while you hold the button, the recording stays in memory until it is turned into text and is then thrown away, and neither the audio nor the text is sent to us or anyone else. The game never uses your browser's online speech service. Settings in the game deletes the model.
• If you link the UpMass app to an account, its link key is kept on that device under upmass-link-v1. It is never synced or copied to your other devices.
• If you sign in on this site, that browser copies those saves to your account (the cloud saves below) so they follow you to your other devices, and a daily result you choose to post goes on the leaderboards.
• The games keep working offline: each one stores its own files in your browser for that. This page and the rest of the site don't.

Without an account

• Update checks: a game sends its name, version, operating system and a random install id. We answer with the latest version and store nothing: no install list, no usage events.
• Crash reports (if the game sends one): the error and stack trace with personal paths, emails and keys removed, the game version, operating system and install id, and a one-way hash of your IP address. We clear the hash after 30 days and delete the report after 90.
• Support requests: your email, name and message, and a one-way hash of your IP address that we clear after 30 days.
• If you choose Rate this session, we keep your rating, the version and what you typed (emails and keys are stripped).
• Rate limits: to stop spam and abuse we count requests per IP address. Those counts live in memory (and, for game linking, in our own cache server) for at most a day and are never written to the database.
• Public pages (leaderboards, player pages, the colony) set no cookies except the security cookies the site needs to work.

With an account

What	Why	Public?
Email address (the address itself, so we can send sign-in codes and replies), name, password hash if you add a password, two-factor settings	Signing in and account emails	No
That you ticked "I'm 13 or older" when you joined, and when (no birthdate)	Accounts are for players 13 and older	No
Display name (e.g. "Clint P.") and the avatar you picked	Leaderboards and your player page	Yes, while "Show me on leaderboards" is on (it's off until you turn it on)
Your Steam picture's address, if you link Steam (copied once)	Offered as an avatar; used only if you choose it	Only if chosen
Best scores per board, with the date, small details the game sends (ship, seed) and an optional replay hash; and a better score waiting for an admin's review if it looked too good	Leaderboards; admins use the details to check scores	Score and date, if shown on boards
Colony totals: tonnes you delivered (total and today)	The community Mars colony and your badge	Your total, on your player page
For each colony delivery, the game's random delivery ID and our reply (deleted after 48 hours)	So a delivery the game sends again after a lost connection is counted once	No
Cloud saves: from the PC games you link, and from Standing Orders, UpMass and One Small Fact in a browser where you're signed in	Keeping your progress on all your devices	No
Session ratings sent from a linked game	Improving the games	No
The Third Leap before launch, only if you tick them: "email me when it launches" and "I'd like to playtest", with when you ticked them; for the playtest, only what you choose to tell us: your operating system, graphics card, and whether you have a gamepad or flight stick	One email at launch; picking playtesters by PC and controller. Nothing is emailed yet, and every email will have a one-click unsubscribe link	No
Linked games: the key's name, when it was last used and from which network (e.g. 203.0.113.x), never the key itself	Showing and revoking access	No
A game's request to link: the game, the name the device reports, a scrambled (keyed one-way) code of the game's network and, behind our Cloudflare edge, its country; never the IP address. Deleted a day after the 10-minute code expires	Showing you on the link page whether the request came from your own network, so a code someone else sent you stands out	No
Sign-in sessions and remembered devices: device and browser type (or the app and its platform), your network, and a one-way hash of your IP address (cleared after 30 days). A device is remembered for 30 days after you enter an emailed code, then asks again; you can forget any of them in Account > Security	Showing and revoking sign-ins, spotting a stolen session, skipping the code on a device you've confirmed	No
Passkeys you add: the public key your device made, its name, when it was added and last used. The private key never leaves your device or password manager	Signing you in with your face, fingerprint or screen lock	No
Sign-in attempts: the email tried, success or failure, and a one-way hash of the IP address (cleared after 30 days)	Stopping password guessing	No
Support tickets you send	Answering you	No
A security log of sign-ins and account changes: what happened, when, the browser type and your network only (the first three parts of an IPv4 address, e.g. 203.0.113.x, or the first three groups of an IPv6 address), never your full IP address	Protecting accounts and investigating abuse	No

The old site's separate sign-in for the browser games, which kept only a scrambled fingerprint of your email, has closed. Accounts here keep the address itself, as the table says, and we use it only for your account: never for newsletters or marketing.

The colony itself keeps only daily totals per cargo type, not who delivered what. Turning off Show me on leaderboards hides your scores and player page at once.

Until you finish the one welcome screen after joining, you aren't shown on any leaderboard.

How long we keep it

• Your account data: until you delete your account (then at once, see below).
• IP address hashes: 30 days. Full IP addresses: never stored.
• Visit counts: the individual page views, visits and clicks (with their daily hash) for 90 days; after that only daily totals (e.g. "412 visitors, 1,250 page views, 37 Play clicks on 4 October"), which we keep.
• Colony delivery IDs: 48 hours.
• The Third Leap launch email and playtest choices: until you withdraw them (on your account page, the game's page or the unsubscribe link: deleted at once) or delete your account.
• Crash reports: 90 days. Sign-in attempts: 90 days. Ended sign-in sessions: 1 year.
• Security log: up to 7 years, with the network only.
• Sign-up limits: to stop mass sign-ups we count, for one hour, how many codes and new accounts come from a network and an email domain. The counters hold scrambled keys, not your address or email, and vanish after the hour.
• A sign-in code we email to a new address: 10 minutes. If nobody enters it, no account is created and the code is cleared. Codes are stored only in scrambled form, never as the code itself.
• A "this wasn't me, lock my account" link we send to your old address after an email change: 7 days, usable once.

Signing in with Microsoft or Steam

If you use them, Microsoft tells us your account id, name and email address; Steam tells us your Steam id and, when we ask, your public name and picture. We use these only to sign you in and, for Steam, to offer your picture as an avatar. We never post anything to either.

Other services

• The site's pages, styles, scripts and images come from this site only; nothing loads from another site, except a Steam picture you chose as your avatar, which loads from Steam's image servers (we send no referrer).
• The site runs on our own server and reaches you through Cloudflare, which handles the connection and so sees your IP address.
• Email goes out through our mail provider; the logo in our emails comes from this site.

Your data, your call

• Download everything we store about your account as one JSON file.
• Delete your account: it happens at once. Your profile, saves, scores, keys and sessions are removed and your games are unlinked. Support tickets and ratings stay without your name or email so we can keep fixing the games; the security log keeps its entries without your account, and your email address and account id are removed from them.
• Questions: use support.