Gambit Dungeon
0 About
The small print

Privacy notice

What the game keeps about you, why, for how long, and how to get a copy or have it deleted. In plain words, because there isn't much.

Last updated:

Who is responsible

Gambit Dungeon is made and run by Nick Kritikos, based in Greece (“we” in this notice). We decide how the data described here is used, so under the EU General Data Protection Regulation (GDPR) we are its controller. You can reach us at trailbookgr@gmail.com.

What stays on your device

Most of the game runs in your browser and keeps its data there, in local storage and IndexedDB: your runs and run history, puzzle history and rating, lessons and stars, review cards, settings and theme, your account key, and a random key that keeps this device's XP and run counts apart from your other devices' in your synced progress. A service worker keeps a copy of the game's pages and puzzles so it works offline.

None of this leaves your device except as described below. You can delete it at any time, with “Clear this device” or “Delete my account” under Your data on Journey, or by clearing this site's data in your browser. Clearing the browser also signs this device out, so keep your account key (on Journey) if you want your synced progress back.

What the server keeps, and why

When you finish puzzles, the game makes an anonymous account for your browser and backs up your progress, so it can follow you to other devices and post your Daily and Weekly scores. There's no sign-up. This is everything the server stores:

Your account

What
A random account id, your name (the one you pick, or a made-up one until you do), when the account was made and last used, a timestamp used to limit how often your name can change, and a scrambled (hashed) copy of each sign-in key. The game makes your account when you first need one: when you pick a name, sync your progress, play co-op, post a score or ask for a claim code. Link codes for signing in another device work for 10 minutes. To slow down abuse, the server counts a few things for about a minute: new accounts per IP address, refused names per account (so nobody can test the list of banned words one by one), and attempts at the admin tools per IP address. The counts live in the server’s memory and, for new accounts, in Cloudflare’s rate limiter. They are never stored with your account.
Why
To back up your progress and sign your devices in to it.
Legal basis
Contract: running the game you asked for (Art. 6(1)(b) GDPR).
Kept
Until you delete the account (Your data, on Journey) or ask us to. Link codes are deleted once used or replaced. If payments belong to a deleted account, its random id and dates stay with them, its name removed.

Passkeys

What
Only if you save your account with a passkey: for each one, its id, its public key (which can check a sign-in but never make one), a random id the passkey holds for your account instead of anything about you, its signature counter, whether your password manager syncs it, and when it was saved and last used. While you save or use one, a one-time challenge that lasts 5 minutes. Your fingerprint, face or PIN never leaves your device: it only unlocks the passkey there, and the server never sees it. To slow down abuse, the server counts passkey requests per account or IP address in its memory for about a minute; that count is never stored.
Why
To sign you in to your account on any device, without an email or password.
Legal basis
Contract (Art. 6(1)(b)).
Kept
Until you remove the passkey (on Journey) or delete the account. A challenge is deleted once used; an unused one is deleted the next time anyone saves or uses a passkey after it expired.

Synced progress

What
One copy of your progress, merged from your devices: rating and puzzles played, XP and runs per device (under a random key each device makes for this), lesson stars, Daily results and their share text, achievements, review cards (puzzle ids and due dates), the looks you wear and your Codex. Run history and runs in progress stay on your device, and so does each co-op room’s log, kept so a reload can rejoin.
Why
So your progress follows you to every device you link, and isn’t lost with one browser.
Legal basis
Contract (Art. 6(1)(b)).
Kept
While the account exists.

Leaderboards

What
For each Daily, Hard Daily and Weekly you post: your name, score, how far you got and with which hero, when you posted, and the run’s action log (your moves and choices, with their timings). A monthly season total built from your Daily scores.
Why
To check every score by replaying it, and to rank it.
Legal basis
Contract (Art. 6(1)(b)).
Kept
As part of each board’s history, until you delete the account or ask us to. Your rows then leave the boards within a minute, since the server reuses each board’s top list for that long.

Supporter payments

What
Your claim code, once you ask for one on the Support page, and when it was made. For each gift on Ko-fi: Ko-fi’s transaction id, its type (a gift, a monthly gift, a shop order or a commission), the amount and currency, and when; the account the claim code in your message names (none until one does); the amount counted in US dollars; and whether it gave lifetime wings, was refunded or was Ko-fi’s test. Ko-fi’s notice to us also carries your Ko-fi name, email address and message: the game reads the claim code in the message and stores none of them. From these, your wings (months given, until when, colour) and whether you chose to be on the thanks wall. If you pick a crest, it’s kept with your wings and shows by your name only while your wings last. To slow down abuse, the server counts claim codes per IP address, and changes to your wings, thanks wall choice or crest per account, for about a minute. The counts live in the server’s memory and, for claim codes, in Cloudflare’s rate limiter. They are never stored. Premium purchases from before the game went free are kept the same way.
Why
To give your wings to the account your claim code names (the code is how a gift finds your account without your email or name), to add a gift by hand when you forgot the code, and to show the month’s total on the Support page.
Legal basis
Contract (Art. 6(1)(b)).
Kept
Your claim code, wings, crest and Premium records while the account exists. Payment rows stay after you delete the account, because tax and accounting law require them; Ko-fi’s test payments are deleted with it. A gift no claim code matched is kept the same way, with no account.

Co-op rooms

What
For each live co-op room: its invite code, the players’ account ids and names, the settings and heroes they chose, whether and since when each is connected, and the run’s log (every move and choice, with its time). When you’re ready your device sends the ids of puzzles you played lately and up to four missed puzzles to bring as nemeses; the log keeps them from the start, the nemeses only if the captain turned them on. Coaching marks, pings and emotes are passed to your partner and not stored.
Why
To play a co-op run: keep both players’ games in step, let a dropped player catch up, and tell a partner when you’re away.
Legal basis
Contract (Art. 6(1)(b)).
Kept
7 days after the room was last used; then the room deletes itself, log and all. Deleting your account doesn’t reach a room before then.

“I’d chip in” votes

What
Your account id, the amount you said you’d give, and when.
Why
To decide how and when to take gifts. Votes were taken until gifts opened on Ko-fi.
Legal basis
Legitimate interests (Art. 6(1)(f)).
Kept
While the account exists.

Usage counts

What
How many times each event (like “a run was started”) happened each day, added up across all players and sent with nothing that tells players apart. For accounts: each day the game checked in with the server while signed in (when it opens or backs up your progress), the day the account was made and the last day it was counted, under a scrambled (keyed hash) copy of the account id instead of the id itself. Nothing is stored on your device for this, and players without an account aren’t counted.
Why
To see which parts of the game are used, how many players come back, and how many new players return the next day and the next week.
Legal basis
Legitimate interests (Art. 6(1)(f)): improving the game with as little data as possible. With Do Not Track or Global Privacy Control on in your browser, neither is counted.
Kept
The day totals are kept: they say nothing about any one player. Account activity is deleted after 90 days: each counted day once it is 90 days old, and the account’s made and last-counted days 90 days after it was last counted (the server clears them each time it counts an account). Deleting your account deletes its activity at once.

The game's server doesn't store IP addresses, browser details (user agents) or your location, and it never uses your data for advertising or sells it.

What other players see

  • On each score you post: your name, with your wings and crest if you’re a supporter, how far you got and your hero.
  • The runs behind the scores. While a board still takes scores, only players who have posted their own score on it can watch its runs; once it closes, anyone can.
  • Your name on the Support page's thanks wall, only if you choose to be listed there.
  • In a co-op run, the game sends your partner, through our server: your name, the hero you pick with your puzzle rating, co-op Depth and how many runs you’ve played, your moves and choices, whether you’re connected, the marks, pings and emotes you send, and the ids of puzzles you played lately (so the run skips them). Your partner sees the puzzles you bring as nemeses only if the captain turns nemeses on. The room keeps the run’s log for 7 days after it was last used, then deletes itself.
  • Whatever you share yourself, such as a result's share text or share card.

You can pick your name when you start, or keep a made-up one. If you’d rather stay anonymous, pick one that doesn’t identify you.

Who else handles it

Cloudflare hosts the game, its server code (Cloudflare Workers), its database (Cloudflare D1) and its co-op rooms (Cloudflare Durable Objects). Every request passes through Cloudflare's network, which sees your IP address to deliver it. Cloudflare processes this for us as a processor, under its data processing addendum, and may do so outside the EU, including in the United States, with the safeguards that addendum provides (such as the EU's Standard Contractual Clauses).

Ko-fi and Stripe: Gifts go through Ko-fi, and Stripe takes the card payment for them. They collect what they need for that, such as your name, email address and card details, under their own privacy policies. Ko-fi then tells our server about the payment: its transaction id, type, amount, currency and time, with your Ko-fi name, email address and message. The server reads the claim code you typed in the message, to find your account, and keeps the transaction id, type, amount, currency, time and that account, as listed under “Supporter payments” above. Your name, email address and message are not stored.

Nobody else. Fonts, art and puzzles come from the game's own site. Links to other sites, such as a puzzle's page on Lichess, only take you there when you open them. Opening a position on Lichess (“Analyse on Lichess”) sends that position to Lichess in the link, and the game’s moves if you open a game; the game sends nothing else, and Lichess sees your visit as it sees any other. Practising five- to seven-piece endings in the Citadel sends each position on the board to the Lichess tablebase (tablebase.lichess.ovh), which judges your moves and plays the defence; nothing else goes there, and Lichess sees each request as it sees any other.

How long it is kept

  • On your device: until you clear it.
  • Your account, progress and scores: while the account exists. Nothing is deleted automatically at the moment, so they stay until you delete the account (under Your data on Journey) or ask us to. Deleting the account removes its progress and takes its scores and season places off the leaderboards.
  • Payment records: tax and accounting law require us to keep them, so they stay when you delete the account: the transaction id, the amount and currency, the date and the account's random id, with no name or anything else left with it. Test payments, which aren't money, are deleted, and so is your claim code.
  • Link codes: they work for 10 minutes and are deleted once used or replaced.
  • Co-op rooms: each deletes itself, with its run's log, 7 days after it was last used.
  • Usage counts: the day totals are kept, since they say nothing about any one player. Account activity is deleted after 90 days, or at once when you delete the account.

Your rights

Under the GDPR you have the right to:

  • access your data and get a copy of it;
  • correct it (you can change your leaderboard name yourself, on Journey);
  • have it deleted;
  • restrict how it's used, or object to a use;
  • take it with you in a machine-readable form (portability);
  • complain to a data protection authority: in Greece, the Hellenic Data Protection Authority (dpa.gr), or the one where you live.

To object to the usage counts, turn on Do Not Track or Global Privacy Control in your browser: the game then sends no event counts, and the server doesn't count your account's activity.

Access, deletion and portability you can do yourself, under Your data on Journey:

  • Download my data saves one JSON file with everything the game holds about you: what this device keeps, and every row the server keeps for your account. Your account key is left out of it, since it signs in to the account.
  • Delete my account deletes the account on the server (its progress, leaderboard scores and season places, supporter wings, activity counts and sign-in keys), then everything on this device, once you type DELETE. Payment records stay, as described above. A refund is a separate matter: message us on Ko-fi or write to us. Without an account, Clear this device wipes what this browser keeps.

For anything else, or if the buttons don't work for you, write to trailbookgr@gmail.com. So we can tell the account is yours, include your leaderboard name and your account key (on Journey, under “Account key”). Anyone with the key can use the account, so send it to that address only. We'll answer within one month.

Cookies and local storage

The game sets no cookies. It uses your browser's local storage and IndexedDB to work: your progress and settings (with the random key that keeps this device's counts apart in synced progress) and your account key (so this device stays signed in). Its service worker keeps a copy of the game so it opens offline. Nothing is stored on your device for usage counts or analytics, and there are no advertising or tracking cookies and no outside analytics.

Children

The game asks nobody for their age, real name or contact details. It asks new players what to call them. Anyone who skips gets a made-up name. Younger players should not use their real name there. Supporting the game with a payment is for adults, or with a parent's or guardian's permission. A parent or guardian who wants a child's data deleted can write to trailbookgr@gmail.com.

Changes to this notice

When this notice changes, the date at the top changes with it. If a change affects what we keep or why, this page will say so.

On 17/10/2026 the game started asking new players for a name before their first level check or run. Picking one makes the account. To limit name changes and slow down abuse, the server now keeps a timestamp with each name and counts new accounts per IP address for about a minute (see “Your account”). Supporters can now pick a crest to show by their name, kept with their wings (see “Supporter payments”). The server now also counts claim codes per IP address, and refused names and supporter settings per account, for about a minute; these counts are never stored.

On 14/10/2026 gifts moved to Ko-fi: the Support page gives you a claim code to type into your Ko-fi message, and the server keeps each gift's transaction id, type, amount, currency and time with the account the code names, as listed above under “Supporter payments”. Ko-fi also sends your Ko-fi name, email address and message; none of them is stored.

On 07/10/2026 we added passkeys, which you can choose to save your account with: the server then keeps each passkey's public key and dates, as listed above under “Passkeys”. Your fingerprint, face or PIN never leaves your device.

Earlier versions of the game kept a random device id in local storage and sent it with the usage counts. The game now deletes that entry when it opens and sends no id with them, and the server deletes the usage rows stored under those ids. Where the same id already labelled this device's counts in your synced progress, it stays on as the key for those counts, and is used for nothing else.

Contact

Nick Kritikos, Greece. Email: trailbookgr@gmail.com. See also the Terms of use.