Nilefold privacy
Nilefold is a free game. It keeps as little as it can, and nothing about who you are.
What we store
- A random account ID, made when you first open the game. It isn't linked to your name, email or device.
- Your town: buildings, coins, goals and the other game progress, so it can follow you to other devices.
- When you last visited, to tell whether your cloud town is still active.
- Your recovery code and sign-in session, only as scrambled (hashed) values. We can't read your code back.
- Passkeys, if you add one: only the public half of the key (it can check a sign-in, not make one), plus the date added. Your face or fingerprint never leaves your device. Passkeys work on nilefold-900.pages.dev only.
- A short-lived counter per network address, also hashed, to stop bots from creating accounts or guessing codes. It's deleted after a day.
- A short-lived request counter per account to limit automated gameplay.
- An account suspension timestamp, only if we ever have to suspend an account by hand for abuse.
Your browser keeps a copy of your town and one cookie that keeps you signed in. There are no ads, no trackers and no analytics.
Where
The game and its data run on Cloudflare (Pages and the D1 database).
If many guest accounts are created from the same network address, we may ask you to verify with Cloudflare Turnstile before creating a cloud town.
Deleting your town
After at least one year without a signed-in visit, we delete your cloud town and its account, including recovery codes, passkeys and sessions. Visiting your town resets the inactivity period. Towns saved only in your browser follow your browser’s storage settings.
In the game, open Your town and choose Delete my town. That removes your account, your town, your codes, passkeys and sessions from our database right away, and clears the copy in this browser.