Privacy

Witchspace keeps as little about you as it can. No adverts, no tracking cookies, and nothing is sold.

Playing without an account

Your commander is saved in your own browser and never leaves it. Nothing about you is sent to us.

If you sign in

• What we keep: your email address, your callsign, and a copy of your commander (the cloud save), so you can carry on from any device.
• Why: your email is only used to send you sign-in links. We don't send newsletters or anything else unless you ask for them.
• If you let the companies contact you: only if you switch it on (press A, then Let the companies contact me). For notifications we keep the address each browser you switch them on in gives us, which identifies nothing but that browser; for email we use your sign-in address. Messages come at most twice a week, in character, when a special assignment is waiting, and every email has a one-click stop. Switch it off at any time, and deleting your account removes it.
• Security: sign-in links (and the 6-digit codes sent with them) work once and expire after 20 minutes; a code allows five tries. Links, codes and sessions are stored only as one-way hashes. You stay signed in on a device for 30 days from your last visit. To save typing, your browser remembers the last email you signed in with, on that device only.
• Deleting it: press A on the title screen, then Delete account. That removes your email, callsign, cloud save, sessions and contact settings straight away. Your commander stays in your browser.

Shared space

When you fly in shared space, your ship's position, callsign and rank are sent to the other commanders in your star system while you're there. Nothing is kept after you leave.

The ideas board

To give each idea one vote per person without accounts, your browser keeps a random id. To stop abuse we keep a one-way hash of your network address, never the address itself. What you post is public.

Counting how it's played

Once a day, the game tells us which rules your commander uses (Modern or Classic) and whether the 1984 look is on, and when a new commander is started, which rules they chose. We keep only the day's totals. To count each device once a day we keep a one-way hash of your network address for that day, never the address itself, and nothing else about you.

Counting visits

We count visits to the website and the game with Vercel Web Analytics: which pages are seen, which site sent you there, and roughly which country and kind of device you're on. It uses no cookies and keeps nothing that identifies you: a visitor is told apart by a hash that changes every day, and your network address isn't kept.

Who handles it

The website is hosted by Vercel, which also counts the visits. Shared space, the ideas board and accounts run on Cloudflare. Sign-in emails, and company messages if you ask for them, are sent by Resend. Notifications go through your browser's own push service (Apple, Google or Mozilla), which sees only that a message arrived, not what it says. Images and videos are served by Cloudinary. Cloudflare's Turnstile checks that you're a person when you sign in or post an idea. The website's fonts come from Google Fonts, which sees your browser's address when it loads them.

Questions

Email hello@witchspace.org.uk.