Privacy & trust

Identity without a website sign-in

Your native client maintains a persistent UUID and a private hub credential. The hub stores that installation UUID and a hash of the credential for authentication. This website does not ask you to paste either. A public profile uses a different opaque identifier; a name or an invite code cannot recover a lost credential.

Invitation codes are private

A code routes a guest toward a host session. Anyone holding it may attempt to join. Share privately and revoke or replace it through the host lobby. Invite pages do not check or disclose whether the host is online, are marked not to index or cache, and do not send referrers.

Public progression is optional

Only opted-in profile summaries appear in rankings and public achievement counts. These summaries are client-reported. The community progress API excludes full saves, inventories and private journal or dialogue contents. Publishing is not a cloud backup of your character or world, and the hub does not certify an anti-cheat competition.

The relay’s trust boundary

Co-op synchronization is separate from public profile sharing. World and welcome snapshots and guest journey state can include terrain, inventories, progression and journal data. The shipped hub forwards these gameplay packets through bounded volatile memory and does not persist them in SQLite or publish them as rankings. The host still runs the simulation and owns the world save.

HTTPS and secure WebSockets encrypt each client-to-hub connection. This is not end-to-end encryption: a trusted hub operator can inspect relayed traffic and could add recording. Turning off public sharing does not hide co-op traffic from that operator. Choose a server and fellow players you trust.

Deployment and retention

The server operator controls deployment, database persistence, access logs and backups. Disable public sharing in the game to stop participating in the public register. Contact your server operator about data removal and operational retention; this site does not invent a retention promise on the operator’s behalf.