Nilefold privacy
Nilefold is a free game. It keeps as little as it can, and nothing about who you are.
What we store
- A random account ID, made when you first open the game. It isn't linked to your name, email or device.
- Your town: buildings, coins, goals and the other game progress, so it can follow you to other devices.
- Your recovery code and sign-in session, only as scrambled (hashed) values. We can't read your code back.
- Passkeys, if you add one: only the public half of the key (it can check a sign-in, not make one), plus the date added. Your face or fingerprint never leaves your device. Passkeys work on nilefold.pages.dev only.
- A short-lived counter per network address, also hashed, to stop bots from creating accounts or guessing codes. It's deleted after a day.
- A short-lived request counter per account to limit automated gameplay.
- An account ban timestamp if someone tries to submit forged state to a verified cloud town.
Your browser keeps a copy of your town and one cookie that keeps you signed in. There are no ads, no trackers and no analytics.
Where
The game and its data run on Cloudflare (Pages and the D1 database).
If many guest accounts are created from the same network address, we may ask you to verify with Cloudflare Turnstile before creating a cloud town.
Deleting your town
In the game, open Your town and choose Delete my town. That removes your account, your town, your codes, passkeys and sessions from our database right away, and clears the copy in this browser.