What this site keeps, and why

Visiting

The server writes ordinary access logs (address, time, page, browser) that rotate away. The site uses TracePrint, my own browser-fingerprinting research script, to tell people from bots; it runs after the room has loaded. Cloudflare sits in front of the site and may set its own security cookies.

The safe

When you open the safe the server stores the puzzle, a one-way hash of your network address, your browser name, how long you took, how many keys you pressed or tapped, the gaps between them and whether the key was pasted. That is only used to keep the drops fair: keys entered faster than a person can read are refused, and very fast or pasted ones are shown to the admin. Nobody is banned for it.

Claiming a find

If you claim something, the certificate keeps the name and country you type, and the email you use (Google sign-in or typed). The name and country appear on the public hall of fame; the email never does. A claimed item cannot be moved to another person.

Signing in

Google sign-in gives the site your email, name and profile picture. They are kept so the blog can greet you and gifts can find you. You can ask for your record to be removed at any time.

Cookies and storage

• ay_s: your sign-in session (30 days)
• ay_admin: the admin session (7 days, admin only)
• Local storage: game statistics and an unfinished claim, only on your device

Questions, removal

Write to [email protected]. Requests to remove data are handled by hand, usually within a few days.