Privacy

Last updated 2026-08-31

PYLOS is a small board game. It has no analytics, no advertising and no third-party trackers of any kind, and it never asks who you are. This page describes everything it does keep, and why.

What your browser stores

PYLOS sets no cookies. It uses your browser’s local storage, which stays on your device and is only ever read by this site:

• A session token — a random string with no meaning outside this game. It is what lets your rating and record follow you back on your next visit.
• Your chosen display name.
• Your display settings: colour theme, piece palette, whether moves need confirming, and whether sound and music are on.

Clearing this site’s browser storage erases all of it, and starts you over as a fresh anonymous player.

What the server stores

For every player, the server keeps only what a game of PYLOS needs:

• the session token described above;
• the display name;
• the rating, and the count of wins, losses and games played;
• when the profile was created, and when it was last seen.

There is no message history, and no record of the moves you made once a game is over.

Your IP address is used for one thing: counting how many connections a single address has open, so that one machine cannot flood the server. That count lives in the running server’s memory, is never written to disk and never appears in any log, and the entry is discarded once you disconnect.

If you use the contact form

The contact form is the only way to write to whoever runs PYLOS, and it stores exactly three things:

• the message you typed;
• the reply address, if you chose to give one — the field is optional, and leaving it blank simply means no reply;
• the time it was sent.

Your IP address and user agent are not recorded with it, and neither is anything that would tie a message to a player profile. Messages are written to the same disk as everything else on this page and are not sent to any third party — there is no email provider, no form service and no ticketing system in the path. They are kept for 90 days and then deleted automatically.

If you sign in with Google

Signing in is entirely optional — the whole game is playable without an account. If you do sign in, one extra item is stored alongside the profile above: Google’s sub, an opaque identifier that Google issues per application. It is a meaningless string anywhere but here, and it is the only thing that links your account to your Google one.

Your email address, real name and profile picture are never requested, never shown and never stored. The server reads the identifier out of the signed token Google returns and discards everything else in it. Your username here is one you choose at sign-up; it is not taken from your Google account.

Google’s sign-in library is loaded from Google’s servers when sign-in is available on this deployment, so that Google’s own sign-in button can be drawn. Loading it means Google can see that a browser requested it. What Google does with that is covered by their own privacy policy, not this one. If sign-in is not configured on the server, the script is never fetched and your browser never contacts Google at all.

Where it is kept

PYLOS runs on Render, in the United States. Profiles are held in the running server’s memory and written to a disk attached to that service, so a restart does not wipe the leaderboard. Messages from the contact form are written to that same disk. Nothing is sent anywhere else.

How long it is kept

• A guest who only looks around — browsing the lobby, or leaving before a game finishes — is never written to the server’s disk at all. Nothing of them outlives the server process.
• A guest who plays is kept for 90 days after their last visit, then deleted automatically.
• A signed-in account is kept until it is deleted.
• A message sent through the contact form is kept for 90 days, then deleted automatically.

What you can do

• Play with no account at all. Everything except rated games and the leaderboard works anonymously.
• Reset yourself completely by clearing this site’s browser storage. That discards the token, and with it the profile it pointed at.
• Ask for your account to be deleted. Send a message through the form below and it will be removed, along with the identifier and the record attached to it.

Contact

For anything on this page — deletion requests included — use the contact form. It reaches whoever runs PYLOS and passes through no one else. Include a reply address if you would like an answer; without one the message is still read.

Changes

If this policy changes, the date at the top of the page changes with it.