Privacy Policy
Effective 27 October 2026
Hidden Front (the “service”) is a web board game that you can use without creating an account. Only players who want a ranking and a record of their games sign in with a Google account. The service never asks for your real name, email address or phone number. This document explains what is stored in your browser, what is sent to the server during online games, what is kept for signed-in accounts, and how advertising and cookies are handled.
Values stored in your browser
The values below are stored in your own browser. Settings, learning progress, interface state and mini game records are never sent to the server. Your nickname and seat information are sent to the game server when you take part in an online game. Anything left in your browser can be removed by clearing the site’s data.
| Nickname | The name you chose or were given. Sent to the server and shown to your opponent when you join an online game. |
|---|---|
| Settings | Music, sound effects, mute, and the interface language. |
| Learning progress | Which lessons and puzzles you have completed. |
| Seat information | A seat token that returns you to the same seat after a reload in an online game. It is sent to the server when you join or reconnect and is never shown to your opponent. |
| Interface state | Whether you have already seen a tip, and similar interface flags. |
| Mini game records | Best score and time for each mini game. |
Notes you write on enemy pieces during a game are not stored. They disappear when the game ends or the page reloads.
Information processed during online games
To connect two players, the game server processes the room code, nicknames, seat tokens, piece moves and combat results, and connection status. This information is used only to run that room and is deleted together with the room seven days after the last move.
Google sign-in and accounts
Signing in is optional. Every game mode is available without it. When you sign in, the
service requests the narrowest possible scope from Google (openid). Google
therefore passes on nothing but an account identifier that is unique to this service; your
email address, name and profile picture are not received.
| Account identifier | Google’s identifier for your account and an account number created by the service. Used only to recognise the same person again. |
|---|---|
| Nickname | The name you chose or were given. Stored with your permanent account code and remaining rename tickets so that signed-in devices use the same profile. |
| Sign-in session | The value that keeps you signed in and its expiry time. The server stores only a hash of the cookie value, never the value itself. Sessions expire after at most 180 days. |
| Creation time | When the account was first created. |
Signing in uses two cookies in your browser: a session cookie that keeps you signed in (at most 180 days) and a short-lived cookie (10 minutes) that verifies the request was not forged while you were on Google’s sign-in page. Both are strictly necessary for the service to work and are not used for advertising or analytics.
Pressing Delete account in settings immediately deletes the account, its sign-in method and the sign-in sessions on every device. Signing out deletes only that device’s session. Account data is stored and processed on Cloudflare (Workers and D1), and sign-in authentication is provided by Google.
Ranked games and the leaderboard
When a signed-in player plays a ranked game, the service stores their rating and their wins, losses and draws for that season on the account, and keeps a record of the game (both accounts, the result, and how and when it ended). Once a player has completed enough games to be placed, their nickname, rating and record appear on the public leaderboard. Deleting an account deletes its rating, and the deleted person’s account is blanked out of their opponents’ game records.
Reports and blocking
When you report an opponent, the service stores both players’ nicknames, accounts (if signed in), device identifiers, the reason and the time, for review by the operators. The device identifier is a random value used only by this service. It is never sent to your opponent as is; only a short key derived from it is shared, for blocking. Your block list is stored only in your browser, and the keys in it are sent to the server when you look for a match so that blocked players never meet. Deleting an account blanks the account field in any reports.
Feedback
When you send feedback, Cloudflare D1 stores its type, title, details, language, receipt ID and time. A keyed hash of the network address is stored to limit submissions; the raw IP, nickname and account are not stored with feedback. The hash is used only for the hourly limit and is deleted at the next scheduled cleanup after an hour. The team transfers the content to a private GitHub issue. Once its issue number is recorded, the title and details are cleared from D1. Failed deliveries retain their content for retry. Do not include passwords or personal information.
Advertising and cookies
The current version of the service does not load any advertising script. The following applies if and when Google advertising is served.
- If Google advertising is served, third-party vendors including Google use cookies to serve ads.
- Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the internet.
- You can opt out of personalised advertising in Google’s ad settings.
- To opt out of third-party vendors’ use of cookies for personalised advertising, see aboutads.info.
- How Google uses information from sites that use its services is described in Google’s policy.
Contact
For questions about this policy, open the main menu and choose Send feedback. You do not need to sign in. This document is also available in 한국어.
← Back to Hidden Front