Privacy and data use
Notice updated September 30, 2026.
This notice describes the data used by the current StrainCrush implementation. You can play as a guest without signing in with Google.
When you sign in with Google, we use your Google identity to recognize your account. Your display name appears publicly on the ranking when you record a ranked victory.
Account data
We store the Google account identifier (sub), display name, an internal identifier derived from the account, the unlocked online level, the best verified score and usage counters. The Google token is received to validate sign-in; it is not persisted in the database. Email and photo are not persisted by the application.
Public ranking
The ranking can be viewed without signing in and returns the player’s display name, score and internal identifier. Responses may be cached for 30 seconds. Signing out does not remove your name or score from the ranking.
Cookies and session
We use first-party Secure, HttpOnly and SameSite Strict cookies: __Host-sc-session maintains the session for up to 7 days; __Host-sc-csrf protects requests for up to 7 days; __Host-sc-nonce binds sign-in to the browser for up to 10 minutes. The database stores a hash of the session token and CSRF information. Signing out revokes the database session and clears these cookies; a new sign-in replaces the previous session.
Games and abuse protection
We store one online game per account: board, random state, level, score, sequence and last response, to validate moves and prevent replay. An attempt expires after 30 minutes, but this deadline does not delete its record: starting another game replaces it. To limit sign-in attempts, we store a hash combining IP and day, a count and an expiry; the code does not store the original IP in that table.
Expiry and deletion
Profiles, scores and counters have no automatic age-based deletion in the current code. Sign-in replay protection records expire after 2 hours and IP limits after 24 hours; cleanup runs in batches during new sign-ins. Expiring a session or game does not imply deleting its record. The game does not yet offer an account deletion button.
Progress on your device
Guest mode uses browser local storage for progress and preferences. Signing in with Google does not send that save to the server or turn local scores into ranking records. Google sign-in adds the account and online campaign.
Services and contact
Google provides sign-in, and Cloudflare runs the online application and stores data in D1. Radio and other external services have their own data practices. For questions or requests about application data, contact suporte@straincrush.com.
Conditions of use · current operation