Privacy notice

Accounts & recovery

Online play uses an account ID and a signing key stored in protected storage on your device. We store your username, progression, inventory, purchase records and match records to provide the game and preserve your progress. Other players can see your public name and match activity. Do not put private information in your username.

Optional email recovery uses a verified recovery identity through Amazon Cognito. Recovering returns you to the same account and revokes its old device keys and sessions. Accounts are not merged by matching email addresses. Losing an unlinked device key can mean losing access.

This notice describes the current account services. Online play and recovery may be limited during testing.

Player reports

Reports are available for a completed match in which you participated. A report contains the match, reporter, reported player and reason: cheating, an abusive name or disruptive play. Reports are private and support investigation; a report does not automatically prove misconduct or trigger a ban.

When you email support, your email address, message and any attachments become part of the correspondence used to address your request. Send only relevant information. Do not include passwords, verification codes, device keys or payment card details.

How long data is kept

Account, progression, inventory and purchase records

Kept until account deletion, to provide your account and game entitlements.

Recovery identity and email

Kept while linked to the account. Account deletion removes the linked recovery identity. Separate email-delivery safety records are described below.

Match history and player reports

Expire from the game service 90 days after match completion. Account deletion also removes personal reports involving that account. Removal of expired records from underlying storage is asynchronous.

Access sessions and signed challenges

Valid for 15 minutes and 60 seconds respectively. Physical removal of expired records is asynchronous.

Account API and backend function logs

Configured to retain 7 days of operational logs. API access logs record request IDs, routes, status and timing rather than bearer tokens or email addresses.

Recovery-email failure records

Private failure records may include recipient addresses and mail headers and are retained for up to 7 days. They do not contain email bodies or verification codes. Aggregate delivery metrics do not include recipient addresses.

Email suppression records

Hard-bounce and spam-complaint addresses may remain on a restricted suppression list until reviewed removal. This prevents repeated unwanted or undeliverable messages. These records are separate from the deleted recovery identity.

Database recovery backups

Earlier data may remain for up to 35 days. A restore must apply current deletions and revocations before reopening account access.

Security and disaster-recovery records

Minimal account/key revocation records and deletion receipts have no automatic expiry. Restricted disaster-recovery archives also have no automatic expiry and can contain account, recovery-identity and key associations. These records prevent revoked credentials or deleted accounts from returning after a restore; they are not anonymous records.

Shared match acknowledgements

Limited records may remain to prevent results being awarded twice and to preserve other participants’ completed match history.

Support correspondence and investigation notes

Emails and private support cases are handled separately from game accounts and have no automatic expiry. The game’s deletion flow does not erase them. Contact us about correspondence or case records you want reviewed or removed.

Account deletion

Choose DELETE ACCOUNT in the game’s account panel while signed in. Deletion permanently removes account access, progression, inventory, purchases and linked recovery. Cleanup waits for any running match and its results. Closing the game does not stop it.

A receipt saved on your device lets you check completion after restarting. Starting a new guest does not restore deleted data. The backup, security and email-suppression exceptions above remain separate from the active account.

If you cannot access the game, contact hello@ishtms.com for help. We may need to verify the account before responding to an account-specific request.

Providers & this website

Amazon Web Services hosts account services and stored game data. Amazon Cognito manages recovery identities, and Amazon Simple Email Service delivers recovery messages. Cloudflare delivers game assets. This public website is hosted through OpenAI Sites on Cloudflare.

We have not added advertising, analytics scripts, account sign-in or support forms to these pages. Hosting providers receive the network information needed to deliver the pages, such as your IP address and requested URL. Cloudflare adds security checks that can run JavaScript and use a security cookie to distinguish browsers from automated traffic. See Cloudflare’s explanation of these checks. The game’s retention periods above do not describe the hosting providers’ own operational records.

Support links open your email application. Sending a message uses your email provider and the support mailbox provider.

Privacy questions

For questions about your data, access, correction or deletion, email hello@ishtms.com. Include only enough information to explain the request. Do not send credentials or verification codes.

See support for account recovery, deletion and player-report guidance. The game also includes an offline DATA & SUPPORT notice in the account panel.