Privacy policy

Last updated 18 October 2026

This covers KICKTABLE: the site and your account. "We" and "us" mean KICKTABLE. In short: without an account, nothing you play leaves your browser. With one, our server keeps your email address and your career, and you can delete both.

1. In your browser

Replays and settings never leave your browser, signed in or not. They are kept in its local storage under kicktable.v1. So is your career, the numbers each room records. Without an account that is the only copy, and nothing you play is sent to us. Clearing this site's data in your browser erases it.

2. On our server, with an account

• Your email address, in lower case, and whether Google has confirmed it is yours.
• A hash, never your password. Your browser stretches the password into a key with PBKDF2, 600,000 rounds, and sends only the key. The server stores a SHA-256 hash of that key and a random salt. We cannot read your password or send it back to you.
• Your Google id, if you sign in with Google: the id Google gives your Google account. Google's sign-in can also carry your name and picture. The server keeps neither.
• Your career: each room's runs, pieces, personal bests and recent times. With it, when it last changed and the ids of its last few saves, so two devices never count a run twice.
• When the account was made.

We keep an account until you delete it.

3. Staying signed in

Signing in sets one cookie, kt_session. It is HttpOnly, so no script on the page can read it. It lasts 60 days and is renewed while you keep using the site. The server stores only a hash of it, with when it was made and when it runs out. Signing out ends it. It is the only cookie the site sets.

4. Limits on tries

To slow down password guessing and mass sign-ups, the server counts two things:

• sign-ups from each IP address, for an hour;
• wrong passwords for each email address, for 15 minutes.

A count is the address and a number. It is deleted after its window closes, and a right password clears its email's count at once.

5. Who else handles it

• Cloudflare hosts the site, runs the server and holds the database. Every visit goes through Cloudflare, which sees your IP address and browser as any host does and may keep its own logs. Its privacy policy covers that.
• Google runs Google sign-in. Opening the Account sheet loads Google's sign-in button from accounts.google.com, so Google sees a request from your browser even if you never press it. If you do sign in with Google, it tells us your email address and Google id. Google's privacy policy covers what Google does.

Nothing else is loaded from anyone else. The fonts ship with the site.

6. What we do not do

• No analytics, no tracking and no ads.
• We do not sell your data, or share it with anyone beyond the two above.
• The site sends no email.

7. Deleting your account

Open Account, the person icon at the top, and press delete account, then delete for good? within four seconds. That erases your account from the server: your email address, how you sign in, all your sessions and your career. It cannot be undone. The browser you did it in starts with a clean career. Its replays and settings stay until you clear the site's data.

Only the counts in section 4 can outlast it, until their windows close.

8. Changes

When what the site keeps changes, this page changes with it. The date at the top says when it last did.