Privacy Policy

Spy Cards is an online game, and therefore some amount of data passes through computers not owned by the player. This page describes all data stored, transferred, or processed by Spy Cards, as well as the reason Spy Cards needs that data.

Web Hosting

Spy Cards is hosted on IPFS and served by Cloudflare. Cloudflare may temporarily record some anonymous diagnostic data about the files your browser requests from this site. This type of logging is standard for almost every website in existence. For more information, see Cloudflare's privacy policy (the section on "End Users" is the relevant one). Data about page load speed is also collected, and no personally-identifiable information is attached to this.

Matchmaking Service

A matchmaking service is used to assist players in connecting to each other online. This service generates a 15-byte random key for player 1 and accepts it from player 2. After this, it relays data between player 1 and player 2 until they can establish a connection. Since this is a web service, the same logging as described in the Web Hosting section is relevant here. The full source code of the signaling server is available for download.

Custom Card Portraits

Images uploaded in the custom card editor are stored in a database, along with metadata about when the image was uploaded including IP address and timestamp. Spy Cards reserves the right to delete custom portrait images for any reason at any time.

Data Stored on Your Computer

Spy Cards stores the decks you have used recently in your browser's localStorage. This data is not transmitted to any server and is only used to speed up the deck selection process by allowing you to select a recent deck rather than building a new one for each match.

Data Sent to Your Opponent

During the match, only data specifically required for gameplay is sent to your opponent. Both your opponent and the matchmaking server participate in the establishment of this connection, described in the Interactive Connectivity Establishment section below.

All data sent to your opponent during the match is either explicitly entered by you by clicking buttons on the screen, or randomly generated security tokens used to prevent cheating. There is no personally identifiable information sent during the match.

Interactive Connectivity Establishment

The specific data sent during ICE is decided by your browser. This generally includes your public IP address, as well as a connection-specific temporary password and information about how to contact your computer on the local network, which may be an IP address or a temporary MDNS hostname.

Public STUN servers are used to allow your computer to discover its public IP address to allow matches to be played outside of a single local area network. However, if your browser provides its own Interactive Connectivity Establishment servers, those are used instead. As of July 2020, no browser currently provides implements the required API extension. The current server addresses used by Spy Cards is stun.stunprotocol.org.

Data Stored in the Database

Custom game modes can be made "official" by entering their cards and game mode settings into a database. All data stored in this database is explicitly entered by the user. There is no personally-identifiable information stored by the game mode data service.