Found a bug? Tell me about it

Three kinds of message

What the game collects

You can play the whole game without signing in or giving a name. The game gives your browser a random ID (a UUID — not derived from anything about you) and stores it locally. There is still no analytics or tracking script anywhere on this site.

Achievements, lifetime statistics and run history live in your browser's local storage first. They are also sent to the server under that random ID, so they survive on another device if you choose to sign in. Clearing site data clears the local copy.

The daily reward is the one thing that only ever lives on the server: against that random ID it stores the date you last claimed a bonus and how many days in a row you have claimed one — two values, no history of every session. It cannot work any other way, since a streak your own browser could edit would not be a streak, but it is still something about when you play, so it is named here rather than left implied.

Four things leave your machine, and only when you do them:

• Sending a bug report — the two fields you type, the address of the page you sent it from, and that random ID, so you can read your own reports back later. Sent from inside the game, it also carries the technical context a developer would otherwise have to ask for: which mission, wave and difficulty, whether the run had started, your game speed and graphics setting, your frame rate, your window size and browser's user-agent string, and (when available) your GPU name.
• Submitting a leaderboard run — the display name you type, plus that run's waves, time and totals.
• Signing in with Google — optional, and only if you click it. Google tells us your account's email and name, which get attached to the random ID you already had.
• Buying something — payment is handled entirely by Stripe; card details never touch this server.

You do not have to take that list on trust: your account page reads back what is actually held against your ID — purchases, achievements and lifetime statistics, your daily streak, your leaderboard placings, and the bug reports you have sent. No sign-in needed; it asks about the random ID your browser already has.

The full version, with the third parties and the deletion details spelled out, is on the privacy page. If you want the data tied to your ID deleted, it is removed by hand — that page says how to ask.