what stays on your device

Your device keeps your whole record: your answers in the free rep and in each run, what you did, what came back, every rep in the ledger, and the reps still out and waiting. They sit in your browser’s storage. Save a copy in the ledger writes them to a file you hold, and that file goes wherever you put it.

what the server holds

It holds your email address. A sign-in link works once and for fifteen minutes; the server keeps a hash of its secret half and deletes the record an hour after the link expires. Sessions are kept as hashes too, and deleted 30 days after they end. It also holds your Stripe customer number, your subscription’s status, length and renewal date, and the day a founding subscription ends if you hold one.

what leaves your device once

When you sign in on a device that already carries reps, it sends the number of reps and the date of the oldest one, to check whether you were here before the subscription began. The reps themselves stay where they are.

analytics

Flirtcraft uses HeyCatch to see how people find the site and move through it. HeyCatch receives the pages you open, the page you came from, your browser and device, your IP address, and on the pricing, about, terms and privacy pages, the text of what you click. Clicks inside the game itself are left out, so the answers you tap stay on your phone. When you sign in, HeyCatch learns your account number and email address, and later whether you opened checkout, subscribed or cancelled. It records nothing on the page your sign-in link opens, because that address carries the link’s secret. Screen recording is switched off.

cookies

Flirtcraft sets one cookie, flirtcraft_session, when you sign in. It lasts 90 days, so you stay signed in with no signal. HeyCatch sets its own cookie and browser storage to recognise a returning visit. Your browser also stores the ledger, your place in the free rep and a cached answer to whether you may draw, which is what lets the draw work offline.

who else is involved

Stripe takes payments, and card details go straight to it. Resend sends the sign-in email, so it handles your address. Vercel hosts the site, and like any host its servers log requests, including IP addresses. The server’s records sit in a hosted Postgres database. The typefaces load from Google Fonts, so Google sees your IP address when your browser fetches them. HeyCatch runs the analytics described above. Every outside service Flirtcraft uses is on this list.

deleting your account

Write to wendell@masteringallyship.com from the address you signed in with, and your account, sign-in records and sessions are deleted. Stripe keeps its own record of past payments, as the law requires of it. The reps on your phone are yours to delete: clear the browser’s data for this site.

Your reps stay on your phone. The server holds an email address and a billing record.