What the game keeps, and what it doesn't.

Privacy

What is stored

The state of each game: its configuration, categories, questions, answers, scores, team names, and player display names (60 characters at most). Alongside that, a hashed session token for every seat in the room, so the server can tell which phone is which. There are no accounts, so there is no email address, password, or profile. Separately from the game itself, the server keeps a diagnostic event log — see Diagnostics below, which is the only other place anything about your device is recorded.

Cookies

One, named str_did. Its value is 128 random bits and nothing else: it is not your IP address, your browser version, or your screen size, and it is not derived from them. It carries a single claim — that two entries in the diagnostic log came from the same browser — which is what lets a phone that crashed and came back be read as one device instead of two. It is not a login and it opens no room: authority comes from the hashed session token above, never from this. It is set on your first page view and lasts a year. Blocking it costs you nothing in the game; it only makes the logs harder to read.

Besides that cookie, the game uses your browser’s localStorage and sessionStorage to restore your seat if you reopen the room, to tell one tab apart from another, and to remember preferences such as whether you muted the music and how far you got in the tutorial. All of it stays on your device.

How long it lasts

Rooms expire on a 12-hour rolling window that refreshes while the room is in use. A cleanup job runs every 30 minutes and deletes expired rooms, their sessions, and the records that go with them.

Diagnostic events are kept longer than the room they describe: 30 days, and 180 days for a problem report you or a Host deliberately files. They are deleted on that schedule whether or not the room still exists.

What leaves the server

Category text and answers are sent to Anthropic’s API to generate questions and to check answers. Music and sound effects are served from stealtheround.com itself. There are no analytics, no ads, and no third-party trackers.

Diagnostics

While you are in a room, the game records what happened during the match to a first-party event log — phases, actions, timings, and failures — so a problem can be reconstructed afterwards. Each entry is tagged with the str_did cookie above and a per-tab id, which is what makes one device’s story readable end to end.

Once per device per match, that log also records your browser’s characteristics so later entries do not have to repeat them: user-agent string, language, platform, window and screen size, pixel ratio, time zone, and whether you have reduced motion turned on. This is a first-party log used to fix the game. It is not shared, sold, or sent to any third party, and it is not used to build a profile or to advertise to you.

Error reports

If a page crashes, the browser sends a report to the same log: the error message, its stack trace, the page URL, and your browser’s user-agent string. It is used to fix bugs.

Rate limits

Creating and joining rooms is rate-limited by IP address, to keep the service up for everyone.

Questions and data requests

Write to support@stealtheround.com. Because there are no accounts, there is no profile to look up and nothing to sign in to: say roughly when you played and what the room code was, and the matching diagnostic records can be found, shown to you, or deleted ahead of the schedule above. A room that has already expired is gone, and so is everything in it — there is nothing left to retrieve.

The same address takes security reports. It is also published at /.well-known/security.txt.