Privacy at Tokenstone

Updated October 14, 2026

Tokenstone uses account and game data to sign you in, run matches, reconnect players and maintain rankings.

Account information

Email registration stores your email address, display name and a salted password hash. The application does not store your original password. Email ownership is not verified for password registrations at this time.

If you choose a connected sign-in provider, we receive its account identifier, profile name and, when supplied and verified by that provider, email address. X sign-in does not supply an email address. Provider access tokens are used to establish your identity during sign-in and are not retained in the account database. We do not use them to post, read your publications or send messages.

Game information

We store match participants, accepted game actions, results and ranking statistics. This lets the server restore a game after an interruption and calculate results consistently. Other players can see your display name, rating, wins, losses, favorite CEO, played cards and preset emotes. Private hands, decks and choices are sent only to the player entitled to see them during the match. Email addresses are not included in public profiles or leaderboards.

Cards you choose to share

When you choose Share Elo, Share victory or Share invite, we save a public card and image with your display name and the rating, result or room invitation shown on the card. Match cards can also show your opponent's public display name and the CEOs played. Anyone with the link can view it without signing in. Cards preserve the information from when they were created; invitation pages show when a room has closed. Cards do not contain email addresses, private hands, decks or provider identifiers.

Post to X opens its editor with the card link and suggested text. Tokenstone does not publish a post automatically. The sharing destination's own privacy policy applies when you open or share through it.

Cookies and browser storage

A session cookie keeps you signed in for up to 30 days. It is protected with HttpOnly, Secure and SameSite settings on the public site. A short-lived cookie binds provider sign-in to your browser. Signing out revokes the current session. Local browser storage remembers preferences such as sound, solo difficulty and your selected CEO. Tab storage remembers a pending friend invitation for up to ten minutes so it can survive provider sign-in.

Infrastructure and providers

The game runs on our application server with SQLite storage and consistent backups. Cloudflare handles DNS, HTTPS delivery and protection. IP and connection information are used to operate the service and limit abusive requests; technical error logs may be generated. The current interface also loads fallback web fonts from Google Fonts.

When you choose Google, GitHub or X sign-in, your browser also connects directly to that provider. Its own privacy policy applies to that part of the process. Only providers currently configured for this game are offered.

Retention and requests

Account and match records are retained to support the account, game history and rankings. Recovery backups can contain earlier copies of these records. To request access, correction or deletion of your account information, contact [email protected] using the address or provider associated with your account so ownership can be checked.

Tokenstone does not sell account or provider data. Provider information is used for authentication and account linking, rather than advertising or training models.