Idleholt Privacy Policy
Last updated: October 9, 2026
This is a draft. Text marked [DECISION NEEDED] has not been decided yet and must be filled in before this policy is published.
Who runs Idleholt
Idleholt is a browser game at idleholt.com. It is run by Idleholt [DECISION NEEDED 1: postal address, if required] ("we", "us"). You can reach us at login@idleholt.com.
In short
- You need an account to play. We keep your email address, your chosen name, and your game progress.
- Other signed-in players can see your name, your skill levels on the hiscores, and what your character is doing in Holtgrove.
- Chat is passed on to the players who are online and is not saved.
- We use two sign-in cookies and no advertising or analytics cookies. The game loads no third-party scripts, fonts, or trackers.
- We do not sell your data and we do not show ads.
- Today Idleholt has no payments, no subscriptions, no ads, and no third-party analytics. We collect no payment information.
What we collect and why
When you sign in with an email link
You give us your email address. We store it with a one-time sign-in link that works for 15 minutes, and we ask our email provider, Resend, to send you that link. The email contains only the link and a short note. We keep the address on the link record even if you never use the link (see how long we keep data).
When you sign in with Google
If Google sign-in is offered, we ask Google for the openid,
email, and profile permissions. From what Google returns
we keep only your email address and Google's account identifier for you. We check
that Google has verified the address. We read your Google name but do not store
it, and we do not read your profile picture or anything else. We do not keep
Google access or refresh tokens and cannot act on your Google account. If your
verified Google address matches an existing Idleholt account, the two are joined
into one account.
Your account
- Email address: to sign you in and to tell accounts apart.
- Google account identifier, if you used Google: to recognise you next time.
- Display name: the name you pick (3 to 12 characters). Other players see it. It must be unique and cannot be changed after you pick it.
- A random account ID, and the times your account was created and your browser save was brought online.
Your game progress
The game saves your progress to our servers about once a minute and when you leave the page: your skill experience and levels, inventory, bank, coins, axes, where your character stands, and what it is doing. We record when each save arrives.
Anti-cheat records
Each save is checked against how much experience the time since the last save could have earned. If a save claims more, the extra is not accepted, and we keep a record of the skill, the experience claimed and accepted, the time between saves, and when it happened.
Sign-in limits and IP addresses
To stop abuse of sign-in emails we count requests per email address and per IP address over 15-minute windows. We store these counters under a one-way hash (SHA-256) of the address, not the address itself, and delete them after the window ends. We do not otherwise store IP addresses in our database.
Sessions
When you sign in we create a session that lasts 30 days. We store only a hash of the session key, which is kept in a cookie in your browser.
Information our hosting provider handles
Idleholt runs on Cloudflare. Like any web host, Cloudflare receives your IP address and standard request information (such as browser type) when you visit. [DECISION NEEDED 16: confirm which Cloudflare logs or analytics are switched on for idleholt.com, and for how long they are kept]
What other players can see
- Hiscores: signed-in players can see the top 50 players for each skill, with each player's display name, experience, and level. You appear once you have a name and some experience.
- In Holtgrove: players online at the same time see your display name, your character's position, whether it is idle, walking, or chopping, and which axe it holds. Their game also receives your random account ID, which it uses to tell players apart.
- Chat and emotes: what you say is sent with your name to everyone online. We do not store chat. Players who join later do not see earlier messages.
Your email address is never shown to other players.
Cookies and browser storage
| Name | Type | Purpose | Lasts |
|---|---|---|---|
holt_session |
Cookie (HttpOnly, Secure, SameSite=Lax) | Keeps you signed in. | 30 days, or until you sign out |
holt_oauth |
Cookie (HttpOnly, Secure, SameSite=Lax), only on the Google sign-in path | Protects Google sign-in from forgery while it is in progress. | 10 minutes; removed when sign-in finishes |
idleholt-save |
Local storage | A copy of your progress, so the game can save every few seconds. | Until you clear it |
idleholt-save-owner |
Local storage | Your account ID, so the game knows whose copy it is. | Until you clear it |
Signing out does not clear local storage. On a shared computer, clear this site's data in your browser settings after you sign out. The game has no advertising or analytics cookies, and it does not install a service worker.
Who else handles your data
We use these providers to run the game. They process data for us:
- Cloudflare hosts the website, runs the game servers, and stores the database (Cloudflare Pages, Workers, D1, and Durable Objects).
- Resend sends sign-in emails. It receives your email address and the sign-in link.
- Google handles Google sign-in if you choose it. Google's own privacy policy covers what happens on Google's pages.
We do not sell or rent your data, and we do not share it for advertising. [DECISION NEEDED 21: where data is stored and the statement on international transfers]
Emails
Today the game only sends sign-in links, when you ask for one. [DECISION NEEDED 12: whether you will ever send other email, such as news or marketing, and how players opt in or out]
Payments
Today: Idleholt is free to play. It has no payments, no subscriptions, no ads, and no third-party analytics, and we collect no payment information. The coins in the game cannot be bought.
Planned: we plan to offer optional premium features in the future. They are not available now. Before any paid feature is offered, we will update this policy to explain what payment data is collected, who handles it, and how long it is kept.
How long we keep data
| Data | How long |
|---|---|
| Sign-in links (with your email address) | Usable for 15 minutes. Removed by a routine clean-up some time after they have been expired for 24 hours. |
| Sessions | 30 days. Removed when you sign out, or by the clean-up after they expire. |
| Hashed sign-in counters | 15-minute windows. Removed by the clean-up after the window ends. |
| Account, game progress, hiscores, and anti-cheat records | Kept while your account exists. Nothing deletes them automatically. [DECISION NEEDED 13: retention period for accounts, saves, hiscores, and anti-cheat records, including inactive accounts] |
| Chat and positions in Holtgrove | Not stored. Passed on to the players online at the time. |
The clean-up runs from time to time when sign-in emails are requested, so expired records may stay a little longer than the times above.
Your choices
- Sign out at any time from the side panel. This ends the session on our side too.
- Reset save in the side panel replaces your progress, here and on our servers, with a fresh start, and takes you off the hiscores. It does not delete your account.
- Delete your account: the game has no delete button yet. [DECISION NEEDED 11: how players ask for account deletion, and how quickly it is done]
- Get a copy of your data: there is no export button. [DECISION NEEDED 14: how players ask for a copy of their data, or to correct it]
- Your display name and email address cannot be changed in the game.
[DECISION NEEDED 15: whether to describe legal bases and regional privacy rights (for example GDPR, UK GDPR, or California law), and how to contact you about them]
Security
Sign-in links and session keys are long random values, and we store only their hashes. Sign-in cookies cannot be read by page scripts and are only sent over HTTPS. Requests from other websites to our game's API are refused. No system is perfectly secure, so please tell us if you find a problem.
Children
[DECISION NEEDED 4: minimum age to play, and what you do if you learn a younger child has an account] The game does not ask for your age.
Changes to this policy
If our practices change, we will update this page and the date at the top. [DECISION NEEDED 20: how players are told about important changes to this policy]
Contact
Questions about this policy: login@idleholt.com.