How we keep what you give us
Privacy
What Shadows of the Corn keeps about you, why, who else sees it, how long it stays, and how to remove it. This page covers shadowsofthecorn.com and every game on it.
Last updated
The short version
- We keep what your account needs to work: your email, the names you choose, your password (scrambled so nobody can read it), and your progress in each game.
- We do not sell your data. There are no ads on the site, and no tracking or analytics tools.
- Other players see the name you choose. They never see your email.
- You can remove your account yourself, at any time, from your profile.
What we keep, and why
Your account
When you make an account we keep your email address, your username, the display name other players see, when you joined, and your password. The password is stored only as a scrypt hash, a one way scramble, never as the password itself. If you turn them on, we also keep your two-factor setup and your passkeys (only their public half).
We use your email to sign you in, to send a link when you forget your password, and to tell you when your password changes or your account is removed. We do not send newsletters or marketing. If you ask to join, we write to you about that request, as that section says.
Your progress
Each game's save: your cards, candy and Fame, trophies, your side, the log of what you earned and spent, and your places on the boards. It is kept on our server so you can carry on from any device. Last Call, the nightly mystery, keeps each night you play there too (the places you searched, your pins, glasses, hints and time), and its own notice says what it keeps.
Friends, chat and voice
Your friends list, and who you blocked or muted. Messages between friends are deleted 7 days after they are sent, and group and game lobby chat 24 hours after. Our staff can change those times, between 1 and 30 days for messages and between 1 and 72 hours for group chat; group chat is never kept longer than 72 hours. Saved chat is encrypted on our server. Talk at a private poker table in the casino is never saved. Voice chat is never recorded. If you report a player, our staff read the report.
How often you play
The days you sign in and the minutes you play each game, kept for 400 days, so we can see which games people enjoy. Only our staff see it.
Messages you send us
What you write on Contact Us: your email, the name and username you give, the topic and your message. We send one email to say it arrived. It is deleted 180 days after we close it.
A ticket you file on the Help Desk on your profile: its topic, what you write, our answers, and which account filed it. Only you and our staff see it, and we answer on your profile, not by email. It is deleted 180 days after the ticket closes.
Things you choose to link
- A crypto wallet. Its public address, which you prove is yours by signing a message (never a payment), and what OpenSea lists it as holding, so your Crypto Unicorns can come into the game. A wallet's address is public on its blockchain already.
- A Phoenix fighter. Your Phoenix id (which is your Discord id) and your fighter's card, to show it in your trophy case. You can unlink it on your profile.
- Reminders from The Gate. If you turn them on, the push address your browser gives us, so we can send them. Turning them off deletes it.
Your internet address
Our server uses your internet (IP) address, in memory only, to slow down floods of requests and repeated failed sign-ins. It does not write your address to its files or its logs. A request to join keeps a scrambled key made from it instead (see the next section), which cannot be turned back into the address.
Asking to join
While the alpha is small, a new player asks to join on Request access, and our owner decides. We keep what you put in the form: your email, the name you want in the game, why you want to join, how you heard of us, any social media names you give (X, Facebook, Discord or Threads), that you said you are 13 or older, and whether you want to hear from us if we cannot let you in yet. We also keep when you asked, the tag of the announcement or the friend's link that brought you, how many seconds the form took, and a scrambled key made from your internet address (never the address itself), so we can spot many requests from one connection.
We use it only to decide on your request. Only our owner sees it. If a friend's Bring a Friend link brought you, our owner sees that friend's game name; the page only tells you that a friend invited you.
We send you four kinds of email about it at most, and none of them repeats anything you typed: one to confirm the address is yours, one if the address already has an account, one with your access code if we let you in, and one if we cannot yet. The code works once, only with the email it was sent to, for 14 days. Every one of these emails after the first has a link to delete your request, and while you are on the waitlist they also have a link to leave it (your mail app's unsubscribe button does the same).
The form checks that you are a person with Cloudflare Turnstile (see who else sees it).
How long a request is kept
- Not confirmed within 48 hours: deleted.
- Not let in, and not on the waitlist: deleted 180 days after we decide.
- On the waitlist: kept until you leave it or we invite you.
- Let in: deleted 180 days after we decide, or sooner, with your account, if you remove it.
- Marked as spam: deleted at once. A one way scramble of the email address is kept for a year, so the same address cannot ask again.
- Delete my request, in any of these emails, deletes it at once.
What stays on your device
Cookies. Two cookies, sotc_sid and sotc_rt, keep you signed in for
up to 14 days. The page's own scripts cannot read them, and your browser sends them only to our sign-in
addresses. A third, sotc_phx_link, lasts ten minutes while you link a Phoenix fighter. Our staff have
one more for the admin pages. There are no advertising or tracking cookies.
Your browser's storage. The games keep a copy of your progress and your settings (such as sound) in your browser, so they load quickly and keep working when the connection drops. Clearing this site's data in your browser removes that copy.
How long we keep it
| What | How long |
|---|---|
| Your account and progress | Until you remove your account |
| Messages between friends | 7 days (our staff may set 1 to 30) |
| Group and game lobby chat | 24 hours (our staff may set 1 to 72) |
| Private poker table talk | Never saved |
| Days and minutes played | 400 days |
| Contact Us messages | 180 days after we close them |
| Help Desk tickets | 180 days after the ticket closes |
| A request to join, not confirmed | 48 hours |
| A request to join, decided | 180 days after we decide (on the waitlist: until you leave it or we invite you) |
| An email address marked as spam on Request access | Only a one way scramble of it, for 1 year |
| Sign-in cookies | 14 days |
| Your internet address | In memory only, never written down (a request to join keeps only a scrambled key made from it) |
Removing your account
Open your profile (every game's account button has Open my profile), go to Remove my account at the bottom, type REMOVE MY ACCOUNT and enter your password, and your two-factor code if it is on. It happens at once, it cannot be undone, and every device is signed out. We send one email to say it was done.
What goes
Your account (email, names, password, two-factor and passkeys), your saves, your candy, Fame and cards, your friends and saved chat, your play counts, your linked wallets and Phoenix fighter, your Gate reminders, your Help Desk tickets, and your place in every game's books, the request to join that let you in among them. Your email address is free to use again.
What stays, with no name on it
- A record you share with other players, such as a match, a race or a place on a board that has closed, stays under "A removed player", so their history still adds up.
- Your points in the season that is running stay with your side, under no name.
- A deck code you shared keeps working, with no maker.
- A crypto wallet address you linked stays marked as used, tied to no account, because one wallet can only ever feed one account.
- An alpha code you used stays used, with your email and name blanked.
- A receipt for something bought with real money stays, with your account taken out.
- Our staff's audit logs keep an account number, or its first 8 characters, which names nobody once the account is gone.
Messages you sent on Contact Us are not tied to your account. They follow their own rule and are deleted 180 days after we close them.
Your choices
- Change your password, turn on two-factor, add a passkey, and unlink a Phoenix fighter, on your profile.
- Turn reminders from The Gate off in The Gate, at any time.
- Ask what we hold about you, ask us to correct it, or ask anything else about your data, on Contact Us (pick "Privacy or my data"). We answer by email.
- Remove your account at any time, as above.
How we keep it safe
- Passwords are kept only as scrypt hashes, and a new password is checked against passwords known to have leaked.
- The accounts file and saved chat are encrypted on our server (AES-256-GCM).
- Everything travels over HTTPS, and the sign-in cookies cannot be read by the page's scripts.
- Every player can turn on two-factor or use a passkey, and every staff account must use two-factor.
Children
Shadows of the Corn is not made for children under 13, and we do not knowingly keep an account for a child under 13. Request access asks you to confirm you are 13 or older. If you think a child under 13 has an account, tell us on Contact Us and we will remove it.
Changes to this page
When this page changes, the date at the top changes with it.
Contact
Shadows of the Corn (SOTC) runs shadowsofthecorn.com. Write to us on Contact Us; a person reads every message and answers by email. With an account you can also file a ticket on the Help Desk on your profile, and we answer there.