Privacy

Cards, Snakes & Ladders

Last updated: 29 October 2026

What stays on your device

The game keeps a few things in your browser's local storage so that it remembers you next time. They never leave your device unless you play online, and then only your name does.

• Settings: the mode, board size, bots and their level for each kind of game, sound on or off, and whether you have finished or skipped the tutorial.
• The game you are playing, so that a reload carries on with it.
• The name you chose for online play.
• For this browser tab only (session storage): a random player number and the online room you are in, so that a reload takes you back to your table.

The game sets no cookies. To remove all of this, clear this site's data in your browser's settings.

What happens when you play online

Solo Play and Pass & Play work entirely on your device. Online play (Quick Match, creating a room or joining one) only starts when you choose it. Then:

• Other players. Your browser connects directly to the browser of the player who holds the room (WebRTC), and through it the others at the table get your name, a random player number, your colour and your moves. A direct connection shows your IP address to the player you connect to.
• PeerJS's public server (0.peerjs.com) puts the players of a room in touch. It sees your IP address and a random ID for the room.
• Google's and Cloudflare's STUN servers tell your browser its public address so that a direct connection can be made. They see your IP address.
• Public relay servers. When two browsers cannot reach each other directly (some mobile and office networks), the table's messages go through public MQTT test servers instead: broker.emqx.io (EMQ) and test.mosquitto.org (Eclipse Mosquitto). They see your IP address and the table's messages (names and moves). These servers are open to anyone, so treat what goes through them as public.

The game has no chat. Nothing from a game is stored on any server: outside Discord there is no server of ours, and in Discord our relay server keeps nothing (see below). The services above work under their own privacy terms.

Playing in Discord

In Discord the game runs as an Activity in a voice channel, and everyone who starts it there plays at one table.

• What Discord gives the game. The ID of the activity's session in your channel (it picks the table), and whether you play on a computer or a phone. When you allow it (Discord asks you once), also your Discord user ID, username, display name and avatar (the identify permission: no email, no friends list, no servers, no messages), and the right to set your game status in Discord (the rpc.activities.write permission, below).
• Your status in Discord. While you play, the game tells Discord what to show under your name: the mode and board ("Champion · 100 cells"), whether you are waiting, playing or watching, how many players are at your table and since when the game is on. Discord shows it to the people who can see your activity, under your Discord settings. It says nothing about your moves or the other players' names.
• Invite Friends opens Discord's own invite window: the game does not see whom you invite.
• What the others at your table see. Your display name, your avatar and your moves. Your user ID goes along (it is part of your avatar's address), and the player who holds the table uses it only to give you your own seat back if your connection drops.
• Our relay server. In Discord the table's messages go through a small server of ours on Cloudflare Workers (csl-relay.csl-relay.workers.dev) instead of direct connections or the public servers above. It passes each message on to the other players and keeps nothing: no names, IDs, moves or logs of its own. A table on it is gone once the last player leaves. Cloudflare sees your IP address and may keep its own request records under its privacy policy.
• Signing in. To read your name, your device sends Discord's one-time code to the relay server, which trades it with Discord for an access token and hands the token straight back. The server does not keep the token or use it for anything else.
• Avatars are loaded from Discord's own image server (cdn.discordapp.com) through Discord.
• If you say no to Discord's question, you play as "Player 2" (or another number) and the game gets nothing about your account.

How long we keep it: we don't. Your name, ID and avatar live only in the browsers of the players at your table while you play. Links in the game (this page, the terms) open in your browser, outside Discord. Discord itself works under Discord's privacy policy.

Names

Online, you get a random name such as "Paper Fox" unless you type your own. Please don't use your real name. Names with rude words are replaced with a random one, both on your device and when they reach the player who holds the room.

The website you play on

The website that hosts the game may collect information of its own, such as visits, under its own privacy policy. This page only covers the game itself.

Children

The game asks for no personal information. The only thing you type is an optional name for online play. In Discord you need to be old enough for Discord itself (13 or older, more in some countries).

Changes and contact

If the game starts collecting anything else (for example when it gets accounts or ads), this page will say so first. Questions: andtargd@gmail.com.