Encrypted connection. Everything between your browser and the service travels over HTTPS.
Passwords are never stored. We keep only a one-way scrambled form made with a slow, modern method (scrypt), so even we cannot read your password.
Sign-in cookie is hidden from page scripts (HttpOnly) and is only sent for this site. The server stores only a scrambled form of it.
Access checks happen on our server. Your browser is never trusted to decide what you may see: other players never receive hidden tokens, fogged areas, other scenes or the DM's private notes, and only the owner of a token can move it.
Limits against abuse. Sign-ups and logins are rate-limited, uploads are checked to be real pictures, and the connection for live play checks where it comes from.
Invite-only during testing. New accounts need an invite code.
Administration is separate. Admin screens are not shown to other accounts and are not reachable from the public address.
The server is isolated. It runs on its own network segment that cannot reach the operator's other devices, and it is updated automatically with security patches.
Backups.
What we cannot promise
No service is perfectly secure. Choose a strong password you do not use anywhere else.
Games, including private whispers, are stored on our server so that games can continue. The people who run the service can technically read them. See the Privacy Policy.
Voice chat connects players directly, so other players in a call can see your network address.
Reporting a problem
If you find a security problem, please email [email protected] with what you found and how to repeat it. Please do not test on other people's accounts or games, do not access or change data that is not yours, and give us a reasonable time to fix it before telling others. We will reply within [3] working days, and we will not take action against people who follow these rules in good faith.