Privacy.

The short version

• No ads, no analytics, and no selling or sharing your data.
• Most of the site works without an account.
• If you make an account, you can delete it yourself at any time.

If you make an account

Username

Public. Shown on your posts, profile, and leaderboards.

Email

Optional. Used only to verify your address and reset your password. Never shown or shared.

Password

Stored only as an Argon2 hash, so nobody (including me) can read it.

Profile

Display name, bio, avatar, and banner, if you add them. Public.

What you post and play

Forum

Posts, comments, likes, and who you follow. Public.

Scores

Typing race, Minesweeper, and GameGuessr results for logged-in players. Public on the leaderboards.

Canvas

Each character you place shows your username.

Game saves

Terminally Idle cloud saves are encrypted before they're stored.

Guests

Playing as a guest keeps your progress in your browser session only. Guest results aren't ranked.

Cookies

sessionid

Keeps you logged in, and lets guests keep their seat in a game. Expires after 2 weeks without a visit.

csrftoken

Security: stops other sites from submitting forms as you.

Cloudflare

May set its own security cookie to tell people from bots.

No tracking or advertising cookies, so there's no cookie banner.

Security records

Failed log-ins

The IP address, username tried, and browser are kept to block password guessing. Deleted after 30 days.

Headers checker

Keeps a scrambled (hashed) form of your IP address to enforce the daily limit. It can't be turned back into the address. Deleted after 7 days.

Status page

Shows counts only, like "3 lockouts today". Nothing about who.

The tools

DNS checker

Lookups go from your browser straight to Cloudflare's public DNS. Nodebug's server never sees which domain you check.

Photo scrubber

Photos never leave your device.

Privacy report

Shows what this server can see about your browser. Nothing is saved.

FileVault

Encrypts in your browser. The server never sees your files or your password.

Services that handle data

Cloudflare

Every request passes through Cloudflare for security and speed, so it sees your IP address.

Hetzner

Hosts the server and database, in the EU.

Resend

Sends verification and password-reset emails to your address.

Google Fonts

Your browser loads the site's fonts from Google, which sees your IP address.

Deleting your data

Go to your profile, choose Edit profile, then Delete account at the bottom. That immediately and permanently removes your account, email, profile and images, follows, scores, and game saves.

Your forum posts and comments stay up so conversations others joined don't break, but they're reassigned to a generic "deleted-user" and no longer point back to you. Characters you placed on the canvas stay, without your name.

For anything else, email [email protected].