Privacy notice
Draft of 4 November 2026
This notice explains what we keep when you sign up for the Instant Dungeon beta on this website, why, for how long, and how to delete it. We keep as little as we can: no cookies, no trackers, no advertising.
Who we are
Instant Dungeon One-Shot (Instant Dungeon) is made by 999 Online Inc. ("we", "us"), [to be confirmed: the company's registered address]. Write to us at support@instantdungeononeshot.com about anything in this notice.
This notice covers the website at instantdungeononeshot.com and signing up for the beta on it. The iPhone app and joining a game table on the web [to be confirmed: whether they get their own notice or are added to this one].
What we keep when you sign up
You sign up with Apple, Google or Facebook. Your sign-up is one record that holds:
- which of them you signed up with, and the account id it gives us for you (an id for our app, not your password);
- your email address, if the provider shares one, and whether the provider told us it is verified (with Apple, it may be a private relay address that forwards to you);
- whether you signed up as a GM ("I run games") or a player ("I play");
- when you confirmed you are 13 or older;
- if you are a GM, your referral code; and if you signed up with Google or Facebook, a claim code you type once in the app to link your sign-up to your app account;
- if you signed up with a GM's referral code, a link to that GM's sign-up (not their details);
- the app account your sign-up is linked to, once you link it;
- the invite wave you are in, once our team assigns one (a number we set when we plan invitations);
- when you signed up, and when beta emails were turned off, if they were (by you, or because you turned off Apple's email forwarding to us).
If you signed up twice (with Apple and with Google, say), our team may merge the two: the months your second sign-up earned, the people it referred and its link to the app move to the sign-up that is kept, and the other one is deleted.
Your free months
We keep a ledger of free months for each sign-up: your launch month and, if you are a GM, a line for each person who signed up with your code, saying whether it is waiting, counted or voided, with its dates and, if one of us voided it, a note saying why. See the referral terms.
Signing in
- When you pick a provider, your browser tab makes a random sign-in value and keeps it in its sessionStorage. It ties the sign-in to the tab that started it, so a sign-in someone else started can't finish in your browser. It reaches our server in the address of the request that starts the sign-in, and again when the welcome page finishes it. Our server stores only a scrambled (hashed) copy of it, first with the sign-in record and then with the hand-off below, and none once the hand-off is used or deleted. The address of that start request, with the value in it, may also be in our server's logs for as long as they are kept; the value is no use to anyone once the sign-in is over.
- While you are away at Apple, Google or Facebook, a sign-in record: a scrambled (hashed) copy of the check value we send with you to the provider, a hashed copy of your tab's sign-in value, the role and referral code you picked, whether you ticked "I'm 13 or older", a one-time value the provider sends back, and for Google and Facebook a one-time verifier. It can be used for 10 minutes, once, and is deleted when you come back; one left unused is deleted by a daily clean-up.
- When you come back, a one-time hand-off for the welcome page, kept as a hash, with the hash of your tab's sign-in value moved over from the sign-in record. It works only together with that value, from the tab that started the sign-in. It can be used for 5 minutes, once, and any try uses it up, whether the value matched or not; one left unused is deleted by a daily clean-up.
- The welcome page's session: kept by us only as a hash, so we can't read it back. It lasts 30 days, or until you sign out (which ends it on our side too) or delete your sign-up.
- If you signed up with Apple, the refresh token Apple gives us, sealed with encryption (AES-GCM) so the database alone can't read it. We use it only to tell Apple to end your sign-in with us when you delete your sign-up, and it goes with your sign-up.
- When Apple tells our server about a change to your Apple sign-in, we act on it: if you stop using Sign in with Apple with us, we delete the sealed token and end your welcome-page sessions; if you turn off Apple's email forwarding to us, we turn beta emails off; if your Apple account is deleted, we delete your sign-up, as Delete my sign-up would. We keep each notification's id and type for 30 days, so one Apple sends again isn't applied twice.
Counting sign-ups
We count how the beta is doing with events we write on our own server: a sign-up started, a sign-up finished, a referral counted and a sign-up linked to the app. Every event records its name and time, a role, a kind of device and a version. On this website the device is the kind your browser's user agent shows (iPhone, Android or a computer) and the version is "web"; the link event and a GM's referral event happen in the app, so they record the app's platform and version instead. Only the sign-up events record the provider and whether a referral code was used; the finished one also records your sign-up's id and whether you were signing in again. A referral event records the GM's sign-up id, the referred sign-up's id and role, and whether the GM was already at the 12-month cap. The link event records the sign-up's id, the app account's id and how it was linked (your Apple account or a claim code). Events never hold your email or the provider's account id. No analytics company sees them.
What each provider shares with us
| Provider | What it sends us | What we keep |
|---|---|---|
| Apple | An account id and an email address, which is a private relay address if you choose to hide your email. The first time, Apple may also send your name. | The account id, the email address and a sealed refresh token (see Signing in). Not your name. |
| An account id, your email address and whether Google has verified it. We don't ask Google for your name. | The account id, the email address and whether it is verified. | |
| Facebook, when it is offered | Your Facebook account id for our app and, if your Facebook account has one and you agree to share it, your email address. | The account id and the email address, if shared. |
We never see or keep your password for any of them. Their own privacy policies cover what they do when you sign in with them.
Why we keep it
- to keep your place in the beta and send your invite when your wave opens;
- to send service emails about your sign-up: your code, your invite and your free month;
- to count the free months you have earned, and to stop codes being misused;
- to link your sign-up to your app account, so the months follow you into the app;
- to know, in counts, how many people sign up and how.
The legal bases we rely on for each [to be confirmed: legal bases, per purpose, for the places the beta is offered].
Emails
During the beta we only send service emails: your code, your invite and your free month. No newsletters and no marketing. You can turn beta emails off, or back on, on the welcome page, or with the one-click link in every beta email: it carries a signed token that says which sign-up it is for, so nothing extra is stored to make it work. We don't sell, rent or share your email address with anyone for their own use.
Cookies and storage in your browser
This website sets no cookies and runs no analytics, advertising or social scripts; every file it loads comes from this website. Two things sit in your browser's sessionStorage, for one tab only, and both are strictly necessary for signing in, so no consent is asked for. Your tab's sign-in value, a random value that ties a sign-in to the tab that started it, goes when the sign-in finishes, whether it worked or not, or when you close the tab. Our server stores only its hash, with the sign-in record and the hand-off; the address of the request that starts a sign-in carries the value, so it may also be in our server's logs, as described under Signing in. While you are signed in on the welcome page, its session token lets the page show your sign-up; signing out or closing the tab removes it. If your browser blocks sessionStorage, you can't sign in, and the sign-up page says so before you pick a provider; nothing is kept anywhere else instead. A referral code travels only in the link you were given; we don't store it in your browser. See cookies and storage.
Who handles it for us
- Cloudflare, Inc. runs this website and our server, and stores the sign-up records in its database service (Cloudflare D1). To deliver pages and to limit sign-up attempts, Cloudflare handles your IP address. Cloudflare also keeps our server's logs. They record sign-up ids and, once a sign-up is linked, app account ids, and the address of each request to our server (the one that starts a sign-in carries your tab's sign-in value); when our team looks a sign-up up by its email address, that search, with the address, is in those logs too. [to be confirmed: how long Cloudflare's request logs and our server's logs keep IP addresses and these ids, and that nothing else stores them]
- Cloudflare Email Service sends the beta's emails on our test site. The service that sends them on the live site: [to be confirmed: the email provider for the live site].
- Apple, Google and Meta (Facebook), when you choose to sign in with them.
Where the records are stored, and the safeguards for any transfer abroad: [to be confirmed: the database's location and transfer safeguards].
How long we keep it
| What | How long |
|---|---|
| Your sign-up and its free-month ledger | Until you delete it, Apple tells us your Apple account was deleted, or our team merges it into your other sign-up. After the beta ends: [to be confirmed: retention after the beta ends] |
| The sign-in record while you are at the provider | Usable for 10 minutes and used once; any left unused are deleted by a daily clean-up |
| The welcome page's hand-off | Usable for 5 minutes and used once; any left unused are deleted by a daily clean-up |
| Your tab's sign-in value | Its hash: with the sign-in record and then the hand-off, as above, and none once the hand-off is used or deleted. The value: in your browser tab until the sign-in finishes or you close the tab, and in the start request's address in our server's logs for as long as they are kept (no use once the sign-in is over) |
| The welcome page's session | 30 days, or until you sign out or delete your sign-up |
| Apple's sealed refresh token (Apple sign-ups) | Until you delete your sign-up (it is used then to end the sign-in at Apple, and deleted), or until you stop using Sign in with Apple with us |
| The ids and types of Apple's notifications | 30 days |
| Sign-up events (no email) | [to be confirmed: how long events are kept] |
| Our server's logs (sign-up and app account ids, any email address our team searched for, and the address of each sign-in's start request, which carries its sign-in value) | [to be confirmed: how long the server's logs are kept] |
Deleting your sign-up
Sign in on the welcome page and choose Delete my sign-up, or follow Delete my data. Your sign-up, its free-month ledger, its sessions and its hand-offs are deleted straight away; for an Apple sign-up we first tell Apple to end the sign-in, then delete the sealed token. If you signed up with a GM's code, the month your sign-up earned them is taken back, whether it had counted yet or not: their ledger keeps a voided line, with no link back to you. Events keep the id your sign-up had and, if it was linked to the app, the app account's id; our server's logs keep the ids they recorded, the addresses of the requests that started your sign-ins (with their sign-in values, which are no use once a sign-in is over), and any search our team made for your email address, for as long as the logs are kept. Deleting your sign-up doesn't delete your app account: do that in the app.
Your rights
You can ask us for a copy of what we keep about you, to correct it, or to delete it, by writing to support@instantdungeononeshot.com from the address you signed up with. The rights that apply where you live, and the authority you can complain to: [to be confirmed: the rights and supervisory authorities that apply].
If you are 13 to 17
You can sign up if you are 13 or older. We keep the same few things about you as about anyone else, we only send you service emails, and nothing about you is public. If you are under 13, please don't sign up; if we learn that someone under 13 has signed up, we delete the sign-up. A parent or guardian can ask us to delete a child's sign-up by writing to support@instantdungeononeshot.com. Where the law sets an older age for agreeing to this on your own: [to be confirmed: whether any country the beta is offered in needs a parent's consent from 13 to 15 or 16].
Changes to this notice
If we change what we keep or why, we will update this page and its date before the change takes effect, and email you if it matters to your sign-up.