/privacy

privacy policy

Last updated: 2026-05-09

tl;dr

· Account: GitHub user id, name, email, avatar URL — provided by GitHub OAuth when you sign in.
· CLI tokens: a name you choose, a hash of the token (SHA-256, original is shown to you once and not stored), the first 12 characters as a prefix, plus created/last-used timestamps.
· Creatures: name, stage, class, stats (STR/INT/DEX), hunger, prompt counters, birth/death/last-sync timestamps. No content of your prompts is stored.
· World map: coordinates of tiles you own and acquisition timestamps.
· Battles: opponent ids, skills used, damage rolls, outcomes, timestamps. Used for battle log + leaderboard.
· Sessions: standard NextAuth session cookies + OAuth tokens issued by GitHub.

· The text of your prompts.
· The contents, paths, or names of files in your projects.
· Tool arguments (e.g. what you typed into Bash, what you read with Read).
· Any data from Claude Code beyond a tool name (e.g. Bash, Edit) and a timestamp, sent only when you've opted into multiplayer.
· Analytics, ad, or third-party tracking cookies.

· Local state (solo + multiplayer): ~/.codetama/state.json on your machine. Plain JSON, you control it.
· Server data (multiplayer only): Postgres database hosted by Neon (EU region). Web served by Vercel.

· Access: everything we have about you is visible on /profile, your public profile, the world map, and the leaderboard.
· Deletion: click "delete account" on /profile. Removes user, all creatures, tiles, battles, tokens, sessions, and OAuth records from our database. Cannot be undone.
· Export: your local state.json is portable. For server data, request a dump via the contact below.
· Object / restrict: stop multiplayer anytime by running codetama --local or revoking your CLI token.

Questions or data requests: hello@codetama.com