Privacy

placeholder runs Mochirix and decides how the data described here is used. Contact: placeholder, placeholder. placeholder

• You can play the whole free game without an account, a name or an email address.
• Signed out, your progress is kept in this browser and, where server saving is on, under an anonymous guest code. Signed in, it is saved to your account and follows you to any browser where you sign in.
• Accounts are for people 18 and over. An account needs only an email address, which is used to sign you in with a one-time code. There is no password.
• Sound, volume and motion settings always stay in each browser.
• There is no behavioural advertising, and no analytics is enabled.
• The site uses cookies for guest progress, account sessions and language preference, with no third-party cookies. The details are on the cookies page.

When server saving is available, guest progress and accounts can be saved across visits. When it is unavailable, no guest or session cookie is set, accounts are unavailable, and progress stays in your browser.

The game keeps these in your browser’s storage. They never leave your device on their own.

Progress and settings

Your tutorial step, which puzzles you have won or mastered, best scores, attempts, whether you asked for a solved formation, and your sound, volume and motion settings.

Server copy

The last copy of your guest or account progress, so the game can show it straight away, and whether a reset is still waiting to reach the server.

Sign-in signal

A time stamp that tells your other open tabs you signed in or out, so they update.

Shop filters

The shop filters you chose, for this tab only.

Gift link

While you open a gift link, its claim code, for this tab only.

Playtest log

Only during a moderated playtest that a moderator starts at /playtest: a participant code (never a name), your browser’s description of itself (user agent), screen size, motion setting and the game events of that session. The moderator downloads it; nothing is sent.

If storage is blocked, for example in some private windows, the game still plays; what would be stored then lasts only until you close the page.

Signed out, the first time the server records something for your browser (a battle, a saved team or a line-up link), it creates a guest and sets the guest cookie. It then keeps:

Guest

A one-way fingerprint (SHA-256 hash) of your guest code, never the code itself; total XP; when the guest was created and last seen.

Battles

For each battle the server computed: the mode, puzzle and revision, rules and roster version, ground, both line-ups, the result, which goals were met, the score, whether help was used, and the UTC day.

Rewards

Each XP and creature mastery grant, creature mastery totals, and the badges and illustrations earned.

Puzzles and daily flight

Won, mastered and assisted marks, attempts and best scores per puzzle and per daily date.

Saved teams

Up to three line-ups, each with an optional label of up to 40 characters that you type.

Line-up links

A snapshot of a formation, its opponent and the result. Anyone you give the link to can open it; it carries no name.

None of these records holds a name, an email address, a payment detail or an IP address.

To sign in or create an account, you give an email address and use a six-digit code. No email is sent. It works once, for 10 minutes, and allows 5 tries. When you sign in, this browser’s guest progress moves into the account and the guest, with its cookie, is deleted. The account then keeps the same progress records as a guest, plus:

Account

Your email address, when it was verified, the account’s language, when you confirmed that you are 18 or over, and when the account was created and changed.

Sign-in identity

The sign-in provider and its own ID for you. Identity tokens never leave the server and are not stored.

Sessions

A one-way fingerprint of each session token, when it started, was last used and expires, and why it ended. A session ends after 30 days without use and after 90 days in any case.

Sign-in codes

A keyed fingerprint (HMAC) of each code, with its expiry and the tries used, filed under a keyed fingerprint of the address.

Sign-in attempts

Each code request and check, with keyed fingerprints of the address and of the IP address, for the rate limits. Deleted at the first code request or check after it is a day old.

Account history

What happened and when: created, 18+ confirmation given, signed in or out, guest progress moved in (with its XP and mastery numbers, and the names and line-ups of guest teams that did not fit), data downloaded, deleted. Never an email address, code or token.

Island arrangement

The arrangement of your owned items on your island’s pedestals, frames and shelf is saved to your account on the server. Published display snapshots are also stored there. Your gallery stays private until you publish a visit link.

placeholder

No payment is taken. An order keeps a reference to the account, the quote you reviewed, each line, the payment and delivery states, refunds, the goods granted and their source, and the history of changes. A gift keeps only a fingerprint of its claim code.

• No card details are requested or stored by Mochirix. The purchase history never holds a card, a token or an email address.
• Your gallery is private until you publish a visit link. A visit shows your chosen display only, never your spending, email address, legal name or order references.
• A gift’s payer never sees the recipient’s other goods.
• Personalized orders, when offered, store the name (up to 24 characters), dedication (up to 200 characters), motif and palette you choose, privately and apart from the public catalogue.

• No behavioural advertising, and no advertising or tracking cookies.
• No analytics script, pixel or identifier is used.
• The public tutorial runs without an account or any analytics identifier.
• Fonts and game files are served from this site; your browser does not contact a font or asset provider to play.
• placeholder

In your browser

Until you reset your progress or clear this site’s data. Shop filters and gift codes, until the tab closes.

Guest cookie

400 days from when it was set, or until you reset your progress or sign in.

Session cookie

30 days from its last renewal, and never past 90 days from sign-in; signing out ends it at once.

Language cookie

One year from the last sign-in; signing out leaves it in place.

Guest records

Deleted with the guest: when you reset progress or sign in. placeholder

Sign-in attempts

One day, then deleted at the next code request or check.

Accounts

Until you delete the account. placeholder

Orders and payments

placeholder

Download your data. Signed in, the account page offers a JSON file of everything stored for the account: sign-ins, progress and its history.

Delete your account. The account page deletes the account: its progress, XP, mastery, teams, line-up links, sign-in identities and codes are erased, and its sessions are ended, so you are signed out on every device; an ended session keeps only fingerprints of its tokens, its times and why it ended. The account’s history stays, without your email address, cut down to which events happened and when (each with a request reference), the sign-in method, and counts: how many puzzle records, battles, unlocks, daily records, teams and line-up links a guest merge moved, and what the deletion removed (whether there was progress, and how many sign-in identities and sessions). The 18+ confirmation, the XP and mastery numbers, and the names and line-ups of guest teams are removed from it. Records the law requires to be kept, such as receipts, stay without your email address.

Reset progress. Signed out, the Reset progress control on the home page erases this browser’s progress, deletes the guest and everything it owns on the server, and removes the guest cookie. Settings stay.

Clear site data. Clearing this site’s data in your browser removes everything kept on your device and all site cookies; an account’s saved progress stays in the account.

Ask us. Write to placeholder about access, correction, deletion or any other request about your data.

placeholder

Account audience: people 18 and over.