Privacy Policy

Rick & Morty Heist lives at heistotron.blackcatmatrix.com. I am John Rooney, and I run it on my own as a personal hobby project. There is no company behind it and no team.

If you have a question about anything on this page, or you want your data deleted, email me at [email protected]. That is the entire support department.

Account info

• Your email address.
• Your display name, which the people you play with can see in the lobby and in game.
• If you signed up with an email and password: a password that is hashed and managed by Supabase, the service that handles sign-in. The game itself never sees or stores your raw password.
• If you signed in with Google or Discord instead: that provider hands back an account id, a name, and usually an email address. There is no password on those accounts, because the provider does the password part.

Gameplay data

• Per game: things like which characters were played and whether each was played as Normal or Pro, whether the game was won, lost, or abandoned, how long it ran, how many turns it took, how many undos were used, which kind of map layout it was on, the loot and tools collected, safes cracked, alarms triggered, stealth lost, guard hits, dice roll counts, and which event cards came up.
• Rooms you play in: when someone sets up a game room, the database keeps the name the host typed for it, stored exactly as typed, along with its join code, who hosted it, whether it was set to private, how many seats it allows, and whether it is waiting, in progress, or finished. When you join a room, a row is added recording that you were in it, which seat you took, and when you joined.
• Your profile: display name, chosen avatar character, games played, and games won.
• Saved map layouts: any map layout you save as a favorite.

Technical and connection data

• The game sits behind Cloudflare, which handles the network side of getting your browser to the server. Cloudflare therefore sees connection metadata, including your IP address.
• The server keeps ordinary local logs of what it did, so that crashes can be worked out afterwards. What lands in them about you is your account id and the ids of the rooms you joined, left, or were disconnected from. Your IP address is not written to those logs.

• Account info: so you can sign in, come back to the same profile, and so the people you play with can tell who is who.
• Gameplay data: so the game can actually run, so your profile and saved map layouts survive between sessions, and so I can see how the game is really being played (which characters win, which events keep showing up) and balance it.
• Technical and connection data: it is a by-product of putting a website on the internet. Cloudflare needs connection details to route your traffic, and logs are how I find out why something broke.

Three places, and that is the whole list.

• Supabase: the hosted service that handles sign-in and stores the database, meaning accounts, profiles, game rooms and who sat in them, game statistics, and saved map layouts.
• Cloudflare: sits in front of the game as the network layer, so it carries the connection between your browser and the server.
• Your sign-in provider, if you used one: signing in with Google or Discord is a conversation between you and them, so they know you did it.

Your data is never sold. There is no advertising anywhere in the game, no analytics, and no third-party tracking scripts of any kind. There is also nothing to pay for, so no card details or financial data of any sort exist here.

Accounts, profiles, game rooms and who sat in them, game statistics, and saved map layouts live in Supabase, which is a hosted third-party service.

The game server itself is my own personal computer. It is not a data centre. It sits in my home and is reachable from the internet through a Cloudflare Tunnel. While you are playing, your moves are being handled by that machine. You should know that before you decide what to put in a display name.

Live game state, meaning the board, the turn order, and everything else mid-game, is held in Redis on that same machine.

• Account info, profile, game rooms, game statistics, saved map layouts: kept until you ask me to delete them.
• Live game state in Redis: expires automatically 24 hours after the last move in that game. The clock restarts every time somebody plays, so a game you keep coming back to keeps its state, and one nobody touches again is gone a day later.
• Server logs: local Docker json-file logs, capped at 10 MB per file with 3 files kept per service. They roll over on their own, so old lines are overwritten as new ones arrive.

The only cookies are the Supabase login-session cookies that keep you signed in as you move between pages. There are no tracking cookies, no advertising cookies, and no analytics cookies, because there is no advertising or analytics here at all. Clearing them just signs you out.

There is an admin statistics dashboard at an unlisted URL that only I can open. It shows per-player and per-game statistics: display names next to the games those players were in, the characters they picked, and how those games went.

I am telling you this because you should not have to guess. Your display name and your game history are visible to me. What is worth being exact about is which parts of that are visible to anybody else, because the two halves are genuinely different.

• The detailed game statistics are not public. The tables holding the per-game and per-player numbers, meaning everything in the "Per game" bullet further up, are locked so that only the operator key I hold can read them. No player can query them, signed in or not.
• Your profile row is effectively public. Display name, chosen avatar character, games played, and games won can be read by anyone using the site. That is the rule that lets the people you are about to play with see who is in the lobby, but it is not limited to them. Please treat those four things as public.
• Room records sit in between. The row saying you were in a room can be read by anyone using the site, and so can any room that was not set to private, join code included. A room set to private is readable only by its host and the people who joined it.

I do not sell any of it and I do not hand it to anyone, but I would rather you knew which half is which than assumed both were sealed.

Email me at [email protected] from the address on the account, or tell me the display name to look for, and ask for the account to be deleted. That removes your login, your profile, and the game statistics tied to that account.

One honest limit on that. The games themselves leave behind a record of the game, not of you: when it was played, how many people were in the crew, and whether the crew won. Once your rows are gone there is nothing in that record tying it to you, but the game itself stays in the history. I am not going to promise you a scrub I cannot actually perform.

I do this by hand, so it is not instant. Once it is done it is gone, and I cannot bring it back.

This game is for players aged 13 and over. Please do not create an account if you are under 13. If I find out that an account belongs to someone under 13, I will delete it.

Nothing checks this. The signup form asks for a display name, an email address, and a password, and it never asks your age, so this is a rule rather than a gate. The same rule is in the Terms of Use.

I take reasonable care. Sign-in and passwords are handled by Supabase rather than by code I wrote, so the game never holds a raw password, and the site is served over HTTPS.

Be realistic about what this is, though. It is a hobby project, run by one person, on a computer in my house. I cannot promise you the kind of security a funded company with a security team can. Please do not reuse an important password here, and do not put anything you would mind a stranger reading into your display name.

If this page changes, the "Last updated" date at the top changes with it. There is no mailing list and I will not email you about it, so that date is the signal. The Terms of Use work the same way.