Privacy Policy

Rick & Morty Heist lives at heistotron.blackcatmatrix.com. I am John Rooney, and I run it on my own as a personal hobby project. There is no company behind it and no team.

If you have a question about anything on this page, or you want your data deleted, email me at [email protected]. That is the entire support department.

Account info

• Your email address.
• Your display name, which the people you play with can see in the lobby and in game.
• If you signed up with an email and password: a password that is hashed and managed by our locally hosted Keycloak account service. The game itself never sees or stores your raw password.
• If you signed in with Google instead: that provider hands back an account id, a name, and an email address to our account service. You can manage linked sign-in methods and passwords on the shared account page.

Gameplay data

• Per game: things like which characters were played and whether each was played as Normal or Pro, whether the game was won, lost, or abandoned, how long it ran, how many turns it took, how many undos were used, which kind of map layout it was on, the loot and tools collected, safes cracked, alarms triggered, stealth lost, guard hits, dice roll counts, and which event cards came up.
• Rooms you play in: when someone sets up a game room, the database keeps the name the host typed for it, stored exactly as typed, along with its join code, who hosted it, whether it was set to private, how many seats it allows, and whether it is waiting, in progress, or finished. When you join a room, a row is added recording that you were in it, which seat you took, and when you joined.
• Your profile: display name, chosen avatar character, games played, and games won.
• Saved map layouts: any map layout you save as a favorite.

Technical and connection data

• The game sits behind Cloudflare, which handles the network side of getting your browser to the server. Cloudflare therefore sees connection metadata, including your IP address.
• The server keeps ordinary local logs of what it did, so that crashes can be worked out afterwards. What lands in them about you is your account id and the ids of the rooms you joined, left, or were disconnected from. Your IP address is not written to those logs.

• Account info: so you can sign in, come back to the same profile, and so the people you play with can tell who is who.
• Gameplay data: so the game can actually run, so your profile and saved map layouts survive between sessions, and so I can see how the game is really being played (which characters win, which events keep showing up) and balance it.
• Technical and connection data: it is a by-product of putting a website on the internet. Cloudflare needs connection details to route your traffic, and logs are how I find out why something broke.

The services involved are:

• Black Cat Matrix accounts: Keycloak and PostgreSQL run on my own computer and store accounts and game data. Resend delivers account verification and recovery messages when email delivery is enabled.
• Cloudflare: sits in front of the game as the network layer, so it carries the connection between your browser and the server.
• Your sign-in provider, if you used one: signing in with Google is a conversation between you and them, so they know you did it.

Your data is never sold. There is no advertising anywhere in the game and no third-party tracking scripts. The site keeps its own records of game activity (when games are played, by which account, and how they turn out) to run and improve the game; they are not shared with anyone and never used for ads. Cloudflare, which delivers the site, collects anonymous page-view statistics. There is also nothing to pay for, so no card details or financial data of any sort exist here.

Accounts, profiles, game rooms and who sat in them, game statistics, and saved map layouts live in PostgreSQL on my own computer. Shared account credentials and linked sign-in methods are managed by Keycloak on that same computer.

The game server itself is my own personal computer. It is not a data centre. It sits in my home and is reachable from the internet through a Cloudflare Tunnel. While you are playing, your moves are being handled by that machine. You should know that before you decide what to put in a display name.

Live game state, meaning the board, the turn order, and everything else mid-game, is held in Redis on that same machine.

• Account info, profile, game rooms, game statistics, saved map layouts: kept until you ask me to delete them.
• Live game state in Redis: expires automatically 24 hours after the last move in that game. The clock restarts every time somebody plays, so a game you keep coming back to keeps its state, and one nobody touches again is gone a day later.
• Server logs: local Docker json-file logs, capped at 10 MB per file with 3 files kept per service. They roll over on their own, so old lines are overwritten as new ones arrive.

The account service and game use essential login-session cookies that keep you signed in as you move between pages. There are no tracking cookies and no advertising cookies, because there is no advertising here at all. Clearing them just signs you out.

There is an admin statistics dashboard at an unlisted URL that only I can open. It shows per-player and per-game statistics: display names next to the games those players were in, the characters they picked, and how those games went.

I am telling you this because you should not have to guess. Your display name and your game history are visible to me. What is worth being exact about is which parts of that are visible to anybody else, because the two halves are genuinely different.

• The detailed game statistics are not public. The tables holding the per-game and per-player numbers, meaning everything in the "Per game" bullet further up, require a verified game administrator role. Ordinary players cannot query them.
• Your display name is visible to other players. Your own profile endpoint returns your game preferences and counters. Administrators can see display names and recorded game statistics. Your email and sign-in tokens are never in the public session response.
• Room records sit in between. Public rooms appear to signed-in players. Private rooms are visible only to their host and members. A valid join code grants a signed-in invitee access; treat it as an invitation. Favorite map layouts and saved games are scoped to their owner.

I do not sell any of it and I do not hand it to anyone, but I would rather you knew which half is which than assumed both were sealed.

Email me at [email protected] from the address on the account, or tell me the display name to look for, and ask for the account to be deleted. That removes your login, your profile, and the game statistics tied to that account.

One honest limit on that. The games themselves leave behind a record of the game, not of you: when it was played, how many people were in the crew, and whether the crew won. Once your rows are gone there is nothing in that record tying it to you, but the game itself stays in the history. I am not going to promise you a scrub I cannot actually perform.

I do this by hand, so it is not instant. Once it is done it is gone, and I cannot bring it back.

This game is for players aged 13 and over. Please do not create an account if you are under 13. If I find out that an account belongs to someone under 13, I will delete it.

Nothing checks this. The signup form asks for a display name, an email address, and a password, and it never asks your age, so this is a rule rather than a gate. The same rule is in the Terms of Use.

I take reasonable care. Sign-in and passwords are handled by our locally hosted Keycloak account service, so the game never holds a raw password, and the site is served over HTTPS.

Be realistic about what this is, though. It is a hobby project, run by one person, on a computer in my house. I cannot promise you the kind of security a funded company with a security team can. Please do not reuse an important password here, and do not put anything you would mind a stranger reading into your display name.

If this page changes, the "Last updated" date at the top changes with it. There is no mailing list and I will not email you about it, so that date is the signal. The Terms of Use work the same way.