Privacy Policy

Last updated October 22, 2026

This policy explains what the Spells and Shells team (“we”, “us”) collects when you use Spells and Shells at spellsnshells.com, how it is used and the choices you have. The game is for adults (18+) only.

What we collect

• Your Discord identity. When you sign in with Discord we receive your Discord user ID and display name (Discord’s “identify” permission). We also ask Discord whether you have joined the Spells and Shells Discord server (its “read your membership” permission, for our server only), so we can stop showing you the invitation to join; we do not see your other servers or your messages. We never see your Discord password or email address.
• Your Google identity. If you sign in with Google, or link a Google account in Settings, we receive your Google account ID and display name (the “openid” and “profile” permissions), and we keep which character that Google account opens. We do not ask for your email address and never see your Google password.
• Guest play. If you play without signing in, we create a guest character linked only to the sign-in cookie in your browser and record the IP address it started from, so no network can start more than a few guests a day. A guest character is deleted after 7 days without play, together with its sessions; if you sign in with Discord or Google first, it becomes your account like any other.
• Your game account. Your username, character appearance, stats, inventory, money, progress, syndicate membership, fights, activity history, settings, and when you confirmed you are 18 or older and accepted our terms.
• What you write and upload. Global, direct, syndicate and raid chat messages, in-game mail, your profile bio and photos, syndicate descriptions and banners.
• Reports and moderation. If you report someone, or someone reports you, we keep the report, the reported profile or message and up to five earlier messages from that conversation, plus any warnings, mutes or bans. If a Discord account or a player is banned from signing in, we keep the Discord user ID or player, the reason and the dates of the ban.
• Donations (optional). If you buy Membership Tokens, payment is handled by PayPal: you pay on PayPal’s site and we never see your card, bank or PayPal login details. We keep a record of each order: its PayPal order and payment IDs, your account, the pack, the price and currency, and when it was created, paid and delivered, so tokens are delivered exactly once and we can answer questions about a purchase. If you subscribe monthly we also keep the PayPal subscription ID, its status (for example active or cancelled), when it started, and the ID, amount and date of each monthly payment that delivered a token. If a payment is refunded, reversed or disputed, we keep a record of that too: the payment, your account, what was taken back or is still owed, and when.
• Notifications (optional). If you turn on phone or browser notifications, we store that device’s push subscription (an address and keys issued by your browser) so we can send short alerts.
• Technical data. Our host, Cloudflare, processes your IP address and basic request information to deliver the site and keep it secure, and may collect cookie-free visit and performance statistics.
• IP addresses. We record the IP addresses your account signs in and plays from, with the first and last time each was seen. Only the administrator can see them. We use them to enforce bans, to spot banned players coming back and accounts run by the same person, and to keep the game secure. If an address is banned, we keep the address (for IPv6, its network), the reason and the dates of the ban.
• Play timing. To spot automated play (bots, scripts and macros), the game keeps short statistics on your own account: how regularly and how quickly your actions arrive, which hours of the day you play, whether an action came from a hidden browser tab or one of several pages open at once, and the times of your last 60 actions. Daily summaries are kept for 14 days. Only staff can see them, and they hold nothing about your IP address or device.
• Error reports. When something breaks, the game sends a report of the error to our error-monitoring service: what failed, where in the code, the page address (without any query), and your browser and device type. Reports do not include your name, messages, cookies or IP address.
• Speed measurements. When you leave or hide a page, the game sends how quickly that page loaded and responded (for example, when its content appeared), the page name and whether you are on a phone or a desktop. These are added to daily totals on our own servers; nothing about you, your account, your device or your IP address is kept.
• Usage counts. To see which pages and features people use and whether new players come back, the game adds your actions to daily totals per feature (for example, how many players did a crime today), counts which pages a visit opened, and notes how many days after signing up a player returned. We also count new characters by where their first visit came from (a link label such as ?src=, a player's invite link, the website that linked to us, or a direct visit) and how many of them come back after 1, 7 and 30 days. The same way it counts, per day and per kind of device (phone or desktop), how many visits reach each step of joining: seeing the front page, pressing sign in, finishing the Discord or Google sign-in, confirming your age, creating a character, a first fight and finishing the beginner story. Only these totals are stored; to count you once per day, your game record remembers which features you used today, and for your first 30 days it remembers where your first visit came from.
• Google Analytics. To see how many people visit, which pages they open and which links and campaigns bring them here, the site uses Google Analytics. Your browser sends Google the page address (with player and fight IDs removed and only link labels such as ?src= kept), the page title, the page you came from, and your browser, device, screen size and approximate location (Google works it out from your IP address and does not keep the address). Google’s advertising features are turned off: nothing is used for ads, ad personalisation or cross-device tracking.

Cookies and device storage

We use one sign-in cookie (bw_session, lasting up to 30 days), a short-lived cookie during Discord or Google sign-in, and a marker cookie (bw_discord_member) that remembers you have joined our Discord server so the invitation stays hidden. If you open a player's invite link (one with ?ref=, including shared replay and profile links), an invite cookie (bw_ref, lasting up to 7 days) remembers which player invited you, so they can be credited when you create a character; it holds only that player's ID and is deleted once the invite is recorded or can no longer be used. Your first visit also sets a source cookie (bw_src, lasting up to 30 days) holding only where that visit came from, such as a link label or the name of the website that linked to us, so new characters can be counted by source. Google Analytics sets its own cookies (_ga and _ga_*, lasting up to 2 years) holding a random ID, so returning visits can be counted. Your browser also stores small preferences on your device, such as display settings, the last page you visited and which chat messages you have read. We do not use advertising cookies.

How we use it

• To run the game: sign you in, save your progress and show you and other players the parts of the game meant to be shared.
• To keep the game safe: enforce the 18+ rule and our Terms of Service, review reports, prevent cheating and abuse.
• To send notifications you asked for.
• To fix bugs and improve the game.

We do not sell your information, show ads or share it with advertisers.

What other players can see

Other players can see your username, profile, profile picture and photos, level, rank, syndicate, public records such as leaderboards and medals, your online status (unless you turn on “appear offline” in Settings) and anything you post in shared chats. Direct messages and mail are visible to you and the people you exchange them with. Staff can view reported content and moderation records. Your combat stats and gear stay private except where the game’s rules show them. On the Endless Road, players near the same mile see notes you leave there and where you were defeated (your name, the mile and the text); notes can be reported and are hidden by moderators when needed. If you share your road chronicle, its link shows your name, distance, regions, titles, bosses beaten and recent road choices to anyone who opens it.

Who processes it

• Cloudflare hosts the game and stores its database and uploaded files.
• Discord and Google handle sign-in under their own privacy policies.
• PayPal processes donation payments under its own privacy policy.
• Google receives the Google Analytics visit statistics described above, under its own privacy policy.
• Sentry receives the error reports described above, so we can find and fix problems.
• Your browser’s push service (for example Google, Mozilla or Apple) delivers notifications if you enable them.

We may also disclose information if the law requires it or to protect players and the game from serious harm.

How long we keep it

We keep your account and game data while your account exists. Sign-in sessions expire after 30 days. Notification subscriptions are removed when you turn notifications off, sign out on that device, or the browser reports them as expired. Donation records are kept for as long as needed for accounting and to resolve payment disputes, even after an account is deleted. Moderation records may be kept after an account is deleted where needed to prevent repeat abuse. IP addresses are deleted 90 days after they were last seen on your account; banned addresses are kept for as long as the ban and its record are needed.

Your choices and deleting your account

You can change your settings and turn notifications off at any time in Settings. To ask for a copy of your data, a correction, or deletion of your account and its content, send in-game Mail to the admin, Boom. We will confirm the request comes from your account and act on it within 30 days.

Adults only

The game is not for anyone under 18. If we learn that an account belongs to someone under 18, we lock it and delete its personal data.

Security

We store only a scrambled (hashed) form of sign-in tokens, use encrypted connections (HTTPS) and limit who can access stored data. No system is perfectly secure, so please keep your Discord and Google accounts secure.

Changes to this policy

We may update this policy. The date at the top shows the latest version, and important changes will be announced in the game’s news.

Contact

Privacy questions or requests: send in-game Mail to the admin, Boom.