Privacy policy

Last updated: October 2026

Acronomicon is a real-time multiplayer party game, made and run by Rainbow Moose, operated by Skye Baxter ("we", "us"). We collect only what's necessary to run the game, keep it safe, and process payments. This policy explains what we collect, why, and how long we keep it. See also our Terms of service.

1. Information we collect

• Account information — If you register, we store your username and a hashed (bcrypt) password. We never store plain-text passwords.
• Google account data — If you sign in with Google, we receive your Google account ID, profile name, email address, and profile picture URL from Google's OAuth service.
• Guest ID — If you play without an account, your browser creates a random guest ID. It isn't linked to your name, email, or device. We use it to keep your seat if you reload, to apply moderation decisions, and to count returning players. If you later create an account in the same browser, your guest play is linked to that account.
• Display names — Your display name is shown to other players. For guests and signed-in players alike, it is saved when you win a round or game (shown on leaderboards and kept in game history) and when you file or are named in a player report.
• IP address — Read when you connect. For signed-in players, we store your account's most recent IP address. We use it for security and to enforce temporary IP blocks (see section 2), and we save the reported player's IP address with a player report. Our server's technical logs also record the IP address of each connection, for troubleshooting and security; these logs are deleted after 14 days. IP addresses are never shared or sold.
• Game activity — We keep a log of game events (for example: room created, player joined or left, game started or finished, sign-up, sign-in, purchase) tied to your account ID or guest ID. It contains no IP addresses, chat, or phrases. We use it to understand how the game is played and to fix problems.
• Game statistics and phrases — Games played, round wins, and scores power leaderboards and your personal stats page. Only winning phrases are stored (to power leaderboards); other phrases you write are not kept unless they are captured in a player report. We do not record how individual players vote.
• Avatar images — If you upload a profile picture, it is stored on our server.
• In-game chat — Messages you send in a room are relayed to the other players in that room and held only in memory for the life of the room. They are not written to our database and are lost when the game ends or the server restarts — unless they are captured in a player report (see below).
• Error reports — When something breaks, our server records technical details of the error (such as the room code and the action that failed) so we can fix it.

2. Player reports and moderation

If you report another player, we store the report so a person on our team can review it. Each report records:

• the reason you selected (inappropriate phrase, harassment or bullying, hate speech, spam, cheating, or other) and any note you add
• the chat line or phrase you reported, the room's last 30 chat messages, and that round's submitted phrases
• the room and round, and both players' display names and account IDs (or guest IDs)
• the reported player's IP address — we do not store the IP address of the person filing the report

Reports are reviewed by people, not automatically. A moderator may rename, mute, or ban a player, remove them or a winning phrase from leaderboards, or temporarily block an IP address. Bans and mutes can apply to an account, a guest ID, or an IP address; IP blocks last no longer than 7 days. If you are banned or muted, you'll see the reason and when it ends. We keep a record of moderation decisions, including the moderator's private notes.

We also keep a list of blocked words. Names and phrases containing them are refused, and they are hidden in chat. When this happens we log which word matched, but not the rest of the message.

90 days after a report is resolved, we delete its evidence — the chat, phrases, notes, display names, and IP address. We keep only the outcome, the dates, the reason category, and the account or guest IDs, so moderation history stays consistent.

3. Cookies and local storage

Acronomicon sets only first-party cookies. We do not use third-party tracking or advertising cookies.

• acroparty_session — a signed cookie that keeps you signed in for up to 30 days.
• acro_guest — holds your random guest ID (see section 1) for up to one year.
• If you sign in with Google, a short-lived session cookie is used only during the sign-in flow and is destroyed immediately after.
• Moderators have an additional sign-in cookie for the staff area. It is not set for players.

Your browser's local storage also holds your guest ID and your display preferences (such as your chosen edition and light or dark mode). These stay on your device.

4. Payment processing

Purchases are processed by Stripe. We never receive or store your card number, CVV, or any raw payment credentials. Stripe's own privacy policy governs how they handle payment data. We store only a record of each purchase: the item, price, date, and Stripe's payment reference. We keep purchase records even if you delete your account, because we need them for tax and for handling refunds and disputes.

5. Data sharing

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes. The only third parties that receive data are:

• Stripe — payment processing
• Google — only when you choose Google Sign-In
• DigitalOcean — hosts our server and database
• Backblaze — stores our nightly backups. Backups are encrypted before they leave our server, and Backblaze cannot read them.

6. Data retention and deletion

Account data — including your most recent IP address — is retained as long as your account exists. Game history and winning phrases are retained indefinitely to power leaderboards. In-game chat is not stored beyond the life of a room, except where a message is captured in a player report. Report evidence is deleted 90 days after the report is resolved (see section 2). Server logs and backups are kept for 14 days, then deleted.

You may request deletion of your account by emailing hello@acronomicon.com. When we delete an account:

• your username, email, password, avatar, IP address, sign-in methods, stats, and equipped items are deleted
• your winning rounds are removed from leaderboards
• your entries in the game activity log are made anonymous
• your name, messages, and evidence about you are removed from player reports; the outcome of past reports is kept
• moderation decisions against the account are kept, so a deleted account can't be used to dodge a ban
• purchase records are kept (see section 4)
• an empty placeholder row remains so those records still add up

Deleted data can remain in our encrypted backups for up to 14 days.

7. Children

Acronomicon is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please email hello@acronomicon.com and we will delete it.

8. Contact

Questions or requests regarding your data can be sent to hello@acronomicon.com. We will respond within 30 days.