Data policy - gmichi.fun

Last updated 29 August 2026. This is the field-by-field companion to the privacy policy, written from the code rather than from a template. If the two ever disagree, this one is wrong and the code is right - tell us.

Three places data can be

Your browser - localStorage on this device. Never sent anywhere except the fields marked below.
The leaderboards - one DynamoDB table in AWS us-east-1, reached through /api/* on this site. One row per player per game.
Accounts - one Amazon Cognito user pool in AWS us-east-1. Only if you register.

What a guest leaves

Field	Where	What it is	Kept until
name	browser + leaderboards	The name you pick. Letters, numbers, spaces, dots, dashes, underscores; 14 characters at most. Shown to everyone on the boards. Required before a score can go up.	You change it, remove your scores, or clear this browser.
player	browser + leaderboards	A random id your browser generates. It is the write key: it decides which row a submission overwrites. Sent only in submissions, never returned by any endpoint, never shown.	Cleared with this browser's data.
pub	browser + leaderboards	A second random id, unrelated to the first, carried on board rows so the page can highlight yours. Visible to anyone who reads the API.	Same.
score, updated	browser + leaderboards	Your best in each game and when it was set. The board holds your best only, not every run.	Beaten, removed by you, or the site closes.
pending	browser	Up to 30 runs that could not be sent yet - offline, or waiting for you to pick a name. Each carries a signed run token dated when the page loaded.	Sent, or cleared.
muted, rename, synced, claimed	browser	Housekeeping flags: the sound switch, and whether the leaderboards have been told about a name change or a sign-in.	Cleared with this browser's data.
game saves	browser	The Michidex, the Meowney Printer bank, a Michordle streak, Saint Michi's old high score and similar. Each game owns its own; none is ever uploaded.	You clear site data in your browser. The Clear this browser button on the account page does not touch these.

Guest rows are not unique by name - two guests can both be "SPARKY". They are unique by the write key, which is why clearing your browser makes you a new guest with a new row.

What an account adds

Field	Where	What it is	Kept until
handle (username)	Cognito + leaderboards	The name you register. Unique across all accounts, case-insensitive, fixed for the life of the account. It replaces the guest name on your rows and draws the ✓.	The account is deleted.
email, email_verified	Cognito	Used to send the sign-up code and password-reset codes. Not shown anywhere public; the account page shows it to you. Not used for any other mail.	The account is deleted.
password	Cognito	Stored by Cognito as a salted hash. Your browser sends it to Cognito directly over HTTPS; this site's own code never receives it and cannot recover it.	The account is deleted.
sub	Cognito + leaderboards	Cognito's random id for the account. Your leaderboard rows are keyed `acct:<sub>` and your public id is derived from it, so no browser-generated id can collide with an account.	The account is deleted.
sign-in history	Cognito	Cognito records when the account was created, confirmed and last signed in, as part of running the pool.	The account is deleted.
session	browser	The ID, access and refresh tokens Cognito issued to this browser - an hour for the first two, thirty days for the refresh token. Sent to `/api/*` as a bearer header on score submissions and account calls so the API can verify the row is yours.	Sign out, delete, or thirty days.

What happens to guest scores when you sign in. The first time an account signs in on a browser that has guest scores, those rows are moved into the account: each becomes the account's row for that game if it beats what the account already holds, and the guest row is deleted so you appear once, not twice. Your bests are then pulled from the account on any other device you sign in on, and raised locally if the account's is higher.

What the servers see, briefly

IP address. The scores API writes it into a rate-limit row so one address cannot post faster than a person; that row is marked to expire after about two minutes (Amazon deletes expired rows on a best-effort schedule, so it may linger a little longer). It is not stored with any score. Amazon's edge network and Cognito see it as part of serving the request.
Error logs. When the API hits an unexpected error it logs the error for 14 days. Names, scores, emails and IPs are not written to those logs.
Nothing from the games. No game sends anything but its final score through MichiArcade.submit(). No gameplay, inputs or timings are recorded.

What we do not do

Sell, rent or share any of the above with anyone.
Email you for any reason other than a code you asked for.
Read your password. We cannot; see above.
Link a guest's rows to a person. There is nothing to link them with.

Removing it

All on the account page:

Remove my scores from the leaderboards - deletes every row this player holds (this browser's guest rows, or the account's rows if signed in). Your personal bests stay in this browser.
Clear this browser's saved data - deletes the name, ids, bests, session, pending runs and flags stored here and signs you out. Game saves are left alone; clear site data in the browser to remove those too.
Delete account - removes every leaderboard row the account holds, then the Cognito user itself with its email and password. Immediate and not reversible. Anything the site held about you is gone; Amazon may retain backups of the user pool for a short period as part of operating it.

Seeded rows. Each board carries five starter scores written by the site on 19 August 2026 so a new game did not open onto an empty board. They are marked as such in the table, are not anyone's data, and are removed as real scores take their place.

Questions

Ask @lil_runnr on X. The code that does all of the above is small and readable, and this page is meant to describe it exactly.