Privacy

On your device

The game stores its data in your browser, on your device. It is the storage the game needs to work: without it your hero would be gone on the next visit. That is why there is no consent banner. Nobody else, us included, can read it or delete it.

Your hero, stash, gear, skills and settings are one record in the browser’s IndexedDB: database dankloot, store save, record profile.

A few small settings live in localStorage, apart from the hero:

• dankloot.skills.v1: skills Automatic or Tap to fire, and which side the buttons sit on.
• dankloot.lootfilter.v1: which loot is shown on the floor.
• dankloot.autosalvage.v1: whether auto-salvage is on or off.
• dankloot.fps.v1: set only while the frame-rate readout is on.
• dl-town2-seen: the places in town whose first-visit line each hero has already read.
• dl-town-private: set when you lock your town to Private on this device.
• dl-coop-seat: plus a room code: a random seat token, the time, and in a dive its floor and your partner, so a reload puts you back in your seat. Ignored after an hour, gone when the dive ends.
• dl-coop-party: plus a party code: a random token and the time, so a reload takes your place in the party back. Dropped after the party’s 30 minutes, a Leave or a kick.
• dl-coop-partners: your last 5 co-op partners on this device: their hero’s name and class, the day you last played together and the floor you started on.

One cookie, written by the game page itself, never by the server: while you stand in the shared town, dl-town holds a random 24-character town token. It is sent only to the co-op service (path /api/coop), so a co-op game you open next takes your old town hero out of the square. It holds nothing else, tracks nothing, and your browser deletes it when it closes.

Once you open /play/, an install cache named dankloot- plus eight letters and digits keeps copies of the game’s own files, so it starts fast and can be added to your home screen. A new version of the game deletes the older cache.

To clear it all: Settings, then “Erase all progress…” deletes the hero’s database. Your browser’s “clear site data” for dankloot.com removes the database, every key above, the cookie and the install cache. A private window keeps none of it once it closes.

When you play with others

Playing with a friend, a party or the shared town goes through our co-op service. It keeps everything in memory only: no data file, no database, no account. When it restarts, every room, party and town is gone.

A room (a dive with a friend) holds your hero as your page sent it (name, class, level, gear, skills), a random seat token and the live game. A room that empties waits 30 minutes before its dive starts, or 16 minutes once it has, so a dropped phone can take its seat back. Then it is deleted, names and all.

A party holds each member’s hero name, class, level, the character he last sent, a random token and his spot in camp. A party nobody is connected to lives 30 minutes, then it is deleted.

The shared town shows your hero’s name, class, level and spot to the other heroes in your square (at most five stand in one) while you stand there. Leaving town, closing the page or 45 silent seconds take you out at once. Private opens no connection at all.

Public games are listed by chapter, depth and each hero’s class and level, never a name or an address.

The service writes one log line when a connection closes: the time, why it closed, the room’s age and seat count, and the browser family (such as Chrome or Safari) from a fixed list. Never an IP address, a name, a token or a room code.

Its health page counts the last 24 hours, in memory only, in hourly totals: rooms opened by kind (invite, public, party, Fissure), joins by how they came (link, board, public button, town), games played together, games played beside our own test bot, the longest game together in minutes, town arrivals and the most heroes in town at once. Counts only: no id, name or address.

The visit counter

Page visits are counted by GoatCounter, which we run ourselves at stats.dankdev.com. It sets no cookie. It records the page, the page you came from, the browser, the screen size and the country.

The web server’s log

Like nearly every web server, ours writes a line for each request: the IP address, the browser, the time and the address asked for. It keeps these lines for up to 52 days, for security and to find faults, then deletes them.

What is never done

No ads and no ad networks. No sign-in and no account. No tracking cookie, no fingerprinting. Nothing about you is sold, rented or shared with anyone.

Who runs it

DANKLOOT is made and run by DankDev. This page was last changed on 3 November 2026; it changes when the game’s code does.