You can play the whole game with no account and give us nothing at all. Make one and we keep your email and your saved game. That is the list.
Last updated 25 August 2026.
Orbfall is a game made by two people. This page says exactly what it keeps, why, and how to make it stop. It is written to be read rather than survived, and there is not much of it, because the game does not collect much.
| What | Why | Where |
|---|---|---|
| Your email address | It is how you sign in, and where a six-digit code is sent. Nothing else is ever sent to it — there is no newsletter. | Supabase |
| Your saved game | So your hero is there on your other device, and after a cleared browser. It is the same data the game keeps in your browser: level, coins, kit, quests, the map you walked. | Supabase |
| Your password, if you set one | Signing in. It is stored hashed by our account provider; we never see it and cannot read it. | Supabase |
| Which world is hosted under which code | So the world list can say a world is up. A world's name, its code and how many people are in it — never who they are. | Supabase |
| A random id your browser made | It is how a world recognises your hero when you come back next week. It is not tied to your name or your email, and it goes no further than the worlds you play on. | Your browser, and those worlds |
| Things you leave in a world | On the always-on world: a note pinned at the fountain, and a line in the book of names when you clear a raid or stand at the Orbfall. Both show the hero name you chose. | That world's disk |
| Server logs | Ordinary web-server records — an address, a time, an error — kept briefly so we can tell when something is broken. | Vercel, Railway |
No advertising identifiers. No analytics and no tracking pixels. No location. No contacts. No microphone and no camera — the game never asks for either. Chat is not stored. What you say on a shared world goes through the host to the people near you and is then gone; the only writing that outlives the evening is a fountain note, and you choose to pin that.
This game is made for children, and it is built so a child can play all of it with no account at all. If your child wants one, an email address is required — and we would rather it were a parent's. Then the sign-in codes arrive with you, and the account is yours to close.
We do not knowingly collect anything from a child beyond that email address and the saved game behind it. If you believe your child made an account and you want it and everything in it deleted, write to the address below and we will delete it. You do not have to explain why and we will not ask.
Three companies run infrastructure for us, and one serves the fonts. Each has its own privacy policy:
Nobody else. There is no advertising partner, no analytics vendor and no data broker.
One address for all of it, deletion requests included: scriptthemarket@gmail.com. We answer.
If this page changes in a way that matters, the date at the top changes with it. If it ever changes so that we keep more than the list above, we will say so on the front page rather than quietly editing this one.