⚔ TokenRPG Level up while you do your thing. And see who else is too.

Privacy policy

Last updated 23 October 2026

Short version: we collect the least we can to run the game, we say exactly what in Your data, and you can delete it all yourself.

Who we are

TokenRPG is run by Tally Digital Ltd (company number 17314375, registered with the ICO as ZC187625). We are the controller of your data: we decide what is collected and why.

Write to us at [email protected]. We have no postal address to give.

You must be 16 or over to have an account.

What we collect

The exact list, field by field, and how long each part is kept, is on Your data. In short:

  • What you give us: your email address, a password (we keep only a hash of it), a handle, and anything optional you add, such as a country or a picture.
  • Usage counts from the small script you install on your computer: tokens per day, by type, model and hour, and a few facts about the machine and your Claude plan.
  • What you do on the site: friends, challenges, your privacy choices, messages you send us, and reports you make about other players (only the admins see those; the player isn't told who reported them, or that anyone did).
  • If you turn on two-factor login (it's optional; admins must have it): your authenticator app's key, sealed so a copy of the database alone can't read it, and ten recovery codes, kept only as hashes. Both go when you turn it off or delete your account.

We never collect your prompts, your code, the names of your files or folders, or your Claude login. To find your plan the script opens two of Claude Code's own files on your computer (on Linux, one of them also holds your login) and sends only a few named plan entries from them.

Why, and on what basis

  • To run the service you signed up for. Your account, your hero's story, the leaderboards and the map you chose to appear on, and the emails that go with them (verifying your address, resetting a password, results).
  • With your consent: news emails. They are off until you turn them on in Settings → Emails, and every one has an unsubscribe link.
  • To keep the service safe: counting sign-ups, resets and wrong passwords so they can be limited, the server's request log, and reports. An admin may rename an account, hide its picture or suspend it when its handle or picture is abusive, it sends spam or it is a fake account; a rename or a suspension is emailed to the player with the reason. A suspended account can't log in or upload and is hidden everywhere. Nothing in it is deleted, but a challenge still waiting to be accepted is cancelled; lifting the suspension puts the rest back. A report is kept while the reported account exists. We have a legitimate interest in keeping the site from being abused.

We don't sell your data, and we don't show adverts.

Who else handles it

The site runs on our own server in the UK. A few services do part of the job for us: Brevo sends our email, Cloudflare carries the traffic and runs the human check on forms that send email, and Google Search Console tells us how people find the public pages (it gets no player data from us). They may handle data outside the UK. Each is named, with what it gets, on Your data, and Tally Digital Ltd's own sub-processors and security pages say more. The only analytics is Google Analytics, and only if you say yes (see Cookies).

Cookies

Two cookies, both needed for the site to work, and no advertising cookies. Google Analytics' cookies are the only others, and only if you accept them (below):

  • session keeps you logged in and protects the site's forms. A visitor who isn't logged in gets it too, on any page with a form, holding only the forms' security token.
  • known remembers that this browser has logged in to your account before, so someone guessing your password can't lock you out: logging in from a browser without it then needs the human check as well. It can't log anyone in.

Their contents and lifetimes are on Your data.

Analytics, only if you say yes. On the public pages, a visitor who isn't logged in is asked whether we may use Google Analytics. Nothing from Google loads unless you press Accept, and it never loads when you are logged in. If you accept, it sets cookies called _ga and _ga_ plus an id, kept for up to 365 days after your last visit, and Google receives your visit: the page, your browser and your IP address. We use it to see which public pages people read. Press Reject, or Cookie settings in the footer, to change your mind.

How long we keep it

Your data stays while your account does, and goes when you delete it. A few things are kept for a short, fixed time (upload timings, reset links, limit counters, accounts that never verified their email, the server's request log, which holds no IP address); each is on Your data with its length.

Your rights

Under UK data protection law you can ask to see your data, correct it, delete it, limit or object to how we use it, take a copy of it, and withdraw consent. You can also complain to the Information Commissioner's Office (ico.org.uk).

  • Delete everything: do it yourself at Settings → Security while logged in, or on the Delete my data page if you can't log in (a suspended account too).
  • Correct something: most of it you can change in Settings.
  • A copy of your data: press Download my data at Settings → Security while logged in: one file with what we hold on you, and your picture. Or email [email protected]: if you can't log in (a suspended account can't), we send the same file to the account's own address.
  • Anything else: email the same address. We answer within a month.

What stays after you delete

In short: a copy can sit in a backup snapshot for up to 8 weeks and in the nightly copy on a second machine for up to 6 months (checked 23 October 2026). In full, the same list as the Delete my data page shows:

Deleting takes, at once: your hero and its story, the tokens and machines you uploaded, your friends and friend requests, your place in challenges, the duels you called, the kudos you gave and the kudos on your events, the invites you sent and the invites to your address, the feedback you sent, your picture, your email settings, and every link and limit tied to the account. A duel someone else called against you stays in their history with no trace of you, so that level isn't fought again.

What stays for a while:

  • Backups, for up to 6 months. Our server keeps snapshots of the database: hourly ones for 24 hours, daily ones for 14 days, weekly ones for 8 weeks, and a nightly copy goes to a second machine, kept for 6 months (checked 23 October 2026). So a deleted account can survive in those backups for up to 6 months. We use them only to bring the whole site back after a disaster. A restore from the hourly, daily or weekly snapshots replays the deletions: before the site answers again, it replays our list of deleted accounts and deletes each one again. The list holds each only as its account number, when it was made and a random number (nothing about you). If the home server itself were lost and rebuilt from the second copy, deletions from the last day before the loss could come back, and we would delete them again on request.
  • Challenges you played in. Their results and the other players' spoils stay. In one that hasn't settled yet, your tokens that week stay in it, counted for your side, until it settles. Two exceptions while it is still under way: on Beat your normal you drop out of your side's average instead, and if nobody else on your side is left, it is called off and your tokens go. After it settles a side's score, which holds what you put in, stays while anyone else on your side is still in it, since it is the result they earned; once nobody on your side is left, the others see it as played against "a player who left". The challenge is deleted once nobody who played in it is left.
  • Brevo's sending log. Brevo sends our email and keeps its own record of each one (the address, the subject and when) under Brevo's privacy policy.
  • Your picture can stay in browser and network caches for up to a day.
  • The server's request log lists the pages asked for, with no IP address and no account, until 30 MB of newer lines have been written or the site is next updated.
  • Feedback emails. Feedback you sent through the site was also emailed to us, and that copy stays in our mailbox until you ask us to delete it: write to [email protected].
  • Analytics. If you pressed Accept for Google Analytics on a public page, Google may hold counts of those visits under a random id in your browser. It is never linked to an account, so deleting your account doesn't touch it. Cookie settings in the footer of a public page stops it from then on.

Changes

If this changes in a way that matters, the date at the top changes and we say so on the Updates page.