Privacy

Most of what the site remembers lives in your browser's own storage, on this device only. In plain words, it keeps:

• Your daily-puzzle record. Today's state for each daily game (the guesses made, whether it is finished and won) and per-game totals of plays, wins, current streak, best streak and how many guesses each win took. Earlier days' game states are dropped whenever a new day is saved; only the totals persist, plus a list of the days you finished each game and whether you won, so your streaks can be kept with your account if you sign in.
• Your Lethal results. Today's puzzle number and id, whether the result has been shown and sent, your solve time and your place among the day's solvers, overwritten every day. For practice puzzles: the ids whose result has already been sent, each with the time it was sent and your place among that puzzle's solvers, so that no puzzle is sent twice (only the newest 150 are kept); the practice puzzles you have already been served, so none is served twice (the newest 4,000); and the character you picked for practice.
• Your tier lists. One for each list you start (cards, relics and potions by character or card type, characters, events, enemies, elites, bosses): its title, the name and colour of each tier and what is in each tier, plus the id of its copy on your account once you save it there.
• Your settings. The sound toggle, whether the side menu is open, the Ascension level you chose on enemy pages and the card pool you picked for Guess the card practice.
• While you are signed in. Your Steam name and avatar link, so every page shows you signed in from its first moment, and a fingerprint of the daily results last sent to your account. Signing out or deleting the account removes both.
• Until the tab is closed. A few notes in session storage:
  • that you have moved the pointer or pressed a key, which browsers require before a page may play sound;
  • that the act banner on the home page has already played this visit;
  • each directory's filters and sort, so a breadcrumb brings them back;
  • the path you took, so the breadcrumbs can show how you got to a page;
  • the side menu's scroll position;
  • the room shown behind the last page, so the next page can fade from it;
  • for a few seconds, a filter handed from one page to the next (a character's card pool, the Multiplayer cards, a power's character, the Ancient you were reading about).

No analytics, no advertising, no trackers. The pages are static HTML, the fonts (Kreon, Spectral and Bitter) are served from this domain rather than a font service, and the share buttons only copy text to your clipboard. Steam avatars are the one picture the site does not serve itself: they load from Steam's image server, so a page that shows one makes your browser ask Steam for it. The hosting provider keeps ordinary server logs (path, time, IP address) to keep the site up; they are used for nothing else.

To wipe what your browser keeps, clear this site's data (Chrome: Settings, Privacy and security, Site settings; Firefox: Settings, Privacy and Security, Manage Data), or use a private window, which discards it when the window closes. Clearing resets the streaks shown in this browser; the results already kept with your account stay there.

Signing in is optional. Reading the wiki and playing the daily puzzles never need it; it is only there to keep your tier lists and your daily streaks with you.

How it works. Sign in with Steam takes you to Steam's own sign-in page. The wiki never sees your password: Steam only confirms which account signed in and hands back its public Steam ID. The site then reads your display name and avatar from Steam's public profile data.

What the site stores about you.

• Your Steam ID (the public 17-digit number of your Steam account), your Steam display name, the link to your avatar picture and the link to your Steam profile, as Steam shows them to everyone. They are refreshed each time you sign in.
• When you first signed in and when you last signed in.
• Your sign-in: a random code in a cookie named sid keeps you signed in on this browser for 30 days. The site keeps only a one-way hash of it, so the code cannot be read back from the database. Signing out deletes it. It is the only cookie the site sets, and only once you sign in; during a sign-in, a second cookie lives for ten minutes to check that Steam's answer belongs to the sign-in you started.
• What you make: your tier lists, and for each daily game and day whether you won, which give the streaks and days played on your profile.
• A count of your recent changes, reset every ten minutes, used only to stop floods of changes.

Who sees it. Tier lists you publish are public: anyone with the link sees them with your Steam name and avatar. Your profile page and your daily results are shown to you alone. Nothing is sold or shared, and no IP address is stored with your account.

The Rankings. Signing in also puts you on The Rankings. When you sign in, and at most every six hours after that, the site asks Steam for three numbers from your public Steam profile: your damage to the Architect, your Slay the Spire 2 achievements and your hours played. It keeps those numbers and when Steam last answered, and shows them to everyone beside your Steam name and avatar, never your Steam ID. If your Steam game details are private, Steam shares nothing and you are simply not ranked. The switch Hide me from The Rankings on your profile deletes the numbers and stops the site asking until you switch it back. Anyone can also add a public Steam profile to The Rankings without signing in, by pasting its link on that page: the site then keeps that Steam ID, name and avatar as it does for an account, and the browser remembers the link until Not you is pressed. To be removed, sign in with that Steam account and switch on Hide me, or email hello@sts.wiki. Lookups are counted for ten minutes under a one-way hash of the IP address, never the address itself, to stop floods.