Cardage Privacy Policy

Last updated 24 October 2026

This policy is for Cardage on the web, at cardage.io. The Android app works differently, and has its own privacy policy.

Who runs Cardage

Cardage is made and sold by Burning Hope Games LLC ("we", "us"). Questions and requests about this policy go to support@cardage.io.

What stays on your device

The game saves to your browser's own storage, on your device. Unless you sign in (below), none of this is sent to us:

• your saved games, in each mode and save slot: the progress you have unlocked, and any run in progress, with a record of the choices you have made in it (the record of a finished run stays until you begin the next one)
• your settings, such as sound and graphics quality
• the Normal and Casual runs you finish while signed out (the last twenty), waiting to go to the leaderboard if you sign in (below)
• a random identifier, made by your browser, that groups the wishes you send without signing in
• if you have signed in, whether your account has the full game, and the key that opens it, so it still opens when your connection drops

Clearing your browser's data for this site erases all of it.

If you sign in with Google

Signing in is done by Google. When you sign in, Google tells the game your Google account ID, your name, your email address and a link to your profile picture. The game keeps:

• Your account ID, to recognise you next time.
• Your saved game (your progress and any run under way, in each mode and save slot) so it follows you to any device you sign in on, with a random label for the device that saved it, made by your browser, so the game can tell your devices apart. Your settings, such as sound, stay on each device.
• The handle you choose. This is the only name anyone else ever sees. Your Google name is never shown on the leaderboard.
• Your Google name and email address, with each wish you send while signed in, so there is someone to reply to.
• Whether your account has the full game, and how it came to have it: the code spent on it, with your Google name, or your purchase (below).

Google keeps a record of your sign-in to this game under Google's own privacy policy.

If you buy the full game

Payment is handled by Paddle.com, our reseller and the merchant of record for all our orders. It collects your payment details, billing email address and country, and keeps them under its own privacy policy. We never see your card number.

It tells us what we need to give you the game and to refund it: the order number, which account the game is for, what was bought, the price, currency and tax, the date, and Paddle's customer number for you, through which your receipt and email address are found if you ask us about the order. We keep that with your account ID.

The leaderboard

Your Normal and Casual runs are kept, with your account ID: every one you finish while signed in, and the ones you finished on the same device while signed out (the last twenty), once you sign in and have chosen a handle. For each: the hero you played, the mode (Normal or Casual) and, in Casual, how many times you got up, your score and how it was made up (such as how far you got and what you defeated), which ending you reached, and when. The leaderboard shows, publicly, your best run on each of its boards, under your handle. Normal and Casual have boards of their own: a Casual run is only ever ranked beside other Casual runs.

You can delete all of it yourself, at any time: Remove me from the leaderboard, at the foot of the leaderboard, permanently deletes every run you have posted, Normal and Casual, and takes you off every board. Nothing of it is kept.

Wishes

Wishes are messages you send us from inside the game, with an optional picture, and your run if you choose to add it. They are private: only you and we can read your wishes and the replies to them.

• A wish sent without signing in is stored with the random identifier from your browser, and nothing else about you.
• A wish sent while signed in is stored with your Google name, email address and handle.
• Pictures are kept in private storage that only the game can read, and are deleted automatically after one year.
• Your run, only if you press "Add my run": how it began (the hero, the run's random seed, and what you had unlocked) and every choice you made in it (which room, which card, which reward), with the game's version. It lets us play your run back and see what you saw. With it go the technical details of your device, so we can see what went wrong on it: the browser and its version, the operating system, the screen's size, the memory, the number of processor cores and the graphics card, whether you play by touch, mouse or controller, the game's graphics and sound settings, and a log of the moments the game stalled or lost its pictures, and when something was pressed. It holds nothing else about you. It is kept with the wish, in the same private storage as pictures, and deleted with the wish, or after one year at most.
• You can take back a wish, or delete any line you wrote, from inside the game.

Counting plays and visits

So we can see how much the game is played and where, it counts, anonymously:

• Runs: each time a run starts, each floor it reaches (once for each, so we can see how far players get), how it ends (which ending, a fall, abandoned, or stopped at the end of the demo), and when a run without the full game reaches the end of the demo (once for that run, so we can see how many players get there), with the country it was played from. Each time the game is opened, it also counts that it opened, that its title screen appeared and that Play was pressed there, so we can see whether the game starts on every device, in the same way. Each count about a run also says which of the four heroes it is played with; that is kept as a total per day per hero, apart from the country. The country is worked out from your internet address when the count arrives, and the address is then discarded. What is kept is only a total per day, per country: nothing in it identifies you or links one run to another.
• Visits to the website: through Cloudflare Web Analytics, which counts page visits by country, browser, device and the site you came from. It uses no cookies, stores nothing on your device, and does not keep your address. About Cloudflare Web Analytics

Countries are looked up with IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 licence.

Preventing abuse

To stop anyone flooding the game with messages or counts, the game counts how often requests come from the same internet address. It stores a one-way scrambled form of the address for that count, never the address itself, and deletes it within a few hours.

The services the game runs on

These companies serve the game. They see your internet address and the ordinary details of each request (such as your browser type), as any website does, and keep their own records under their own policies:

• Google Firebase: the website, sign-in, the database, private picture storage and the game's server. Firebase privacy
• Cloudflare: the game's pictures, sound and 3D models, the visit counts, and email to cardage.io addresses. Cloudflare privacy policy
• Paddle: payment, tax, receipts and refunds, as the merchant of record, for anyone who buys the full game. Paddle privacy policy

Your data may be stored and processed in the United States and other countries where these companies operate.

What Cardage does not do

• No advertising and no ad networks.
• No selling or sharing of your information for marketing.

How long things are kept

• Your runs and leaderboard places: until you delete them from the leaderboard, or ask for them to be deleted.
• Your account ID, handle and saved game: until you ask for them to be deleted.
• Wishes and replies: until you delete them, or ask for them to be deleted.
• Pictures and runs sent with wishes: one year at most.
• Whether your account has the full game: as long as your account's data is kept.
• The record of a purchase: for as long as tax and accounting law requires us to keep records of sales, even after the rest of your data is deleted.

Your choices and rights

You can play the demo without signing in, and then nothing that identifies you is sent to us. If you have signed in, you can ask to see what the game holds about you, to correct it, or to have all of it deleted, by writing to support@cardage.io. Please write from the email address of your Google account, or include your handle, so the right records can be found. Deleting your account's data takes the full game away from it; the record of a purchase is kept as the law requires. Depending on where you live, you may have further rights under local law, and you may complain to your local data protection authority.

Children

Cardage is not directed at children under 13, and does not knowingly collect information from them. If you believe a child under 13 has signed in or sent a wish, write to support@cardage.io and it will be deleted.

Changes to this policy

If what the game collects changes, this page will be updated and the date at the top changed.