Privacy

The short version: an account is a name and a password, there is no email, there are no trackers, and nothing is sold or shared.

What is stored, and where

On the server, only if you make an account:

• Your username.
• Your password and recovery words, each hashed with scrypt. They are not stored in a form anybody here can read, which is also why they cannot be recovered for you.
• Your saved avatars, as the manifest bytes the format uses. A manifest is a list of item ids and colours, about a kilobyte.
• Your gamer profile, if you fill one in: the gamertag, motto, zone, rep and gamerscore you type, and a gamerpic. A picture you chose from a game is kept as its id; one you took in the booth is kept as the image.
• Your display cases: each one's settings, its name, and any links you put under its bar. A case is public to anyone who has its address.
• A pet's state, for each case with pet mode on: three numbers (food, fun, energy) with the moment each was set, and whether it is asleep. Nothing else.
• A session token, so you stay signed in.

Visitors to a display case

Anyone can see a display case on a page it is embedded in, and press a pet's buttons there. To keep one visitor from pressing forty times, the server keeps, in memory only, a salted hash of the visitor's network address with the time of each press, for an hour. The salt is made up when the server starts and is never written down, so nothing about who fed a pet is kept or can be read back, and a restart forgets all of it. A visitor is not asked to sign in and nothing is set in their browser.

Each time a display case loads, it is counted. When it loads inside another website, the name of that website (for example example.com, as the browser reports it to the embedded page) is counted with it, so 360sona can see where its cases are shown. Nothing about the visitor is stored with that count.

In your browser, whether or not you have an account: your settings, where you had scrolled to in each category, and whether you have dismissed the tips. Saved avatars are not kept here. Signing out removes what is removable and leaves nothing for the next person at the same computer.

Bug reports

If you send a bug report, what you typed is stored along with the item it was about. If you leave the diagnostics box ticked, the report also carries the avatar on the stage, your quality settings, your graphics card and browser as the browser reports them, and any errors the page had already hit. That is the part that makes a report reproducible, and it is the part you can decline: untick the box and none of it is collected.

What is not done

• No analytics, no advertising, no third-party scripts, no cookies beyond the one that keeps you signed in.
• No profiling, and no selling or sharing of anything above.
• No email address is ever asked for, so none can leak.

Deleting it

Clearing a slot deletes that avatar from the account. Deleting a display case deletes its pet, its links and its counts with it, and clearing a profile field removes it. To have an account and everything in it removed, ask through the contact page and say which name it is.

Last updated: 7 October 2026.