← Back to workspace

Privacy

This is a personal workspace. Google sign-in verifies identity for game accounts and private access using only openid and email scopes. It does not access Gmail, Drive, or other Google services.

Private applications only admit the designated account or explicitly authorized visitors. Login sessions are stored on this server for up to 12 hours and are revoked on sign-out. Session cookies are HttpOnly and Secure and shared across this site's subdomains.

OAuth codes and tokens are not stored in browser local storage or forwarded as application credentials. Login attempts expire after 10 minutes. Games support configured Google, Apple, and email-code sign-in methods. Game accounts grant no private application or administrator access.

Only hashes of résumé invitation codes are stored; expiry and revocation are enforced. Experiment passwords use salted scrypt hashes, and accounts only grant experiment access. Administrators can revoke codes or accounts at any time. Revocation blocks subsequent requests but cannot recall content already saved by a visitor.

Games store a provider account identifier (the email address for email sign-in), a nickname, and necessary game associations. Other players only see the nickname. Game sessions last 30 days and the current session is revoked on sign-out; cookies are HttpOnly and Secure, with no tokens in local storage. Email codes are stored only as keyed hashes, expire after 10 minutes, and allow five attempts. The mail provider receives the recipient address and code for delivery. Nicknames can be changed, immediately releasing the old name.

Contact: chenlukaka@gmail.com