Your play. Your data.
This application
This notice describes ReplayCove 0.4. The operator must provide the actual hosting, email provider, jurisdiction and contact information before public launch. It is not a claim that every deployment has identical provider logs or retention rules.
On your device
Favorites, recently opened games and snapshot files use browser storage. Clearing site data or changing browser/domain may remove or separate them. Account-local snapshots use separate user namespaces, but someone with access to this browser or its developer tools may still read local data.
When you register
The server stores your email, a one-way password hash, verification status and necessary session/security records. Passwords are not stored as plaintext. Session cookies are HttpOnly; public deployments require HTTPS. Optional two-factor secrets are encrypted, and verification/reset mail goes through the configured email transport.
Favorites and backups
Account favorites live in the database. Browser favorites are added only with your confirmation. Uploading a snapshot is an explicit action; backup bytes are stored outside public static directories and require account authorization. Revisions are separate, not silently overwritten by another device.
Optional measurement
When first-party measurement is enabled, the site records short-lived play sessions and daily pseudonymous observations. It excludes owner testing and respects browser Do Not Track and Global Privacy Control signals. Session counts are not unique-person counts and client reports are not tamper-proof. No key-by-key gameplay or raw search history is sent to this measurement service.
Retention and operations
The maintenance command removes expired sessions, raw measurement records older than two days, daily observations older than thirty days, and old resolved issues. The supplied worker runs maintenance periodically; without a worker, the operator must schedule the command. Hosting, reverse proxies, email delivery and security services may retain their own connection logs.
Export and deletion
Your account page can export a metadata inventory and authenticated backup links. Use the player to export the actual snapshot files. Account deletion requires your current password and removes account favorites and server backups; local browser copies and files you already exported are unchanged. The sole owner account has a separate administrative recovery procedure.