Privacy policy
Push to Prod is a free poker roguelike browser game by Xaplore LLC. This page explains, in plain words, what is stored when you play, why, and how to delete it. Effective October 24, 2026.
Short version: you never need an account to play, and your progress stays in your browser. If you choose to sign in with Google, you get a cloud save and join the Daily Seed leaderboard: we store a hashed account ID, the display name you see on the board, your cloud save and your finished Daily Seed runs. We never store your email, full name, surname or photo, and you can delete your data at any time.
Playing as a guest
Your progress (the run in progress, your Collection and history) and your settings are saved only in your browser's local storage on your device. Clearing your browser data, or private browsing, removes them. The game works fully without signing in. Guests never load the Google sign-in script and never contact our server for sign-in, saves or scores.
The game sends one anonymous play count per page load, and one anonymous share count when you press Share and the result is shared or copied (only that a share happened, never what or where; no cookies, no identifiers), as described in the Xaplore privacy policy.
If you sign in with Google
Signing in is optional, Google is the only option, and it is used only for the cloud save and the Daily Seed leaderboard. Google's sign-in script loads only when you open the sign-in panel. Sign-in is not offered inside the itch.io embed; open push-to-prod.xaplore.dev to sign in.
Our server checks Google's sign-in token (its signature, that it was issued for this game, and that it has not expired) and then stores only:
- Account ID: a one-way SHA-256 hash of your Google account ID (not the ID itself), plus when the account was created and last used.
- Display name: by default your given name and last initial (for example "Guangya L."). You can change it to any nickname of 2–20 characters. It is never your email or your full surname.
- Cloud save: your Collection (which cards and Automations you have seen), your history counters (kept per random device ID generated in your browser, not a fingerprint), your best hand and furthest Sprint, and the run in progress with its list of actions, so you can continue on another device.
- Daily Seed runs: for each Daily Seed run you finish while signed in, the list of actions you took (kept so the result can be re-verified), the result our server computes by replaying it with the game's own rules (rounds cleared, points shipped, best hand, Sprint reached, and whether it was the demo or full build), the rules version and the time it reached our server. Only the first finished run per day and build counts.
- Session: a hash of a random session token, kept for up to 60 days. The token itself lives in an HttpOnly cookie named
ptp_sthat is sent only to this game's/apiand is used only to keep you signed in. - Abuse limits: short-lived counters keyed by a hash of your IP address or account, deleted within about a day.
Not stored: your email address, full name, surname and profile picture. Your settings (language, sound and so on) stay on your device and are not part of the cloud save.
Public: your display name, Daily Seed results and ranks, best hand and number of days played are visible to anyone who views the leaderboard.
How we use it
Only to keep your cloud save, show the leaderboard and keep you signed in. No ads, no selling or sharing of data, no profiling, and no analytics tied to your account.
Who processes it
- Vercel hosts the game and forwards
/apirequests to the game's online service. - Cloudflare runs the online service (Workers) and the database (D1) that holds the data above.
- Google provides sign-in. We receive the sign-in token only when you sign in. Google's own privacy policy applies to your Google account.
Like any network provider, these services may keep short-lived request logs that include IP address and browser type.
How long we keep it
- Sessions expire after 60 days.
- An account, its cloud save and all its runs are deleted automatically after 2 years (730 days) without use.
Deleting your data
Open the account menu in the game and choose Delete my data. This immediately deletes your account, your cloud save and every Daily Seed run, and signs you out on every device. The progress in your current browser stays unless you clear it yourself. You can also email support@xaplore.dev. Sign out only ends the session; your cloud save and results stay.
Children
Push to Prod is not directed at children under 13. If you are under 13, please play as a guest and do not sign in.
Changes
If this policy changes, the new version will be posted here with a new effective date.
Contact
support@xaplore.dev · xaplore.dev · Xaplore LLC, North Carolina, USA
隐私政策
Push to Prod 周五别发版是 Xaplore LLC 出品的免费扑克牌型肉鸽网页游戏。本页用平实的话说明：玩游戏时保存了什么、为什么保存、怎样删除。生效日期：2026 年 10 月 24 日。
简单说：玩游戏永远不需要账号，进度只保存在你的浏览器里。如果你自愿用 Google 账号登录，就能使用云存档并加入每日种子（Daily Seed）排行榜：我们保存一个哈希后的账号编号、排行榜上显示的昵称、你的云存档，以及你完成的每日种子对局。我们从不保存你的邮箱、全名、姓氏或头像，你也可以随时删除这些数据。
以游客身份游玩
你的进度（进行中的对局、图鉴和历史记录）和设置只保存在这台设备浏览器的本地存储里。清除浏览器数据或使用无痕模式会让它消失。不登录也能完整地玩。游客不会加载 Google 登录脚本，也不会为登录、存档或分数访问我们的服务器。
游戏每次打开页面时会发送一次匿名的游玩计数；当你点“分享”并成功分享或复制成绩时，还会发送一次匿名的分享计数（只记录发生了一次分享，不含分享内容或分享到哪里；不用 Cookie、不带任何标识），详见 Xaplore 隐私政策。
如果你用 Google 登录
登录是可选的，目前只支持 Google，而且只用于云存档和每日种子排行榜。只有你打开登录面板时才会加载 Google 登录脚本。在 itch.io 的嵌入页面里不提供登录，请打开 push-to-prod.xaplore.dev 登录。
我们的服务器核验 Google 的登录凭证（签名、是否发给本游戏、是否过期）后，只保存：
- 账号编号：你的 Google 账号 ID 经单向 SHA-256 哈希后的值（不保存 ID 本身），以及账号的创建时间和最近使用时间。
- 昵称：默认是你的名字加姓氏首字母（例如“Guangya L.”）。你可以改成任意 2–20 个字符的昵称。它绝不会是你的邮箱或完整的姓氏。
- 云存档：你的图鉴（见过哪些牌和自动化工具）、历史统计（按浏览器里随机生成的设备 ID 分别记录，不是设备指纹）、最佳牌型和最远到达的迭代（Sprint），以及进行中的对局和它的操作列表，方便你在其他设备上继续。
- 每日种子对局：登录状态下完成的每一局每日种子，你的操作列表（保留下来以便重新核验成绩）、服务器用游戏自身规则重放后算出的结果（通过的回合数、发版得分、最佳牌型、到达的迭代，以及是试玩版还是完整版）、规则版本号和到达服务器的时间。每天每个版本只计第一次完成的对局。
- 登录会话：一个随机会话令牌的哈希值，最长保存 60 天。令牌本身放在名为
ptp_s的 HttpOnly Cookie 里，只发送给本游戏的/api，只用来保持登录。 - 防滥用计数：以 IP 地址或账号的哈希值为键的短期计数器，大约一天内删除。
不保存：你的邮箱地址、全名、姓氏和头像。你的设置（语言、音效等）只保存在你的设备上，不属于云存档。
公开内容：你的昵称、每日种子成绩和名次、最佳牌型以及参与天数，任何查看排行榜的人都能看到。
我们怎样使用这些数据
只用来保存云存档、显示排行榜和保持登录。没有广告，不出售或分享数据，不做用户画像，也没有与账号关联的统计分析。
由谁处理
- Vercel：托管游戏网页，并把
/api请求转发给游戏的在线服务。 - Cloudflare：运行在线服务（Workers）和保存上述数据的数据库（D1）。
- Google：提供登录。只有你登录时我们才会收到登录凭证。你的 Google 账号适用 Google 自己的隐私政策。
和所有网络服务一样，这些服务商可能会短期保留包含 IP 地址和浏览器类型的访问日志。
保存多久
- 登录会话 60 天后过期。
- 连续 2 年（730 天）没有使用的账号及其云存档和全部对局会被自动删除。
删除你的数据
打开游戏里的账号菜单，选择删除我的数据。这会立即删除你的账号、云存档和全部每日种子对局，并在所有设备上退出登录。当前浏览器里的进度会保留，除非你自己清除。也可以发邮件到 support@xaplore.dev。退出登录只结束会话，你的云存档和成绩仍会保留。
儿童
本游戏不面向 13 岁以下儿童。如果你未满 13 岁，请以游客身份游玩，不要登录。
变更
本政策如有变更，新版本会发布在本页并注明新的生效日期。
联系我们
support@xaplore.dev · xaplore.dev · Xaplore LLC，美国北卡罗来纳州