Privacy policy
Ember Abyss is a free browser game by Xaplore LLC. This page explains, in plain words, what is stored when you play, why, and how to delete it. Effective October 18, 2026.
Short version: you can play without an account, exactly as before, and nothing about you leaves your browser. If you choose to sign in with Google, we keep your characters on our server so they are safe across devices and browsers and if your browser data is cleared. We never store your email, name or photo, and you can delete your cloud data at any time.
Playing as a guest
Your characters and settings are saved only in your browser's local storage on your device. Clearing your browser data, or private browsing, removes them. You can export a character to a file and import it elsewhere yourself. The game sends one anonymous play count per page load (no cookies, no identifiers), as described in the Xaplore privacy policy. The Google sign-in script is not loaded for guests; it loads only when you open the sign-in panel.
If you sign in with Google
Signing in is optional, and Google is the only option for now. Google sends the game a signed sign-in token; our server checks it (Google's signature, that it was issued for this game, and that it has not expired) and then stores only:
- Account: a one-way SHA-256 hash of your Google account ID (not the ID itself), and when the account was created and last used.
- Session: a hash of a random session token and its expiry (30 days). The token itself lives in an HttpOnly cookie named
ea_sthat is sent only to this game's/apiand is used only to keep you signed in. - Your characters: the game data for each character (the name you chose, class, level, items, gold, progress and play time; up to 6 characters, at most 256 KB each), with a revision number, the last-updated time and a random ID for the browser that saved it. That ID is created by the game, not a fingerprint of your device.
- Abuse limits: short-lived counters keyed by a hash of your IP address or account, deleted within about an hour.
Not stored: your email address, name and profile picture. The masked email shown in the account menu (for example gy•••@gmail.com) is worked out at sign-in and kept only in your own browser.
Your browser also keeps a small sync record in local storage: a revision and a content check for each character, the random browser ID, and the masked email. It lets the game tell which copy changed, so it never overwrites a character silently.
How we use it
Only to save and restore your characters and keep you signed in. No ads, no selling or sharing of data, no profiling, and no analytics tied to your account.
Who processes it
- Cloudflare runs our server (Workers) and database (D1) that hold the data above. Like any network provider it may keep short-lived request logs that include IP address and browser type.
- Vercel hosts the game and forwards
/apirequests to Cloudflare. - Google provides sign-in. We receive the sign-in token only when you sign in. Google's own privacy policy applies to your Google account.
How long we keep it
- Cloud saves are kept while you use your account.
- When you delete a character while signed in, a small marker without any character data stays so your other devices remove it too.
- Sessions expire after 30 days. Accounts unused for 2 years are deleted automatically, with all their saves.
Deleting your data
In the game, open the account menu and choose Delete my cloud data. This immediately deletes your account, your sessions and every cloud save. The copies in your current browser stay unless you delete them yourself. You can also email support@xaplore.dev. Signing out ends the session and keeps a local copy of your characters in that browser.
Children
Ember Abyss is not directed at children under 13. If you are under 13, please play as a guest and do not sign in.
Changes
If this policy changes, the new version will be posted here with a new effective date.
Contact
support@xaplore.dev · Xaplore LLC, North Carolina, USA