Privacy

Project Overrun keeps as little as a live game needs, and deletes it a week later.

No accounts: You join with a code and a display name. We never ask for an email, a password or a real name.
What is stored: Each game room stores its settings (including the seed that deals the cards), the display names typed in and when each player joined, the game’s moves with their times, and scrambled (hashed) copies of the host key and seat tokens, never the keys themselves. Nothing else.
Where: Only in that game room on the server. Your phone keeps a seat token for that game, and the last name you typed, in its own storage so a reload puts you back in your seat; the table screen keeps the host key the same way. Clearing the site’s data in your browser removes them.
How long: A room and everything in it is deleted 7 days after its last move, join or facilitator control.
Game records: Once the game is over, the host can download the game record (the settings, the moves and their timings, with players shown as “Player 1”, “Player 2” and so on, never by name) for a playtest debrief. Once downloaded, it is theirs to keep or delete.
Server logs: The site runs on Cloudflare. To stop abuse, the server counts new games per IP address for a minute, and Cloudflare keeps short-lived request logs (errors and request details, not display names or moves) under its own privacy policy.
No tracking: No analytics, no advertising, no cookies for tracking, and no requests to anyone else: fonts and images are served from this site.