LAST UPDATED: SEPTEMBER 10, 2026

Privacy policy

This policy describes information used by Capybara Treasure Trails when you read the website, play as a guest, or use an optional account. For privacy questions, see About & contact.

Information used to run the game

Guest progress is stored in your browser's local storage. It includes your current adventure, position, dug patches, remaining digs and scans, and collection statistics. Guest play does not require an email address. Browser saves remain until replaced, deleted through browser settings, or removed by the browser.

If you create an account, the service stores your email address, explorer name, a salted password hash, a hashed recovery code, and saved progress. Your email identifies the account; it is not used to send password-reset emails because email recovery is not enabled. Signed-in progress is also cached in local storage on the device.

Essential cookies and security information

The account service uses a first-party cookie named trail to keep you signed in, with a maximum age of 30 days. Logging out clears that cookie and invalidates the session. The server stores a hashed session token and expiry time. It also records an IP address, attempt count, and a 15-minute restriction window to limit repeated authentication attempts. Expiry of a restriction does not itself erase the database record. Hosting providers may process technical request information to deliver and protect the site.

Google AdSense and advertising cookies

The homepage includes Google AdSense code. Google and its advertising partners may use cookies, identifiers, IP addresses, and browser or device information to serve, measure, and protect advertising. Advertising cookies can allow ads to reflect earlier visits to this and other websites. These data are not necessarily anonymous; identifiers and IP addresses can be personal data. Our play page, embedded game, and policy pages do not include the AdSense script.

Read how Google uses information from sites that use its services and Google's advertising information. You can manage Google ad personalization in My Ad Center and manage or remove cookies in your browser. Blocking cookies does not necessarily prevent all advertising or all technical data processing.

Your privacy choices and regional rights

Depending on your location and applicable law, including the GDPR and the CCPA as amended, you may have rights to access, correct, delete, or obtain a copy of personal information, restrict processing, object to certain uses, and withdraw consent where processing is based on consent. California residents may also have rights to opt out of a sale or sharing of personal information, including certain advertising uses, and to receive nondiscriminatory treatment when exercising their rights.

Where a regional advertising consent or privacy-choice message is displayed, use it to make or revise your selection. Browser controls and Google's ad settings provide additional choices but do not replace consent where legally required. Contact the site through the contact page for requests relating to account information. We may need to verify that the account belongs to you; do not send a password or recovery code. You may also contact your local data protection authority.

Purposes, storage, and retention

Account and save information is used to provide the optional account service. Session and authentication information supports security. Where applicable, these activities may rely on providing the requested service or legitimate security interests; advertising storage and personalization require consent where applicable law requires it. Google explains its own processing and legal bases in its linked policies.

The current account service uses a server database without an automatic account-deletion schedule or a self-service deletion button. Account information remains until removed by the operator or lost through a hosting reset. Server storage is experimental and may be temporary; do not treat account saves as a permanent backup. Clearing browser data removes local copies but does not delete server account information. Signing out likewise does not remove locally cached account saves.

Service providers and changes

Hosting and advertising providers process information under their own applicable terms and policies and may process it outside your country. This site does not include a separate analytics script in its current version. If features or data practices change, this page will be updated with a revised date.