Privacy: what we keep

Last updated 1 November 2026

Tenth Bell is run by Michael Bondi, sole proprietor, PO Box 462, Shrewsbury, MA 01545, USA, who is the controller of the personal data described here. Write to support@thetenthbell.com about anything on this page. There are no ads and no tracking cookies, and every act plays without signing in.

What we keep, why, and for how long

Without signing in. Your saves live in your browser. If cloud backup is on, a copy of each save is kept on our server under a random device id (a cookie) and a recovery code, so you can get your game back. Nothing else about you is stored, apart from the anonymous visit counts and play stats below, which aren't about you either. We rely on our legitimate interest in keeping your game safe, and we keep it until you delete your saves or ask us to remove them.

If you sign in. We keep your email address and your cloud saves, so your game follows you to other devices. We use the address to send you sign-in emails. This is needed to provide the account you asked for (contract). We only email you about new acts if you tick that box yourself (consent, which you can withdraw in Options or from any of those emails). We keep this until you delete your account.

The email list. You can join the list from the About page without an account. We keep your email address, when you asked and when you confirmed, and use it only to email you when a new season is out. We first send one email with a link; you're on the list only once you press it, and a request you never confirm expires after three days and is then deleted. The link is stored only as a hash. This is your consent, which you can withdraw with the unsubscribe link in any of those emails; unsubscribing deletes our record of it (Resend, who sends our emails, keeps the address marked unsubscribed, so the list never emails it again unless you join again). Deleting an account with the same address deletes it from the list too.

Visit counts. Cloudflare Web Analytics counts page views: the page, the site that linked you, your country and device type, and how fast the page loaded. It sets no cookie, stores nothing on your device, and doesn't identify you or follow you across sites. We see only the totals, in Cloudflare's dashboard, and keep no copy. We use them to see what people read and whether the game loads quickly (legitimate interest).

Play stats. While you play on this site, the game counts a few moments so we can see where players stop and tune the game: an act started, a checkpoint on an act's main path reached, the party falling in battle, the page closed or hidden during a battle, and an act finished. For the first hour of play it also counts a new game's first fight and first random fight, a story scene's opening words, title card or animation skipped (and which scene), the fight at the bridge checkpoint on the Hollow Road begun and each time the party falls there, and, after you press Continue, how many seconds pass before the story gives you your next objective. Each count carries only which moment it is, the act number, which checkpoint, scene or fight (where it names one), the seconds (for the Continue count), and which version of the game sent it. When the page is hidden or closed, one more count says how many times since the last such count the music had to skip ahead, pause while the tab was hidden, or wait over a third of a second to start, with the act and the version; if it had to do none of these, nothing is sent. Nothing else: no account, device or player id, no cookie, no name or address, nothing you typed, and nothing that ties one count to another or to you. Your IP address is used for up to a minute to stop floods of counts, and is never stored. The counts go to Cloudflare Workers Analytics Engine, which keeps them for three months; we see only totals (legitimate interest).

Ledger counts. Each act has a few quiet choices, the ones its end card lists (whether you fed the deserter on the Hollow Road, say). When you finish an act, the game also counts the choices you made in it, so we can show players how everyone else chose on the Ledger of Vael, where a choice appears only once at least 100 players have made it. Each count carries only the act, the choice, which way you went and which version of the game sent it, and on our server it only adds one to that option's running total: not the version, no time, no account, device or player id, no cookie, and nothing that ties one choice to another. Choices you never made aren't counted. The totals are kept in our database on Cloudflare for as long as the game runs (legitimate interest). Your IP address is also used for up to a minute to stop floods of counts, as for play stats. Unlike play stats, the Ledger keeps one more thing, so that one person can't stuff it: each network counts once per choice a day, so we keep a hash of your IP address (for IPv6, of its network part) with the act and which choice it was, but not which way you went. It stops counting after one day and is deleted the next time the server clears expired counts. Players sharing a network who make the same choice on the same day count once.

AI-written extras. The game can include small pieces of extra text (rumors, lore, the Emperor's words) written by an AI model and checked before they appear. The combined totals above may shape what it writes. Nothing about you goes to the AI: no saves, no account, device or player details, and nothing you typed.

None of these counts are sent from the itch.io or desktop versions. To turn off play stats and Ledger counts, open Options and set Play stats to Off; your browser remembers the choice.

Who else receives it

We never sell your data. Some of these providers process data outside your country; where the law requires it, they do so under standard contractual clauses or an equivalent safeguard.

Links to other sites, such as the game's Discord, Ko-fi or Bandcamp pages, take you to those sites. What they collect is up to them, under their own privacy policies.

Cookies

We set one cookie: a random device id that holds your cloud saves and, if you sign in, keeps you signed in. It is needed for those features to work. No advertising or analytics cookies, ever: the visit counts, play stats and Ledger counts above use none.

Your rights

Depending on where you live, you can ask to see, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent at any time. Write to us and we'll answer within one month. You can also complain to your local data protection authority.

To delete everything yourself: in the game, open Account (on the title screen or in the Save menu) and choose Delete my account. Your email address, your cloud saves and your recovery code are deleted at once. Saves in your own browser stay until you clear them.

Security

Abuse limits. To stop scripts flooding the game's server, a few requests are counted per network for one hour: asking for a sign-in email or joining the email list, starting a new device for cloud backup, and trying a recovery code. Each count is kept under a hash of your IP address (for IPv6, of its network part), never the address itself. It stops counting when its hour is over and is deleted the next time the server clears expired counts (legitimate interest). The Ledger's once-a-day check, above, is the only one that counts for longer, a day.

Everything travels over HTTPS. Sign-in codes and links are single-use, expire after 15 minutes and are stored only as hashes. Access to the data is limited to running the game.

Children

Tenth Bell is rated Mature 17+ and isn't meant for children. We don't knowingly collect data from anyone under 16.