What railmid
keeps

Ordinary localStorage, on the site's own origin. It never leaves the browser except where the table says so, it is not shared with anybody, and clearing site data removes all of it. No advertising cookie is set and none is read; the analytics library described below keeps an id of its own here too, and a development build keeps one more (a table of tuning values) that never leaves the browser either.

Eight things, in one database, and this is the whole list:

• An account — a random id and the moment it was made. No name column and nothing about you: what reaches it is a row in one of the two tables below.
• Your reserved handle — the string as you typed it, a folded form of it that is what collisions are decided on, and when it was claimed.
• Your passkeys — the public key, signature counter and enrolment moment for each one. A public key cannot be used to sign in as you, and the private half never leaves your device.
• Your email address and password, if your account has one — the address as you typed it, a lower-cased copy of it that is what two spellings of the same address are decided to be one on, and the moment it was made. The password itself is not kept and never has been. What is stored instead is a PBKDF2-HMAC-SHA-256 derivation of it over sixteen random bytes generated for your row alone, plus those bytes and the number of rounds it was run for. Nobody, including us, can read your password out of that row, and two people who happen to choose the same password do not produce the same one.
• Your sessions — one row per browser you have signed in on, holding a hash of the string that browser keeps rather than the string itself, and the two moments it was made and expires. They expire after thirty days, and an account keeps its newest eight.
• Any password reset you have asked for — one row per outstanding code, holding a hash of the code that was mailed to you rather than the code itself, which account it is for, and the two moments it was made and expires. A code works once and dies after thirty minutes; spending one removes its row and every other code outstanding on that account, and your account keeps at most three at a time. The code is in the message that carried it and nowhere else — not in a log, not on the wire the game is played over, and not in a match recording.
• Your rating — one number, how many rated duels are behind it, and when it last moved. It is what the ladder is drawn from, and it exists only once you have played a rated duel: two signed-in accounts, opposite each other.
• The matches you have played against other accounts — two things, kept apart. One row for the match: which way it ended, which side won, and whether it counted for a rating. Then one row for each seat a signed-in account held in it, naming that account id, the side it played for, whether that side won, and the points it moved. Nothing is written down for a match the bot was in, and a seat nobody was signed into has no row of its own.

No IP address, no user agent and no location is written against any of it.

It is the whole list for the accounts database. The one other thing this server writes down is the match tape, which is kept whether or not you have an account and is described below.

Open the game, press Account, and press Delete account. It asks once to be sure, and then removes the account, the handle it reserved, every passkey on it, your email address and the derived password beside it, every session, and every password reset code still outstanding — immediately and irreversibly. Your handle is free for somebody else the moment it returns, and so is the address: nothing is kept back to stop it being used again.

It is one press from inside a signed-in session and there is no form to fill in, no email to confirm and nobody to ask. A signed-out connection cannot delete anything, which is the same rule that stops anybody deleting yours.

Deleting the account takes your rating with it, so you leave the ladder the moment you press it. The rows for the matches themselves are kept, including the per-seat rows that name you: they hold a random account id that no longer belongs to anybody, and blanking it would rewrite the history of the people you played. There is nothing else left to join it to — no handle, no passkey, no session, no reset code.

Playing anonymously leaves no account on the server to delete, and clearing this site's data in your browser is the whole of it. The match tape is the exception either way: it is written for the match rather than for a player, so deleting an account does not delete the tapes of matches that account played, and they age out on their own.

Your handle. It is drawn on the seat you are in, on the arena list and beside anything you type in the arena chat, to everybody connected to the same server — which is what a handle is for. Chat is relayed live and kept nowhere a player can reach — but it is written into the match tape along with the rest of the match, so it is not gone the moment it scrolls off screen.

Your handle and your rating are also what the ladder is, if you are in the top hundred: a rank, the handle, the number and how many rated duels are behind it, on a public page anybody can open. It says nothing about when you played.

Nothing else about you is broadcast. There is no profile to open and no match history to look up, because there is not one to look up.

A match that a human sat down in is written down by the server while it runs. A match nobody sat down in — the bot playing itself in an empty arena — is not written down at all.

What a tape holds is what a spectator standing in that arena would have been sent, and nothing a spectator would not have been sent:

• The match — where everything stood, several times a second: the two champions, the minion waves, the towers, the shots and the score. It is the same stream the game draws from, which is why it can be played back as the match rather than as a video of it.
• The two handles in the seats, as they were when the match kicked off.
• The arena chat, as it was said.

Nothing private to a seat is in one. The stream a tape is cut from is the ownerless one — the same projection a stranger watching gets — so the things the server sends only to the player they belong to are not in it, and neither is your account, your session, your IP address or anything about your device.

It is stored as gzipped pieces in Cloudflare R2, under the match's own id, and a bucket rule deletes it after ninety days. Nothing reads it back yet: there is no listing, no link and nothing to press, in the game or anywhere else. If that changes — a replay you can watch, a link you can share — this page changes in the same release, which is the promise at the bottom of it.

This is the only address on railmid that is not a player's own way back into their account, and it is not about playing the game: it is the form on /sponsor, filled in by a company that wants to buy a placement. A player never sees it and never needs it.

What a sponsorship application keeps: the company name, the contact email it asked to be answered at, an optional link, the bid, anything written in the note, and the artwork that was uploaded. The row is written as applied, which means nothing in it is on any public screen — the artwork is not served to anybody until a person has looked at it and approved it. Looking at it is the one exception, and it is a person holding an administrator's key rather than a page anybody can open. The address the application arrived from is used to bound how many applications an hour one caller can make, and is not written down.

How long. An application that goes nowhere is deleted within twelve months; a sponsorship that runs is kept while it runs and for twelve months after it ends, because it is a record of a commercial arrangement. There is no automatic sweep behind that — a person deletes the row — and writing to the address you applied from is enough to have it deleted sooner. An application that is turned down is the one case that is not a wait: declining it deletes the artwork immediately, in the same moment, and there is no undo.

One thing a player should know about it. A sponsor bids for first pick of the players, and a pick is made against a reserved handle — so a handle at the top of the ladder can be picked without being asked, and the sponsor's mark would then ride that champion for the month. It is a mark drawn next to a name; nothing about the account, the email address it may have been made with or how it plays is given to the sponsor, and no money reaches the player. If that ever becomes something you can decline or be paid for, this page says so in the release that makes it true.

Two things count how the game is doing. Neither is joined to your handle, and only one of them knows anything about your account: if you sign in, the funnel below is told your account's internal id — a random string, not a name — so that two visits from two of your devices count as one person. That is the whole of it, and signing out puts it down again. The arena's own rows know nothing about either.

The funnel. The landing page, the game, the ladder and the sponsorship page load PostHog, on this site's own hostnames and nowhere else — the privacy page you are reading loads no script at all, and neither does the write-up. What the game itself reports is a fixed list of moments: the landing page opened, the game opened, a socket connected (or failed to), an arena joined, a queue asked for or given up, a seat taken, waiting past the cap, a connection refused, a first shot fired, a match finished, and whether this was a return visit. Five more are about accounts: that the account half of the handle card was drawn to somebody who has none, that this machine has nowhere to keep a passkey, that Register or Sign in was pressed, that the server refused that press (and which of its seven refusals it was), and that an account was made. Two more come off the sponsorship page: that it was opened, and that an application was sent from it. Every property on those events is a count, a duration or a fixed category — the device class, for instance, is one of three words. Your handle is on none of them.

Signing in. When you sign in, the funnel is told the account's own id — the random string this site generated when the account was made. It is not your handle, it is not a password, and it means nothing anywhere but here: presenting it proves nothing and reaches nothing. It exists so that a player who comes back on a second machine is counted as the same person rather than as a stranger, and so that "how far does a signed-in player get" is a question with an answer. It applies from the moment you sign in onward; what was recorded before that stays as it was, under the random device id below. Signing out, deleting the account, or a session that has expired all put it down again and go back to that device id, and signing into a different account on this browser puts the first one down before it picks the second one up. Playing without an account never sends it, because there is nothing to send.

Being honest about the rest of what that library does: on its own defaults it also records page views and clicks on the four pages it is loaded on, it keeps a random device id in this browser so that two visits can be counted as one person rather than two, and — like every request any website makes — the analytics request carries your IP address to it. Nothing here ever tells it a name: the single identify call in this codebase sends the account id above, and nothing else is ever sent with it — not your handle, not an email address, nothing you typed. Profiles are configured as identified-only, so a browser that never signs in never becomes one at all, and a browser that does becomes a profile keyed on that random id. Clearing this site's data resets the device id.

The arena's own rows. The server writes one row at each boundary an arena crosses — somebody entering it or leaving it, a pre-game lobby resolving, a match starting or ending. Every field on them is a count, a duration, a fixed category or a code: how many seats a human held, how long it lasted, which weapons, which side won. No handle and no account id is on any of them, and nothing on one could be joined back to either.

Two of those fields are geographic, and only a row about a connection carries them: the three-letter code of the Cloudflare datacentre the socket landed in, and the two-letter country it came from. They are there because where a player terminates and where they are turned out to disagree constantly, and the game is unplayable at the wrong distance. A country is a closed list of 249 codes shared by tens of millions of people; the finer geography Cloudflare offers with it — city, postcode, coordinates — is used to pick a server while the request is being handled and is never written down.

PostHog is the one third party this site talks to about you at all — the only others are a font host and Cloudflare, which serves the game. There is no ad network and no cross-site tracking.