Cordon Authority · records and disclosure

Privacy

There is no account here. There is a random number in your browser, a row in a table when a page is served, and a suburb that deletes itself three days after the last person stops playing it. This page is all of it.

Last updated 2026-08-05

Notice

“Persons inside the wire are recorded by number. The Authority does not hold your name. You were never asked for it.”

This site sets one cookie, called sd_sid. It is written the first time you load a page here and never by anything else.

Its value is sixteen random bytes, written out as thirty-two characters. It encodes nothing — not a name, not an address, not a time, not a device. Two requests are known to be the same visitor only because the browser sent the same number back.

That number is your account. Which worlds you are in, which world you host, which characters are yours: all of it hangs off it, and there is nothing behind it. No email, no password, no way to prove a character was yours other than being the browser that holds the number.

It is HttpOnly — scripts on the page cannot read it.
It is SameSite=Lax, and Secure, so it only travels over HTTPS.
It is scoped to suburbandead.com and no other host. That is why www and the hosting provider's own address redirect here: one name, one cookie.
It lasts 365 days from the day it was issued. Coming back does not extend it.

It is also what the rate limiter counts, so that a household sharing one connection is not throttled as though it were one person.

What a visit writes down

When a page is served, one row goes into a table on the server. It has ten columns and these are all of them.

Column	What is in it
row	A number that counts up, so that two things happening in the same millisecond can still be put in order.
time	When the row was written, by the server's clock, in milliseconds. Nothing is read from your clock and no timezone is stored.
session	The cookie number above. The only column that ties two rows to the same browser.
event	Which step this was, from a list of six: a page served, a link clicked, a world created, a world joined, a run started, a character rolled.
detail	One short qualifier — the id of the link, `solo` or `shared`, `drill` or `holdfast`, which class. Never a character name, a world name or a join code.
src	The campaign tag off the end of a link you arrived on, like `reddit`. Empty on nearly every row. Nothing else from the query string is kept.
referrer	The page your browser said it came from, if it said anything, to 200 characters — whole, including any query string it carried. Usually another page here; for a link from somewhere else, most browsers send only the site and not the page.
path	The path you asked for — `/`, `/wiki/food.html`. The query string is not part of it.
bot	A 0 or a 1: whether the request looked like a crawler at the time. A guess, made from the line below.
agent	The browser and operating system string your browser announces to every website it visits, to 200 characters. Kept as it arrived, not parsed and not matched against anything.

A row like that was written for the page you are reading now. There is no way to serve a page without knowing a page was served; the honest thing is to show you the shape of the record.

The one thing the page itself sends is a click: when you take a link that is being counted, the browser posts the name of that link. It is the only step the server cannot see for itself. Nothing in this table is ever served back to a browser — there is no page and no route that reads it.

What is not collected

No IP address is stored by this game. Not in its database, not in its own logs, not anywhere it writes to disk. The only place an address exists at all is the rate limiter, and only for a request that arrives with no cookie yet: it becomes a key in a table in memory that is emptied whole every sixty seconds, and it is never written down.
No location and no fingerprinting. No country lookup, nothing asking your browser where you are, no canvas or font tricks. The browser string is stored as it arrived and combined with nothing.
No third-party anything. No analytics service, no tag manager, no error reporter, no advertising pixel. Every script on this site is served from this site.
No fonts or files from elsewhere. Every typeface here is one already on your machine, and every stylesheet, picture and sound comes off this server. Loading a page here makes no request to any other host at all.
No accounts, no email addresses, no passwords, no mailing list. There is nowhere on this site to type an email address. Three of the things you can type are stored: a character name, a world name and a join code. The fourth — the field manual's search box — is answered inside your browser, out of a file it already downloaded, so what you typed there is never sent anywhere and there is nothing of it to keep.
Nothing goes out. The server makes no outbound request to anyone.

One honest caveat, because the opposite claim is the sort of thing sites say and cannot mean: this game does not store your address, but the request had to cross a network to get here, and a network that carries a request necessarily sees where it came from. That is true of every website you have ever loaded. What this page can tell you is what the game itself keeps, and the answer there is nothing.

How long it is kept

The cookie: 365 days from the day it was issued, and returning does not push that back. Clear your cookies and it is gone at once; the next visit mints a fresh number with nothing anywhere connecting it to the old one.
A world and everything in it: 72 hours after the last time anyone played it. The file is deleted from the server, and the character names, positions, inventories, news and chronicle inside it go with it. A world whose run is still standing is left alone while the run is live — seven nights is seven evenings of somebody's week, and a quiet Tuesday is not abandonment.
A world you all leave: immediately. When the last person walks out of a shared world — or the host leaves a solo one — the file is deleted in that same moment, and the record of who was in it goes with it.
The rows above: no timer. This is the plain and slightly awkward one. Nothing deletes them on a schedule. The table holds a cap of 50,000 rows and drops the oldest first when it is reached, and at the traffic this site expects it will not be reached — so in practice they are kept until somebody deletes them by hand.
The rate limiter's table: sixty seconds, in memory, never on disk.

What other people in your world can see

Three pieces of text you type are stored on this whole site. There is no chat, no profile, no bio and no message system.

The world name, up to forty characters, or Fenwick if you do not type one. Everybody in that world sees it, and so does anyone you hand the join code to. It is also the one thing a player types that appears in the server's own log — two lines, one when a world goes to night with its host absent, one when it is deleted.
Your character's name, two to twenty-four characters. Everybody in that world sees it: on the roster, in the news the district generates, and in the chronicle anyone in the world can read.
The join code — WORD-WORD-NN, made by the server, not by you. It is built to be read aloud and posted in public. Anyone holding it can join a shared world and see its name, its roster and its chronicle. That is what an invite is.

What is never shown is which session a character belongs to. A roster is names, not credentials. Solo worlds cannot be joined at all, there is no public directory of worlds or players anywhere on the site, and asking the server for a list of worlds returns only the ones your own cookie is already in.

Where it is kept

One machine, in London, rented from Fly.io, with one disk attached to it. On that disk: the table of rows above, a registry of worlds — ids, join codes, world names, and the session numbers of who is in them — and one file per world. Everything travels over HTTPS.

Two parties touch any of it. The person who runs the site, who reads the counts; and Fly.io, who run the machine, the disk and the network in front of them, and who collect what the application prints. Your request reaches their proxy before it reaches this game — that is what a proxy is — so they necessarily handle the address it came from, and they keep their own records of the traffic they carry, on their terms and not ours. This page can only speak for the game. Nobody else touches it: no analytics vendor, no content network, no advertiser, nothing embedded from anywhere.

What your browser keeps to itself

The game also stores a few things in your own browser that are never sent to the server: the last world and character you had open, whether you have seen the intro, whether the narrator's voice is on, and whether one panel was folded away. They live on your machine, they are read by nothing else, and clearing site data clears them.

Clearing it

Clear cookies for suburbandead.com and this site stops recognising you. The rows it already wrote stay where they are — there is simply nothing left that connects them to you, or to the fresh number your next visit mints. So do your worlds: the number is the claim, and there is no email to recover with, no password and no support desk that can put it back. That is the trade for never being asked who you are.

If you want a world gone now rather than in three days, leave it. When the last person walks out, it is deleted with them.

In short

One cookie, sd_sid: a random number, 365 days, and the whole of your account.
One row per page served: the time, that number, which page, where you came from, and the browser string your browser tells every site.
No IP addresses, no location, no accounts, no third-party scripts, and nothing loaded from any other host.
Worlds delete themselves 72 hours after the last person plays, or the moment the last person leaves. The rows have no timer on them.
People in your world see the world name and the character names typed into it. Nobody sees whose session is whose.