Idleholt Privacy Policy
Last updated: October 10, 2026
Who runs Idleholt
Idleholt is a browser game at idleholt.com. It is run by Idleholt ("we", "us"). You can reach us at Idleholt ([email protected]).
In short
- You need an account to play. We keep your email address, your chosen name, and your game progress.
- Other signed-in players can see your name, your skill levels on the hiscores, and what your character is doing in Holtgrove.
- Chat is passed on to the players who are online and is not saved.
- We use two sign-in cookies and no advertising or analytics cookies. The game loads no third-party scripts, fonts, or trackers.
- We do not sell your data and we do not show ads.
- Today Idleholt has no payments, no subscriptions, no ads, and no third-party analytics. We collect no payment information.
What we collect and why
When you sign in with an email link
You give us your email address. We store it with a one-time sign-in link that works for 15 minutes, and we ask our email provider, Resend, to send you that link. The email contains only the link and a short note. We keep the address on the link record even if you never use the link (see how long we keep data).
When you sign in with Google
If Google sign-in is offered, we ask Google for the openid,
email, and profile permissions. From what Google returns
we keep only your email address and Google's account identifier for you. We check
that Google has verified the address. We read your Google name but do not store
it, and we do not read your profile picture or anything else. We do not keep
Google access or refresh tokens and cannot act on your Google account. If your
verified Google address matches an existing Idleholt account, the two are joined
into one account.
Your account
- Email address: to sign you in and to tell accounts apart.
- Google account identifier, if you used Google: to recognise you next time.
- Display name: the name you pick (3 to 12 characters). Other players see it. It must be unique and cannot be changed after you pick it.
- A random account ID, the time your account was created, and, for accounts that used the old (now removed) save import, when it was used.
Your game progress
The game saves your progress to our servers about once a minute and when you leave the page: your skill experience and levels, inventory, bank, coins, axes, where your character stands, and what it is doing. We record when each save arrives.
Anti-cheat records
Each save is checked against how much experience the time since the last save could have earned. If a save claims more, the extra is not accepted, and we keep a record of the skill, the experience claimed and accepted, the time between saves, and when it happened.
Sign-in limits and IP addresses
To stop abuse of sign-in emails we count requests per email address and per IP address over 15-minute windows. We store these counters under a one-way hash (SHA-256) of the address, not the address itself, and delete them after the window ends. We do not otherwise store IP addresses in our database.
Sessions
When you sign in we create a session that lasts 30 days. We store only a hash of the session key, which is kept in a cookie in your browser.
Information our hosting provider handles
Idleholt runs on Cloudflare. Like any web host, Cloudflare receives your IP address and standard request information (such as browser type) when you visit, and processes it to host the site, run its network, and protect it from attacks and abuse. We do not use any third-party analytics.
What other players can see
- Hiscores: signed-in players can see the top 50 players for each skill, with each player's display name, experience, and level. You appear once you have a name and some experience.
- In Holtgrove: players online at the same time see your display name, your character's position, whether it is idle, walking, or chopping, and which axe it holds. Their game also receives your random account ID, which it uses to tell players apart.
- Chat and emotes: what you say is sent with your name to everyone online. We do not store chat. Players who join later do not see earlier messages.
Your email address is never shown to other players.
Cookies and browser storage
| Name | Type | Purpose | Lasts |
|---|---|---|---|
holt_session |
Cookie (HttpOnly, Secure, SameSite=Lax) | Keeps you signed in. | 30 days, or until you sign out |
holt_oauth |
Cookie (HttpOnly, Secure, SameSite=Lax), only on the Google sign-in path | Protects Google sign-in from forgery while it is in progress. | 10 minutes; removed when sign-in finishes |
Idleholt is played online only, and your progress is kept only on our server. The
game keeps no copy of it in your browser's local storage. Older versions kept one
(idleholt-save and idleholt-save-owner); the game
deletes them the next time it loads. The game has no advertising or analytics
cookies, and it does not install a service worker.
Who else handles your data
We use these providers to run the game. They process data for us:
- Cloudflare hosts the website, runs the game servers, and stores the database (Cloudflare Pages, Workers, D1, and Durable Objects).
- Resend sends sign-in emails. It receives your email address and the sign-in link.
- Google handles Google sign-in if you choose it. Google's own privacy policy covers what happens on Google's pages.
We do not sell or rent your data, and we do not share it for advertising. Your data may be processed in the United States and in other countries where Cloudflare, Resend, and Google operate.
Emails
We only send sign-in links, when you ask for one. We never send marketing email.
Payments
Today: Idleholt is free to play. It has no payments, no subscriptions, no ads, and no third-party analytics, and we collect no payment information. The coins in the game cannot be bought.
Planned: we plan to offer optional premium features in the future. They are not available now. Before any paid feature is offered, we will update this policy to explain what payment data is collected, who handles it, and how long it is kept.
How long we keep data
| Data | How long |
|---|---|
| Sign-in links (with your email address) | Usable for 15 minutes. Removed by a routine clean-up some time after they have been expired for 24 hours. |
| Sessions | 30 days. Removed when you sign out, or by the clean-up after they expire. |
| Hashed sign-in counters | 15-minute windows. Removed by the clean-up after the window ends. |
| Account, game progress, hiscores, and anti-cheat records | Kept until you ask us to delete your account. Nothing deletes them automatically. |
| Chat and positions in Holtgrove | Not stored. Passed on to the players online at the time. |
The clean-up runs from time to time when sign-in emails are requested, so expired records may stay a little longer than the times above.
Your choices
- Sign out at any time from the side panel. This ends the session on our side too.
- Start over: the game has no button that resets your progress. Email Idleholt ([email protected]) if you want a fresh start, and we will reset your progress and hiscores by hand. It does not delete your account.
- Delete your account: the game has no delete button yet. Email Idleholt ([email protected]) and we will delete your account, progress, hiscores, and anti-cheat records by hand within 30 days. Sign-in links and sign-in counters are not tied to your account; the clean-up above removes them.
- Get a copy of your data, or correct it: there is no export button. Email the same address to ask for a copy or a correction.
- Your display name and email address cannot be changed in the game. To ask for a correction, email us.
Legal bases and your rights
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:
- Contract: your account and your game saves, including sign-in, sessions, the hiscores, and showing you to other players, because they are needed to provide the game you signed up for.
- Legitimate interests: anti-cheat records and sign-in limits, to keep the game fair and protect it from abuse.
You have the right to access your data, to have it deleted, and to object to our use of it based on legitimate interests. To use these rights, email Idleholt ([email protected]). You also have the right to complain to a data protection regulator.
California notice
We do not sell or share your personal information. We collect these categories of personal information:
- Identifiers: email address, Google account identifier (if you use Google), random account ID, display name, and IP address (stored only as a short-lived hash for sign-in limits, and handled by Cloudflare as our host).
- Game activity: game progress, hiscores, anti-cheat records, and your character's position and actions while you are online.
To ask to know, delete, or correct the personal information we hold about you, email Idleholt ([email protected]).
Security
Sign-in links and session keys are long random values, and we store only their hashes. Sign-in cookies cannot be read by page scripts and are only sent over HTTPS. Requests from other websites to our game's API are refused. No system is perfectly secure, so please tell us if you find a problem.
Children
Idleholt is for people aged 13 and over. The game does not ask for your age. If we learn that a child under 13 has an account, we will delete it.
Changes to this policy
If our practices change, we will update this page and the date at the top.
Contact
Questions about this policy: Idleholt ([email protected]).