Privacy

Updated October 11, 2026

XStory is a small game run by Joel Panchevre in San Antonio, Texas. This page says what the game stores about you. It is short because there isn't much.

What you give us

• The name you type when you join. It is up to 16 characters and everyone in the room can see it. Don't use your real name if you don't want to.
• If you choose Verify with X: the link to a public post you made on X. We read that one post to confirm the short code is in it and that it came from the handle in the link. That is all we read.
• What you type in chat. Everyone in the room sees it. The room keeps the last 30 lines in memory so people who arrive can catch up. Chat is not saved to a database.

What we save

• Your character: name, class, level, EXP, HP, MP and items. It sits in its own small SQLite database on Cloudflare's servers, one per character, so your progress follows you from room to room. Only one room can hold your character at a time: if you join another room, the first one lets you go.
• A random token ties your browser to that character. The token itself stays in your browser (localStorage). It never leaves your browser except to join a room. The server only keeps a hash of it, so we can't read your token back. That hash is also the name of your character's database.
• Rooms made before this change may still hold an old copy of your character. Those copies are no longer updated and are deleted after 30 days.
• A character that hasn't been played for 30 days is deleted.

If you verify with X, we also keep:

• Your X handle, the display name shown on your post, and the date you verified. They sit in a small database on Cloudflare. Your character then lives under your handle, so it follows you to other devices.
• The short verification code and a hash of the one-time key that goes with it. They are deleted within an hour.
• A scrambled copy of your IP address (a salted hash, never the address itself; for IPv6 only the first half, the /64 your provider gave you) so we can limit how often one network can ask for codes, check posts, or make rooms. It is deleted within an hour.
• A sign-in counter for your handle. "Sign out" raises it, which signs you out on every device at once.

If you make a room with Make a room, we keep the room name, a hash of its owner key (never the key), the X handle that posted it, and whether the host locked it. A room nobody posts within an hour is released. When a host removes a player, we keep that ban (the character, a hash of their token, and their network address for two minutes) in the room's database for ten minutes.

What stays on your device

• Your last name, so the name box is filled in next time.
• One random token for each room you've played in.
• Only if you verify with X: one cookie named xs_id. It holds a signed sign-in token, lasts 30 days (it renews while you keep playing), and is HttpOnly, Secure and SameSite=Lax. Scripts on the page cannot read it, and nothing is kept in localStorage for it. Sign out on the name screen and it is removed everywhere.
• If you make a room: one cookie named xs_own_<room name> with the owner key, lasting 30 days, also HttpOnly, Secure and SameSite=Lax. You manage the room from this browser only; clearing your cookies hands that up.
• Without verifying or making a room, XStory sets no cookies. Clear your site data and the guest tokens are gone, which means those guest characters are no longer yours.

Your IP address

We use it to stop abuse: how fast one address can load pages, how many connections it can open to a room, and how many new characters it can make in ten minutes. Those limits live in memory and expire. We never write a plain IP address to our database and we don't tie one to your name. The only trace of it is the scrambled hash described above, which is deleted within an hour.

XStory runs on Cloudflare. Cloudflare sees your IP address when it delivers the site and keeps its own standard logs under its own privacy policy.

What we don't do

• No ads.
• We don't sell or rent your data to anyone.
• We don't run analytics or tracking scripts. Everything the page loads comes from xstory.party, fonts included. Cloudflare may count traffic on its side.
• No passwords and no sign-up form. "Post it on X" and "Post on X" open X's own compose window with text already filled in. You press the button on X yourself.
• We never ask for your X password, and we have no access to your X account. There is no X login, no OAuth, and no X developer app. We read one public post, the one you link to, and nothing else on your profile.

Kids

XStory is meant for people 13 and older. We don't knowingly collect anything from younger kids. Chat is open to the whole room, so don't share personal details in it.

Getting something removed

Characters expire on their own after 30 days. To remove a verified handle and its character, email support@xstory.party from any address and name the handle. For anything else, or if you think someone posted your information in chat, email the same address. We may need the room name and character name to find it.

Changes

If this changes in a way that matters, the date at the top changes too.