Privacy

Last updated October 13, 2026

Soggy Boats is a free, open source paper boat game at www.soggy.boats. This page explains what the game keeps on your device, what it sends online, and how to remove it. The source code is public, so you can check all of this against the code.

No ads, analytics or cookies

Soggy Boats shows no ads and runs no analytics. The game sets no cookies and does no tracking.

What stays on your device

Your game progress stays on your device. The game saves it in your browser's local storage under the key paperboat:v1:

• level progress, best times and the steering inputs of your best runs
• settings: theme, sound, reduced motion and the FPS counter
• your gems and the riders you own
• the This device boards for endless and speedrun, and your speedrun splits
• a random four-digit guest number such as Guest 1234, picked once on this device, and your username if you sign in and choose one

When you play online, a second key, paperboat:auth:v1, holds your account id and the sign-in tokens Firebase issues, so you stay signed in. Signing out deletes those tokens from your device.

Race mode keeps its own keys. paperboat:racer:v1 holds your Race best times with a replay of your controls, your best checkpoint times, the medals already paid out, your pre-race choices and Race settings. paperboat:racer:tracks:v1 holds the tracks you build, up to 50. A shared track link carries the track and its author time in the part of the address after the #, which your browser never sends to a server.

If your browser blocks storage, the game keeps your progress in memory until you leave the page.

To remove everything on this device, clear this site's data in your browser. In the game, Settings, Reset progress clears level progress, gems, riders, the device boards and everything under paperboat:racer:v1, and keeps your game settings, guest number, username and the tracks you built.

Online play

The Endless and Speedrun screens have Everyone boards that rank players online, and you can sign in with an email address or a Google account. Online play talks to Firebase, a set of Google services:

• The first time you open an Everyone board, finish an endless run, finish a speedrun or open Multiplayer, the game creates an anonymous guest account for this device in Firebase Authentication. Guests show up as Guest 1234.
• If you create an email account, Firebase Authentication keeps your email address and a hash of your password. The game itself never stores your password.
• If you sign in with Google, Firebase Authentication keeps your Google account identifier, along with the basic profile details Google shares at sign-in, such as your email address and name.
• Cloud Firestore, Firebase's database, keeps a player row with your username or guest number, your best endless distance, the account id Firebase assigns and when the row last changed. It also keeps one row for every endless run, with its distance and the date and time.
• For speedruns it keeps the same name, your best time with its per-level splits, and one row for every finished speedrun with its time, splits, date and time.
• In Race mode, when you finish a track as fast as or faster than your best on this device, Cloud Firestore keeps your name, your time, your checkpoint times and a replay of your controls on that track (steering, gas, brake, drift and respawn presses), so other players can see your time, race your ghost and check that it is real. A private list of the tracks you have times on is kept too, so deleting your online data can find them all. Runs played in a test session with ?debug are never uploaded.
• If you open Multiplayer, Firebase Realtime Database keeps short-lived race data: a row for you in your party (your name, your rider, when you joined and when your game last checked in), a row in each race lobby you join, the lobby's starting list of names and riders, your vote for the race map, the steering, hop and duck inputs your boat sends during a race so the other players' games can show your boat, and one server time value used to start races together. Your game deletes your party and lobby rows when you leave, and your race inputs a minute after the race. Lobbies older than 30 minutes are removed the next time anyone opens Multiplayer, and a party removes rows that stopped checking in.

The game's own records in Firestore and the Realtime Database never contain your email address or anything from your Google profile.

Google provides Firebase and processes this data to run it. See Firebase's privacy and security page.

Before the sign-in options appear, the game asks for your birth year once on this device. Only then, if you are old enough to sign in, does Google's sign-in script load from accounts.google.com to show the Sign in with Google button. Google runs that script under Google's privacy policy. The game keeps the result of the age question on this device only, under the key paperboat:age:v1, and never sends it anywhere.

Soggy Boats for iPhone, iPad and Android

The iPhone, iPad and Android apps are built from the same game code as the website. In the apps:

• The game saves your progress and settings on your device, inside the app, under the same keys as on the website. The app also keeps a copy of everything the game saves, including your sign-in session, in a file in its own storage, so your progress survives if that storage is cleared. Your phone's backups (iCloud or computer backups on iPhone and iPad, automatic backup on Android) can include that file and the app's storage.
• There is no Sign in with Google button, so the apps never load Google's sign-in script. You can play as a guest or sign in with an email address.
• Guest accounts, email accounts and the Everyone boards work the same as on the website and keep the same data in Firebase, as described under Online play.
• Deleting the app removes what it saved on your device, but a phone backup can bring it back, including a sign-in that is still valid, when you reinstall the app or move to a new phone. Deleting the app never removes your online records. To delete those, see Deleting your online data below.
• On iPhone and iPad, while the app is open it checks about once a minute whether it can reach the internet by requesting an empty page from Google (clients3.google.com/generate_204). Nothing about you is sent beyond the network address every request carries.

Apple and Google deliver the apps through the App Store and Google Play under their own privacy policies.

Children

Anyone can play Soggy Boats, including online as a guest. Guests get a random name such as Guest 1234 and never give an email address or a name. Signing in with email or Google is for players 13 and over, so players under 13 stay guests. If you think a child under 13 has signed in, email hello@soggy.boats and we will delete that account and its online data.

What other players can see

Other players can see your name, your best endless distance, and your best speedrun time with its splits, along with the random account id Firebase assigned and when your row last changed. The Everyone boards list names and best scores. In Race mode they also see your best time on each track with its checkpoint times, and the game downloads your replay to check it and to show it as a ghost. Your individual run rows can be read only by your own account. In Multiplayer, players in your party or your race see your name and rider and watch your boat sail. Pick a username you are happy for everyone to see. Names that are rude or look like contact details, such as a link, an email address or a phone number, are turned down, and any player can report a name or hide a player from their own boards.

Deleting your online data

Reset progress and clearing site data only change this device. Your online records stay until you delete them.

To delete them, use the button in the account row on the Endless or Speedrun screen. It reads Delete account when you are signed in with email or Google, and Delete online data when you play as a guest. Either one removes your online data first and then your account. If your sign-in is too old for Firebase to remove the account right away, the game tells you: an email or Google account signs in again right there, with its password or with Google, and the account is then removed, and a guest's sign-in record, which holds no name or runs, stays with Firebase. Signing out on its own deletes nothing online.

Forgot the password for an email account? Use Forgot password in the email sign-in form to get a reset link by email.

Can't use the game, or want us to do it for you? Email hello@soggy.boats from the address on your account, or tell us your username or guest number, and we will delete your online data and account. The delete account page walks through both ways.

Hosting

Vercel hosts www.soggy.boats. Like any web host, Vercel processes standard request data, such as your IP address and your browser's user agent, to deliver the site and protect it from abuse. It does this under Vercel's privacy policy.

Questions

Email privacy questions and requests to hello@soggy.boats. For general questions about the game you can also open an issue on GitHub. Issues are public, so please do not post personal data, such as your email address, there.

This page lives in the game's public repository, so every change to it shows in the history.