IdleDeck

Privacy policy

Translation provided for convenience; if there is any discrepancy, the Portuguese version prevails.

Applies to the IdleDeck app for Windows (site installer and Microsoft Store version) and to this site. Last updated: September 22, 2026.

In one sentence

The games run on your computer and what's yours stays there. Our server only knows the minimum for your account to exist and for us to count how many people use IdleDeck.

What stays only on your computer

None of this is ever sent to us:

  • game accounts, open sessions and each one's cookies;
  • the logins stored in the vault (email, password and notes), encrypted by Windows and, if you want, by a master password;
  • the event history, uptime, Ping's level and achievements, watched texts, settings and screen thumbnails;
  • the Discord webhook address, if you set one up: alerts go from your computer straight to Discord.

In the Microsoft Store version, Windows deletes this data when you uninstall the app. With the site installer, it stays in the data folder until you delete it.

What the app sends to our server

  • An anonymous computer code, calculated from a Windows identifier and scrambled (hashed): it's used to recognize the same machine without knowing whose it is.
  • The app version.
  • The link code that ties the computer to your account. The site password is never typed into the app: you confirm the link yourself, signed in, in the browser.

This check happens when the app opens and from time to time while it's open. The app only gets back your masked email (for example, ma•••@exemplo.com), to show which account is linked, and your donation XP (just the number), to unlock Ping's decorations — the XP from Ping's achievements is added up on the computer itself and never comes from or goes to the server. When you open donations in the app's wardrobe, it asks the server for your account's deposit address (with the same code of the linked computer) and, while that screen is open, checks every now and then whether something arrived — nothing else goes back or forth.

"App open" signal: while the app is open, every 5 minutes it tells our server that it's on, and tells it again when you close it or the computer goes to sleep. Only the anonymous computer code and the app version are sent. That's how we know how many people are using IdleDeck right now. Who is online stays only in the server's memory, for a few minutes; what we keep is the count — how many accounts and how many computers had the app open in each 5-minute slot, totals only. This signal also counts as "used the app today" and updates when the computer was last seen.

Problem reports and suggestions are only sent when you click send. The diagnostics that go with them are anonymized (accounts by number, no names, emails, passwords, full addresses or watched texts) and you see the whole content before confirming (or uncheck the diagnostics and send just the text). With the computer linked, the form comes with the Reply to my account's email option checked: when checked, the app sends the computer's link code along, and our server uses that code only to tie the report to your account so we can reply to your email (the code is not stored with the report). When unchecked, the report arrives with nothing that identifies you — neither the computer nor the account. In no case is the sender's IP address stored with it: it's only used to limit abuse. You can also leave another contact in the report itself.

When uninstalling (site installer), the app opens a farewell screen with an optional field: "why are you leaving?". Only if you write something and click Send and uninstall do the text and the app version go — without the account, without the computer code, and the sender's IP address is not stored (it's only used to limit abuse). If you don't write anything, nothing is sent. In the Microsoft Store version this screen doesn't exist.

Your feedback: every 10 days (the first time, 10 days after you start using it), the app asks how your experience is going, with an optional field. Only if you write something and click Send do the text and the app version go — without the account, without the computer code, and the sender's IP address is not stored (it's only used to limit abuse). With no internet, the answer waits on your computer until it can be sent (for at most 7 days). Closing or clicking "Not now" sends nothing, and "Don't ask again" turns the question off.

Recommended games: the add-account screen and the banner at the top of the app (marked as an ad) show a list of games we recommend, downloaded from our server along with each game's icon and banner. That request carries only the app version, and the list is the same for everyone; the images also come from our server, as soon as the list changes — not when they appear on screen —, and no image is loaded from other sites. Some links are referral (affiliate) links, and the app says so next to them, in the banner and before creating the account. If you pick one, the game's page opens on your computer, like any site: when you confirm creating an account through a recommended game, the app tells our server only which game it was and whether it came from the banner or the list — without the computer code, without your account and with nothing that identifies you; the server adds it to a daily counter and doesn't store the IP address of that request. That's how we know how many accounts each recommendation brought. We don't find out who saw the games or which ones you clicked without creating an account, and whoever learns that you arrived through a referral (and whether you finished signing up) is the game itself, under its own policy.

What the site keeps

  • Account: your email and password, stored only as a hash (not even we can read it). If you sign in with Google or Discord, we also keep your account code there (see below).
  • Site sessions: when you sign in, we keep the date, the IP address and the browser identification, to protect the account. Sessions expire on their own and you can end them by signing out or changing your password.
  • Linked computers: the machine's anonymous code, the app version and when it was first and last seen.
  • Usage counts: how many distinct accounts and computers used the app each day, and how many had the app open in each 5-minute slot — totals only, without saying who.
  • Support messages: the email and text you send through the support page, so we can reply.
  • App reports: title, text, contact (if you fill it in), app version, the anonymized diagnostics and, if you leave "Reply to my account's email" checked, which account the report belongs to — from the problem reports and suggestions you send. A resolved report is deleted automatically 180 days later; to delete one before that, ask through support (if it was anonymous, tell us the title and the day you sent it).
  • Farewells: the text you write on the farewell screen when uninstalling the app and the app version — no account, computer code or IP. They are deleted automatically 1 year later; since they don't say whose they are, to delete one before that, ask through support telling us the text and the day.
  • Feedback: the text you write in the "How's IdleDeck working out for you?" popup and the app version — no account, computer code or IP. It's deleted automatically 1 year later; since it doesn't say whose it is, to delete one before that, ask through support telling us the text and the day.
  • Donations to Ping: your account's deposit address (a public Solana network address, created for it), the amount and date of each donation, the account's donation XP and the transaction IDs with the wallet they came from (which are already public on the blockchain). We keep them while the account exists; the records of amounts received remain, without the email, for our accounting.

The server also keeps, for a short time, technical access logs (which may include the IP address) for security and to limit abusive login attempts.

Signing in with Google or Discord

If you use "Continue with Google" or "Continue with Discord", we receive from the chosen service only your email — and only if it's confirmed there — and the code that identifies your account on it (that code is how we recognize you next time, even if you change your email there). We don't receive your password, contacts, servers, friends or messages, and we don't post anything on your behalf. The permission they grant is used a single time, to read the email, and then discarded.

If an account with that email already exists, both ways of signing in open the same account. Since the site never confirmed emails when signing up with a password, when the email of an older account is confirmed this way, its old password is turned off for safety (it could have been created by someone else using your email); you can create a new one in My account if you want to keep signing in with a password.

You can disconnect in My account (as long as another way to sign in remains) and remove IdleDeck's access on Google, at myaccount.google.com/connections; on Discord, under User Settings › Authorized Apps.

What we use it for

To keep your account working, know how many people use IdleDeck, protect the service against abuse and handle support requests. We don't use your data for ads or build individual profiles of anyone: the site's audience measurement (only with your consent, see Cookies and audience measurement) is used to see visits as a whole and improve the pages.

Who we share it with

We don't sell or hand over personal data. It stays on a server rented from a hosting provider in Brazil, which processes it only to keep the service running. Payments and donations are made in cryptocurrency directly on the network: we don't receive card or bank details. If you installed from the Microsoft Store, Microsoft handles the installation data under its own policy; we only receive aggregate numbers. If you accept the site's audience measurement, the browsing data described below is handled by Google (Google Analytics), which may process it outside Brazil.

Cookies and audience measurement

The site uses two first-party cookies: your session cookie, needed to keep you signed in, and your chosen-language cookie.

If you choose a language on the site (PT, EN or ES) — or arrive through an English or Spanish address —, the idioma cookie stores only that choice, for 1 year. It doesn't measure anything or identify you.

Besides that, only if you accept in the notice shown on your first visit, we use Google Analytics to measure the site's audience: which pages are visited, where visits come from, which buttons people click, whether sign-up and app linking worked, errors and page load speed. For that, Google stores measurement cookies (_ga and _ga_…, which last up to 13 months) and receives technical data from your browser, such as device type, language, approximate city and IP address (which Google Analytics uses to estimate the region and does not store).

What does not go to Google: your email, your password, the app's link code, what you type in forms and anything from the app or your games. Page addresses are sent without the codes that appear in them, the new-password page and the admin panel don't load the measurement, and Google's advertising features are turned off: no ads, remarketing or advertising profile.

If you decline, Google's script isn't even loaded. You can change your mind whenever you want under Cookies, in the site footer. Browsers with the Global Privacy Control signal turned on already count as declining. Google explains how it handles this data at policies.google.com/privacy.

The IdleDeck app has no measurement of this kind: what's described here applies only to the site.

For how long

Account data is kept while the account exists. Daily usage counts are deleted after about four months, and farewells and feedback 1 year after they arrive. Audience measurement data stays in Google Analytics for up to 14 months. When you delete the account, we delete the data linked to it, except what the law requires us to keep.

Your rights

Under Brazil's General Data Protection Law (LGPD), you can ask to see, correct, take or delete your data, and ask questions about how it's handled. Just contact us through the support page. You can also unlink a computer at any time in My account or in the app itself.

Minors

IdleDeck is not aimed at children. People under 18 should use the service with the permission of a parent or guardian.

Changes to this policy

If something important changes, we'll announce it on the site and update the date at the top of this page.