← Back to the game

cybercab.city Privacy Policy

Last updated: 2026-10-01 (applies to the build with X sign-in and $CAB wallets, hosted at cybercab.city)

Signing in with X

The game is online only, and you sign in with your X account. Sign-in runs through Firebase Authentication (Google), which receives your X user ID, display name, username and profile picture link from X, as Google's service provider for us. Our server keeps your X user ID, to recognise you next time, and your X username, updated each time you sign in and shown only to you in the garage so you can see which account you're in. Your X username is also your driver name when your account is first made; you can change the driver name.

After sign-in, our server gives your browser a session key, kept in local storage (cybercab.session). The server stores only a one-way hash of it. Signing in on another device gives that device its own key.

Your account

The server stores, for each account:

Your browser also keeps a copy of this profile (cybercab.profile.v1) so the garage shows something before the server answers. The server's copy is the one that counts.

Your $CAB wallet

Every account gets its own Solana wallet, created by our server. Its secret key is encrypted with a key held in Google Cloud KMS before it is stored, and is only decrypted inside our server to sign transfers you start (Dark Side stakes and withdrawals). Because we hold the key, we can move the $CAB in it; we only do so for those transfers.

The server keeps a record of each transfer: Moon Run payouts to your wallet, Dark Side stakes from it, Infinity Stone purchases (paid to the treasury for a stone's first purchase, or to the seller's wallet for a resale), and withdrawals you send to other addresses (the destination address, amount, time, status and transaction ID). Anyone can send $CAB to your wallet address; the game reads your balance from the blockchain.

The blockchain is public and permanent. Your wallet address, its balance and every transfer in or out of it, including the addresses you withdraw to, are visible to anyone and can't be deleted, by us or anyone else. Anyone who links your wallet address to you can see that history. We don't publish which X account owns which wallet.

In this build, $CAB is a test token on Solana devnet, with no value. Transfers go through a public Solana RPC service (Solana's devnet endpoint), which sees the transactions our server sends.

What other players see

Matches

While you play a shift, your game sends your controls to the server about 30 times a second, and the server sends back the match state. Matches are not recorded. When a shift ends, only your totals (CAB banked, placement, kills, deaths, fares) are added to your account.

Moon Runs

When you start a Moon Run, the server records the run: your stake, mode, the run's random seed, its start time, and your build at that moment. When it ends, your game sends a step-by-step record of your inputs and choices. The server replays it to work out what the run earned, and pays that. The server keeps the outcome, the payout, what your game reported, a short note if the two disagreed, and when the run finished.

Run recordings. The server keeps that record of your inputs and choices with the run for 90 days after it finishes, so a result can be checked again if it's ever questioned (for example, a missing payout). It's game controls only: directions, button presses and draft picks, step by step. After 90 days the recording is deleted; the run's outcome and payout stay with your account.

Balancing statistics. For each finished run the server also keeps a separate, anonymous copy, used to balance the game (how hard each level is, what players run into, which upgrades work): the mode, the day (not the time), the stake rounded to a range, the outcome and level reached, your cab's upgrade and weapon levels and loadout, what happened in each level (time taken, damage taken from each kind of enemy, enemies destroyed, upgrades drafted, what wrecked the cab), and the input recording with only the build details a replay needs. It has no account, X user ID, name, wallet address, exact stake or payout, and nothing in our records links it back to you. It's kept with no set end date.

IP addresses

Our game server receives your IP address when your browser connects. It holds addresses in memory for a few seconds to rate-limit requests. They are not written to the account database.

Hosting and service providers

What this build does not do

Separate local settings remember your display and audio choices: cybercab.pref.film (whether the film filter is on), cybercab.pref.musicVolume (music volume) and, on iPhone, cybercab.pref.fsTip (that you dismissed the Add to Home Screen tip). They stay on your device.

CAB and $CAB

Game CAB (your bank) is an in-game number with no monetary value. It cannot be bought, sold, or withdrawn. $CAB in your wallet is a Solana token, a devnet test token in this build.

Keeping and deleting your data

Your account is kept until you delete it. To delete it, withdraw any $CAB in your wallet first (its key is deleted with the account), then open the garage, go to Career and press Delete account. That removes your account, its wallet key, its sessions and its Moon Run records (with their recordings) from our server. The anonymous balancing statistics stay, since nothing links them to you. Any stones you held become unowned again. Lines in the Stone Exchange log that name you stay until newer entries push them out. We keep the record of past wallet transfers, without your X user ID or name, because they are the treasury's ledger; the transfers themselves stay on the blockchain permanently in any case.

Sign out (garage → Career) signs that browser out and removes its session from our server. Clearing this site's data signs the browser out too, but leaves the unused session record on our server. Either way your account stays, and signing in with X again brings it back.

Changes

This policy will be updated before any of the following ship. Each one changes what data is collected: