Every single-player run starts with a seed issued by the server. Your browser records the moves you make and submits the move log with the score. The server replays that log through the same deterministic engine and recomputes the result.

A run is rejected when the log contains illegal moves, exceeds the per-game time or move caps, or produces a score different from the one submitted. Rejected runs never reach a leaderboard. A run is flagged when it is legal but statistically implausible — for example an inhumanly steady input rhythm or a completion time near the theoretical floor. Flagged runs are queued for review.

Versus matches are not trust-based. The server owns the board, decides whose turn it is, validates every move against the rules, and computes the result. A client cannot declare itself the winner, cannot move out of turn, and cannot edit the board — an illegal move is rejected with an error and the match continues.

Server replay validates the data your browser sends. A determined attacker who controls their client can craft a plausible move log, and no server-side check can fully rule that out without moving the entire simulation into a trusted enclave. Replay raises the cost of cheating dramatically and catches the overwhelming majority of real-world abuse. It is not proof. We say so rather than advertise a guarantee we cannot honour.

• Queueing with a second account to lose to your main account.
• Abandoning ranked matches to avoid a loss.
• Win-trading or agreeing results in advance.

Outcomes depend on severity and are recorded in an audit log: the score is removed, the leaderboard entry is hidden or disqualified for that period, the rating is reset, ranked play is restricted, or the account is suspended. Player history is never silently rewritten — a hidden entry keeps its record and can be restored.

You can contest any of these by opening a support ticket. Reviews are handled by staff and the decision, including the reason, is stored.