Account recovery policy
How recovery codes work, and the limits we cannot work around
1.Why recovery exists
Accounts are anonymous: there is no email address or password to reset. The only way back into an account after a browser wipe is a recovery code you generated beforehand. That is a deliberate trade-off — it means we hold no contact details about you.
2.How codes work
- Codes are generated on request from the recovery page and shown to you exactly once.
- Only a hash of each code is stored. We cannot read, email or restore a code you lost.
- A code is single-use: redeeming it consumes it and issues a fresh session.
- You can generate several codes and revoke any unused code at any time.
3.Treat a code like a password
A recovery code is a bearer credential. Anyone who has it can take over the account it belongs to, and we cannot tell the difference between you and them — by design, we do not ask identifying questions. Store it in a password manager, not in a screenshot on a shared machine.
4.What we will never do
We will not restore an account from an IP address, a device fingerprint, a username guess, or a description of the games you played. Support cannot bypass this. If that sounds harsh, it is the same property that keeps your anonymous account unlinkable to you as a person.
5.If you lose both the cookie and every code
The account becomes permanently unreachable. Its scores stay on the leaderboards — deleting them requires proving control of the account, which is exactly what you cannot do. If you want the data gone in that situation, say so in a support ticket and we will discuss what can reasonably be verified.
Related:Recovery pagePrivacy policy