Guest accounts use a cryptographically secure random resident token stored exclusively in your browser’s local storage. The backend stores only an irreversible hash of the token, game state milestones, and durable action receipts. Clearing browser data clears your guest session.
When configured, Firebase Authentication securely validates email credentials and Firestore syncs cloud saves across your devices. Signing in provides authenticated multi-device persistence without exposing account passwords to our gameplay logic.
Active presence displays your resident display name and destination to fellow active residents on this server. Sessions automatically expire after inactivity. Private invitation rooms securely synchronize avatar positions and home furnishings among invited friends without exposing wallet balances. Photos are captured and saved locally on your device with zero automated uploads.
Use of optional Google Maps place and route services is subject to the Google Privacy Policy (https://policies.google.com/privacy). Relevant manually entered route or place queries are sent to that service only when the operator has connected it. Review the enabled providers and their privacy terms before submitting sensitive information.
Accra Oracle has separate Real Accra and My AccraLife modes. Game guidance is computed on the device and does not transmit your wallet, inventory or save to an AI provider. Real Accra questions and recent conversation context are sent through the authenticated game API and Cloudflare gateway to the configured AI provider and relevant search, places, route or weather services. Only manually entered preferences are used; no automatic precise-location access is requested.
Chat memory is off by default. Opting in stores the latest conversation and preferences in this browser, partitioned by account and mode, with an expiry seven days after last use. Expired entries are removed on next access. Export and Forget my Oracle data controls are available. Cloudflare operational retry receipts have ten-minute validity and are deleted by automatic cleanup. Application analytics omit chat text; third-party providers have their own processing and retention policies. Do not send passwords, API keys, identity documents or confidential personal information.