Accounts & Authentication

SpaceDwarves is fully playable without an account — free play runs entirely in your browser. An account exists to back the online features: VIP subscriptions, cloud saves, and the social layer (leaderboards & activity feed). Creating an account is optional, and an account on its own is free; VIP is a separate subscription on top of it.

Registering & logging in #

You create an account with an email, a password, and a display name (your corporation name, shown on leaderboards and the feed).

• Passwords must be at least 8 characters and are stored only as a strong bcrypt hash — never in plain text.
• Registration is rate-limited to 5 attempts per hour per IP; login to 10 attempts per 15 minutes per IP. These limits exist to blunt brute-force and spam.
• When you register, you can optionally hand your existing local save straight to the server as your first cloud save (subject to the 2 MB cloud limit).
• Login responses include your VIP/subscription status so the client knows which features to enable.

Email addresses are normalised to lowercase, so capitalisation never causes a duplicate or a failed login.

Sessions & tokens #

Authentication uses a two-token model:

• The short-lived access token limits the damage if it’s ever leaked; the refresh token quietly renews it in the background so you stay logged in.
• Refresh tokens are stored hashed server-side, one row per session, so you can manage and revoke them.
• Log out revokes the current session only. Log out everywhere revokes every active session at once — useful if a device is lost.
• Suspended (banned) accounts are blocked at login and refresh, and all their sessions are revoked.

Password reset #

A password-reset flow exists (request a reset link, then confirm with a token and a new password). On a successful reset the new password is hashed, all sessions are revoked, and the one-time token is marked used.

Status: in v0.10.0 the reset-request endpoint is a stub — it always responds “if that email is registered, a reset link has been sent” (which also prevents attackers from probing which emails exist), but the actual reset email is not yet dispatched. The confirm step is implemented and validates tokens for expiry and reuse.

What your account stores #

Server-side, an account holds:

• Profile: user ID, email, display name, created/updated timestamps.
• Preferences: leaderboard opt-in, activity-feed opt-in.
• Cloud save: your save blob, its size, version, and checksum (VIP).
• Stats: time-series snapshots used for plausibility checks and VIP dashboards.
• Leaderboard entries and activity events you’ve posted.
• Subscription & entitlements: your VIP status and any DLC ownership.
• Sessions and (if used) password-reset tokens.

You can see a summary of all of this — profile, preferences, subscription status, and entitlements — from your account at any time.

Privacy & opt-ins #

Privacy is opt-in by default: nothing about your play is made public unless you turn it on.

Both can be toggled at any time. Turning leaderboard opt-in off immediately deletes your existing leaderboard entries, removing you from every board. (Posting to the feed while opted out simply does nothing — no entry is created.)

Your data rights (GDPR) #

Two self-service endpoints cover data portability and erasure:

• Data export — returns a complete JSON archive of everything held server-side: your profile, preferences, all saves, stats, leaderboard entries, entitlements, subscriptions, and activity events. (Your password hash is never exported, and billing records held by the payment provider are retrieved from that provider’s own portal.)
• Account deletion — a “right to erasure” request. You confirm by re-entering your email; the account is then marked for deletion, all sessions are revoked immediately, and every associated data row (sessions, saves, stats, leaderboard entries, activity events, entitlements, subscriptions, reset tokens, and the user record) is removed. Payment records retained by the payment provider for legal/accounting reasons are the one exception and stay with that provider.

Free vs. account vs. VIP #

See VIP & Monetization for what a subscription adds, and Persistence & Saves for how accounts back up your progress.