Privacy Policy

Run Analyzer is a personal project that archives and analyzes runs of Slay the Spire 2 and Guildrun. This policy explains what it collects, why, who can see it, and how to have it deleted. Questions go to privacy@voz.dev.

• Account details. Sign-in is handled by Clerk. When you sign in with Google, we receive your name, email address, profile picture and a Google account identifier. We never see your Google password and get no access to your email, files or any other Google data.
• Game data you upload. The capture tool you install and pair reads only the game's save folder. It uploads in-progress save files and completed run history files: characters, cards, relics, map, combat statistics, timings and the game version. Multiplayer saves include the Steam account ID of every player in the run, including other players; those IDs are stored as part of the run record. To show player names, the app looks up those IDs' public Steam profiles (display name and avatar) through Steam's Web API and caches them for up to a day.
• Capture status. Pairing records, the time of your capture tool's last check-in and any upload errors it reports, so the app can show whether capture is working. Capture and share-link tokens are stored only as one-way hashes.
• Problem reports. When you use the report button, we store your description with the page you were on, the time, your browser, language and window size, recent errors and failed requests on that page, your account ID if you're signed in, and a keyed hash of your network address used only to limit abuse. The dialog lists what is included before you send.
• Technical data. Our hosting provider processes standard request data (IP address, browser user agent, timestamps) to serve and protect the site, and keeps it in short-lived logs.
• Cookies. Only the cookies needed to keep you signed in, set by Clerk. There are no analytics or advertising cookies and no third-party tracking.

To store and show your run history, live maps and statistics; to keep capture working and investigate problems, including ones you report; and to secure the service. We do not sell or rent your data, use it for advertising, or use it to train machine-learning models.

• You. Everything in the app is scoped to your account.
• Anyone with your share link. Your account has a live-view link (/watch/…) that opens without signing in. It shows your current run (map, characters, cards, statistics and the players' Steam names and avatars) and whether your capture is online. It never shows your account's name or email. Share it only with people you want watching. When you host a co-op run, other players in that run who also use Run Analyzer see your live link automatically, but only after your live save confirms they are in the run and at the same point in it.
• Service providers that run the service for us: Clerk (sign-in), Vercel (hosting), a managed Postgres database provider, and Valve's Steam Web API, which receives player Steam IDs to return their public names. They process data only to provide their service. Data may be processed in the United States.
• Authorities, only when the law requires it.

Google sign-in is used only to authenticate you, with the basic profile scopes (name, email, profile picture). Run Analyzer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We keep your data while your account exists. To get a copy of it, revoke a paired capture tool, or delete your account and every run and capture record tied to it, email privacy@voz.dev from the address on your account. Deletion is completed within 30 days; copies in provider backups expire on their normal schedule.

Traffic is encrypted with HTTPS, tokens are stored hashed, and every record is scoped to its owner's account. No system is perfectly secure, but we work to protect what you entrust to us.

Run Analyzer is not directed at children under 13, and we do not knowingly collect their personal information.

When this policy changes, this page and its effective date are updated.

privacy@voz.dev