Murder Desk

Privacy

Murder Desk is built to know as little about you as possible. You play under a nickname; an email address is optional, and there is no password, no advertising and no analytics tracking. This notice explains the little that is stored, why, for how long, and how to remove it.

Last updated

In short

  • You play under a nickname you choose. We never ask for your name or a password. An email address is optional: add one only if you want to sign in on other devices with a code we email you.
  • We store your nickname, your progress in each case and your votes, so you can continue later and appear on the leaderboard.
  • We set one cookie, and it is strictly necessary: it keeps you signed in to your own progress. There are no tracking or advertising cookies, so there is no cookie banner.
  • Players who have not visited for 12 months are deleted. You can delete your data yourself at any time.

Who is responsible

The site is a free, non-commercial hobby project run by Tifa, a private individual based in Malaysia, who is the controller of the personal data described here. The controller is outside the European Union, but the database is stored in the European Union (see below). For any question about this notice or your data, write to yusofelshal@gmail.com.

What we store on our server

Your player record
Your nickname, a random player ID, the date you started and the date you were last active. We also keep a one-way hash of the session token of each device you are signed in on, and of your recovery code. A hash cannot be turned back into the code, so we cannot read or resend your recovery code.
Your email address, only if you add one
The address and the date you confirmed it. We use it only to email you sign-in codes; it never appears on the site and we send nothing else to it. For each code we send, we keep a one-way keyed hash of the code (never the code itself), when it was sent, how many times it was tried and whether it was used.
Your progress
For each case you open: which files and locked items you have opened, which hints you have revealed, your gate attempts (right or wrong, with the time), your deductions, and whether you gave up.
Your vote and result
Your five-part vote, your score and the time you voted.
Rooms
If you play in a room: the room code, who is in it, who hosts it and the room’s shared progress. Other members of your room see your nickname and whether you have voted, and, once the room reveals, your vote and score.
Moderation
If a nickname is offensive or impersonates someone, we may mark it as hidden so it no longer appears on public leaderboards. That mark is stored with your player record.
Leaderboards
When you vote, your nickname, score, deductions, number of hints and vote time are published on that case’s leaderboard. Team results also store the room code, which is never shown publicly.

We do not store your IP address in our database. When you create a player, recover one, ask for or enter a sign-in code, join a room or take an action in a case, your IP address or player ID is used for a moment to limit how many requests can be made per minute. This protects the site from abuse and is not used for anything else.

Anonymous statistics

To show the crowd split after a verdict and to see which parts of a case are too hard, we keep simple counters per case: how many runs were started, how many players opened each file, how many hints of each tier were revealed, how many votes and surrenders there were, and how many votes each answer received. If you arrive through a link that carries a source tag (for example a link under one of our videos, ending in ?src= and a word), we also add one to that day’s total for the tag, and one more if you then start a player. The tag is not stored with your player, and no cookie or browser storage is used for it. These are totals only. They contain no nickname or ID, cannot be linked back to you, and use no cookies. They stay when a player is deleted.

What stays on your device

Your notebook, your timeline, the marks showing which exhibits you have read, your work on cipher sheets and your choice of language are kept in your browser’s local storage. They are never sent to our server, except that the case app tells the server which language to answer in with each request; that is not stored. You can export your notes to a file from inside a case, and you can remove all of this by clearing this site’s data in your browser.

The cookie is called sid. It holds a random token that links your browser to your player record. It is marked HttpOnly (scripts cannot read it), Secure (only sent over HTTPS) and SameSite=Lax, and it lasts up to 400 days. It is strictly necessary for the service you ask for, which is keeping your progress, so it does not need consent. There are no other cookies: no analytics, no advertising, no social media widgets and no third-party scripts. Fonts are served from our own domain, not from a font service.

Why we may use this data

  • To provide the game you ask for (keeping your progress, scoring your vote, running your room and listing you on the leaderboard): processing necessary to provide the service, GDPR Article 6(1)(b).
  • To sign you in with an emailed code, if you add an email address: processing necessary to provide the service you ask for, GDPR Article 6(1)(b).
  • To keep the site secure and fair (rate limits, preventing abuse) and to keep anonymous totals that improve the cases: our legitimate interests, GDPR Article 6(1)(f). You can object at any time by writing to us.

Who processes it for us

The site, its database and its room connections run on Cloudflare (Cloudflare Workers, D1 and Durable Objects). The database is created in Cloudflare’s EU jurisdiction, so the stored data stays in the European Union. Cloudflare acts as our processor under its Data Processing Addendum, which includes the European Commission’s Standard Contractual Clauses for any transfer outside the European Economic Area. To deliver pages and protect the site, Cloudflare handles technical data such as IP addresses, and it keeps short-lived technical logs that we use only to find and fix errors. Sign-in codes are sent with Cloudflare Email Service, under the same addendum; on its way to your inbox an email also passes through the mail providers in between, as any email does. We do not sell or share your data with anyone else.

How long we keep it

  • Players: a player who has not visited for 12 months is deleted, together with their email address, runs, room memberships and leaderboard rows.
  • Sign-in codes: deleted 24 hours after they are sent. A code works for 10 minutes.
  • Devices: a device that has not been used for 400 days is signed out, and its session record is deleted.
  • Rooms: a room that never reaches voting closes 14 days after it was opened and is then deleted. A daily clean-up job removes expired rooms and players inactive for 12 months.
  • Anonymous totals: kept for as long as the case is online, because they contain no personal data.
  • The cookie: up to 400 days, renewed when you use the site, and removed when you delete your data.

How to delete your data

  1. Open Account (in the main menu) or a case’s start screen and choose Delete my data. This removes your player record, your email address, your runs, your room memberships and your leaderboard rows straight away, signs out every device and clears the cookie. Vote totals stay only as anonymous counts.
  2. If you are on a different device or have cleared your cookies, first sign in with your email address or use your recovery code, then delete.
  3. If neither works, write to yusofelshal@gmail.com. We hold no real name for you, so we will ask for your nickname and recovery code, or send a code to the email address on your player, to confirm the data is yours.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable form. Write to yusofelshal@gmail.com to use any of these rights. We answer within one month. You also have the right to complain to the data protection authority in the country where you live or work.

Age

The cases describe violent deaths and are written for adults and older teenagers. The site is not aimed at children under 16.

Changes to this notice

If what we store or how we use it changes, this page is updated first and the date at the top moves. We will not start using your data in a new way without saying so here.