X leaderboard privacy
Signing in is optional. Games and browsing stay public.
When you sign in, we retrieve your X account ID, handle, display name and avatar. We use your account ID to keep the same leaderboard account if your handle changes. Your handle, display name, avatar and leaderboard scores are public.
We store your profile, game runs, scores and their timestamps in the leaderboard database, with a separate internal player ID. A secure session cookie keeps you signed in for up to one year and renews while you use the site. X API access tokens are used during sign-in and are not retained in the database or browser session.
Completed scores waiting to upload are kept on your device for up to seven days and retried with the X account that started the run. Signing out pauses these retries. Deleting your leaderboard profile also clears its pending scores on this device.
We do not use X to post, send messages, follow accounts or read your timeline. Local game progress remains in your browser.
You can sign out at any time. To remove your leaderboard profile and scores, sign in and use the delete option in your X account menu. Disconnecting the app in X also prevents future authorization until you approve it again.
Telegram arcade progress
Photo challenge sharing sends a scorecard only after you choose and confirm a recipient. The image contains the original challenge target and public invite link, not your Telegram identity. Telegram and recipients may retain shared copies after progress is erased. When photo sharing is unavailable, the app clearly offers a link-only fallback.
Opening the Mini App from SLOPBOT connects a separate Telegram profile using launch data checked by our server. We retain a keyed identity hash, not your name, photo, raw Telegram ID or chat history. A secure, HttpOnly cookie keeps this connection for up to eight hours. Telegram launch data is not stored or passed into games, and your Telegram identity is not linked to X.
Finished runs can save personal bests, daily completions, streaks and friend-challenge results. Challenge links reveal an arcade alias and score to anyone who has the invite. Scores are unverified community results, without prizes. Runs are cleaned up after 30 days, challenges 30 days after their seven-day expiry. Bests, streaks and daily completions remain until erased.
Telegram privacy controls let you switch run saving off or confirm permanent deletion of your progress. Deletion also removes invites you created and friends’ results inside those invites; it does not delete their other scores, your X scores, browser progress, bot personality or Telegram messages. Only a keyed saving-off preference remains to prevent saving restarting on your next visit.
Spam protection retains keyed rate-limit counters until expiry and cleanup. Bot delivery receipts contain update numbers and processing state for seven days; aggregate operational counters are retained for 30 days. They contain no message text or raw Telegram user IDs.