Mordent · playmordent.com

Privacy Policy

Last updated: July 7, 2026

Mordent is a weekly murder-mystery game built to need as little of your personal information as possible. You can play without giving us your name, your email, or any account details. Your identity in the game is an anonymous case key. This policy explains exactly what we collect, why, and what we never do.

The short version: no required email, no ads, no selling or sharing data for advertising, no third-party tracking cookies. The one personal thing you can give us, an optional recovery email, is stored encrypted and used only to help you recover your account.

1. What we collect

Your case key (account credential). Generated randomly when you create an account. We store only a keyed cryptographic hash of it, and cannot read your key back, and it contains nothing about you.
Optional recovery email. If you choose to add one (recommended for Mordent+ members), it is stored encrypted (AES-256-GCM). A separate keyed hash lets us find your account during recovery without reading the address. We use it only to send verification and recovery codes, never marketing (unless you separately opt in to something that clearly says so).
Gameplay data. Your investigations: the questions you type to suspects, actions, notes, scores, achievements, and leaderboard entries. Typed messages are processed by our AI provider to generate suspect responses (see §3).
Purchase records. If you buy Mordent+ or store items, payment is handled entirely by Stripe. We never see or store your card number. We store what you bought and your subscription status. Stripe collects your email on its checkout page under its own privacy policy.
Telemetry and analytics. First-party gameplay events (e.g., "case started", "case completed") tied to your anonymous player ID, used to make the game better. Site traffic is measured with Cloudflare Web Analytics, which is cookieless and does not profile you across sites.
Technical logs. Standard server logs (IP address, request path, status) for security, rate limiting, and abuse prevention, retained briefly.

2. What we don't do

No advertising, no ad trackers, no cross-site tracking cookies.
No selling or renting your data. Ever.
No reading your recovery email address for anything but recovery.
No training AI models on your data. Your messages are processed to run your game session, not to train models (see our provider terms below).

3. Service providers (processors)

We use a small set of infrastructure providers to run the game. Each receives only what it needs:

Provider	Purpose	What it processes
Supabase	Database & file storage	All game data listed above (hosted Postgres)
Fly.io	Application hosting	Traffic to our servers, server logs
Cloudflare	Site hosting, cookieless analytics	Page requests (no cookies, no cross-site profile)
Anthropic	AI suspect dialogue	The text you type in-game and game context needed to answer it, not your email or identity. Anthropic does not train on this API data.
Stripe	Payments	Payment details you enter on Stripe's checkout page
Resend	Transactional email	Your recovery email address, only when a code is sent
Sentry	Error monitoring	Technical error reports (scrubbed of personal data)
Langfuse	AI quality monitoring	The same in-game text sent to Anthropic, plus the reply, so we can diagnose a suspect behaving wrongly. Automatically scrubbed of email addresses, phone numbers and keys before it is sent. Stored in the United States.

4. Cookies & local storage

We don't use tracking cookies. Your browser's local storage holds your session token (so you stay signed in) and preferences like your theme. Clearing your browser data signs you out.

5. Data retention & deletion

Game data is kept while your account exists. To delete your account and its data, contact us at support@playmordent.com from your recovery email (or with your case key available for verification) and we'll remove it within 30 days, except records we must keep (e.g., payment records for tax law). Server logs rotate automatically on a short cycle.

6. Your rights

Depending on where you live (including under GDPR and CCPA/CPRA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Because our accounts are pseudonymous, we may ask you to prove control of the account (via your recovery email or case key) before acting. We don't discriminate against you for exercising these rights, and we don't "sell" or "share" personal information as those terms are defined in the CCPA.

7. Children

Mordent is fiction with mature mystery themes (murder, deception) presented without graphic content. It is intended for players 13 and older. We do not knowingly collect personal information from children under 13; if you believe a child has provided us any, contact us and we will delete it.

8. Security

Account credentials are stored only as keyed hashes; recovery emails are encrypted at rest; payments never touch our servers; access to production systems is restricted and audited. No system is perfectly secure. If a breach affecting your data ever occurs, we will notify affected players as required by law.

9. Changes

If we change this policy, we'll update the date at the top and, for material changes, note it in-game. Continued play after a change means you accept the updated policy.

10. Contact

Questions or requests: support@playmordent.com.
Mordent is operated by Fragment Softworks Inc., Calgary, Alberta, Canada.