Privacy

Last updated 20 September 2026

Hold the City is a small, free browser game made by ML Games. This page explains what the game stores and why.

In your browser

The game keeps a few things in your browser’s local storage:

• a random player ID, so your own scores can be highlighted on the leaderboard
• your run in progress, so it survives a reload
• your weekly challenge build, and your best score on it
• whether music is on
• if you sign in, your sign-in session, so you stay signed in

Clearing this site’s data in your browser removes all of it.

On our servers

• Leaderboard. The name you enter, the round you reached, the game version, your player ID, the time, and the towers you had built when the city fell. Names, rounds and the towers are public: anyone can open a score on the board to see them.
• Weekly challenge. If you put a score on the challenge board: the name you enter, the damage dealt, the build you played (your towers, units and formation), the game version, your player ID and the time. Names and damage are public.
• Account. Only if you choose to sign in: your email address (used to send your sign-in code, and nothing else), the name you set for the leaderboards, your heroes’ names, and which of your games, challenge scores and PvP matches were played while signed in, so we can show you your record. None of this is public except the names you put on a board. Sign-in is run by Supabase.
• Email list. If you sign up to hear about new features: your email address, when you signed up, where in the game, and the wording you agreed to. It is used only to tell you about the game, is never shared, and nothing has been sent yet. Before the first email, you will be asked to confirm.
• Games. For each game: the round reached, time played, whether it finished, the game version and your player ID. This shows us how far people get.
• Feedback. The answer you choose, anything you write, the round you were on and your browser type.
• Visitor counts and spam protection. A salted, one-way hash of your IP address rather than the address itself. It lets us count daily players and limit repeated submissions.

A shared result, and its “beat my score” link, contains only your score: the round you reached, or the damage you dealt in the challenge.

This data is stored with Supabase. The site is hosted by Vercel, which keeps standard request logs. Scores stay on the leaderboard and in its archive of past weeks. Everything else is kept only as long as it is useful.

Analytics

We use PostHog, on its EU servers, to see how the game is played: rounds started, towers built, where games end. It sets no cookies and stores nothing in your browser, so it cannot recognise you on a later visit. As with any website, PostHog receives your IP address when your browser sends it data.

Other services

• The game’s fonts are loaded from Google Fonts, so your browser requests them from Google.
• The Ko-fi link goes to ko-fi.com, which has its own privacy policy.

Why, and your rights

We process this data on the basis of legitimate interest: to run the leaderboard, prevent abuse and improve the game. An account is processed to provide it to you, because you asked for one. The email list is based on your consent, which you can withdraw at any time.

To see, correct or delete anything stored about you, such as a name on the leaderboard, to delete your account, or to leave the email list, email hello@holdthecity.app. Please include your account’s email address, or the name you played under and roughly when. Deleting an account removes it and its record; scores already on a board stay there without it. You can also contact your local data protection authority.