No email required
Cross-device player accounts arrive via Google sign-in, chosen over a magic link or a sync code, plus the claim-or-discard flow, GDPR deletion, and the review findings that shaped the implementation.
Every stat this game has ever tracked has lived on one device. A player who plays Daily Challenge on a phone and picks up a PvP duel on a laptop has always had two separate histories with no way to connect them, because nothing about the anonymous per-device model gave them anything to connect with. That changes today. Signing in with Google gives a player one account whose Daily, AI Duel, and PvP stats follow them across every device they use, while anonymous play keeps working exactly as it always has for anyone who never signs in at all.
No email, no sync code#
Three mechanisms were genuinely on the table for the cross-device identity itself: a magic link by email, a manually typed sync code, or OAuth. A sync code carries a real no-recovery risk, since losing it leaves nothing else tying a player back to their account, and the preference going in was to avoid collecting a real email address if a viable alternative existed at all. Both lost to Google OAuth, which needs its own long-lived “stay signed in” cookie. The last time this game needed a cookie for something outside gameplay itself, the feature got fully built and then set aside unmerged rather than stand up consent-banner infrastructure that doesn’t exist anywhere in this codebase. This time the question got asked before any code shipped, rather than after: a short, session-bound sign-in cookie qualifies for the ePrivacy “strictly necessary” exemption, no consent banner required, distinct from the more cautious read a persistent “remember me” cookie would get. The game had already shipped one authenticated cookie for a PvP connection stream; this is the second, for a genuinely different reason.
One account, one shape of data#
The account itself stores nothing but a Google-issued identifier, never an email address, plus one rolling JSON blob of aggregate stats per game mode. No existing anonymous game table changes at all. A device that already has local stats when it signs in for the first time gets an explicit choice, claim those numbers into the account or start fresh, refined through a live before-and-after pass on the settings page rather than decided on paper. Deleting an account is self-service from Settings with its own confirmation step, unlike the reversible notification-toggle precedent it otherwise mirrors, since this one can’t be undone. The player’s own stats page already covers seeing what’s stored, so no separate export feature was needed.
Two rounds of review#
Four of the decision documents behind this feature had been drafted on their own branches before implementation started, then cherry-picked directly onto the feature branch once the work actually began instead of merged first. That left the original four documentation pull requests stale and, once everything shipped for real, closed without ever merging. The decisions themselves are unaffected, only which pull request gets credit for them, but it was enough of a rough edge that the fix is now written down for whichever umbrella effort hits the same shape next.
What’s left before any of this actually works for a real player is entirely outside code: a genuine Google OAuth client still needs provisioning before the sign-in button does anything but fail.