NIGHT SHIFT
Privacy notice
Scira Night Shift is a free game developed and published by Patient Thread Ltd, company 17167409, England and Wales. Contact: chris@patientthread.com. This game is separate from Patient Thread's clinical products: it holds no medical records and a game account is not a Patient Thread clinical account.
- Practice all eight shifts with no account at all.
- Ranked play needs a free account: an email address, a password and a public player name. Other players only ever see the player name and scores.
- No adverts, no tracking SDKs, no analytics, no sale or sharing of your data.
- Delete your account yourself at any time, in the game or on the deletion page.
What we hold about a player
| Data | Why | Kept |
|---|---|---|
| Email address and password (stored only as a salted hash by our authentication provider) | To sign you in on any device, confirm your address and reset a forgotten password. | Until you delete the account. |
| Account identifier (random, assigned at sign-up) | Owns your scores so that a player name change can never move points between people. | Until you delete the account. |
| Public player name | Shown on the leaderboard beside your scores. | Until you delete the account. |
| Ranked runs: the shift reached, verified score, platform (web, Android or iOS) and timestamps | The shared leaderboard: best run and lifetime total. | Until you delete the account. |
| Recorded game controls for each ranked shift | Sent once so the server can replay the shift and verify the score. The server keeps only a fingerprint (hash), the frame count and the verified points, not the recording. | Recording discarded after verification. |
| Reports you make or receive, hidden-player choices | Moderation of offensive names and impersonation; your personal hide list. | Reports until resolved; a moderation log entry (action, accounts involved, reason) for 12 months; hide list until you change it or delete the account. |
| Short-lived rate-limit counters keyed by connection address or account | To stop abuse of sign-up, sign-in, reporting and score upload. | Up to 24 hours. |
We do not collect your real name, phone number, contacts, location, photos or device advertising identifiers, and we do not profile you.
What other players see
Only your player name, rank, best run, lifetime total and number of ranked runs. Your email address and account identifier are never published. Choose a player name you are happy for strangers to see and avoid putting personal information in it. You can hide any player from your own leaderboard and report a name to us.
Service providers
We use a small number of processors under contract, each acting on our instructions:
- Supabase hosts the account and score database and performs sign-in, in a data centre in London, United Kingdom (AWS eu-west-2). Supabase keeps standard authentication logs for a limited period.
- Netlify serves the game and runs the game's server code, and keeps standard web server logs (IP address, browser type, pages requested) for security and reliability. Netlify's infrastructure may process requests outside the UK.
- Resend delivers our confirmation and password-reset emails and keeps delivery logs for a limited period.
- Apple and Google distribute the apps and provide their own crash and usage statistics under their terms if you have opted in on your device; we add no analytics of our own.
Lawful basis and your rights
We process account data to provide the service you ask for when you create an account (performance of a contract) and moderation and rate-limit data in our legitimate interest in running a safe game. Under UK GDPR you can ask for access, correction or erasure of your data, object to or restrict processing, and complain to the Information Commissioner's Office (ico.org.uk). Email chris@patientthread.com.
On your device
Sound settings, practice progress, a device-only best score and an unsent ranked result may be stored locally. The browser keeps your sign-in as secure, HttpOnly cookies scoped to the game's API; the apps keep it in the operating system's secure storage (Keychain on iOS, encrypted storage on Android). Deleting the app or clearing site data removes this device's copy; your account is unaffected.
Children
The game is suitable for a general audience and is not designed for children. Practice needs no account. We do not knowingly accept accounts from children under 13; a parent or guardian can ask us to remove one at the address above.
Deletion
Player profile → Delete account in the game, or the deletion page. Deletion removes your sign-in, player name, runs, scores, reports and hidden-player list immediately and signs out every device. Provider backups are overwritten on their normal rotation (within 30 days). If you cannot sign in, email us from the account's address and we will verify and delete.
Changes
If this notice changes we will update the date above and, for material changes, say so in the game.