← DEAD WEIGHT Privacy notice

What this site knows about you

DEAD WEIGHT is a static page. The game — the sim, the twelve ladder rooms, the timer, the replays — runs entirely inside your browser, and the only thing on it that speaks to another machine is a pageview counter. This notice names that counter, says what your browser keeps locally, and says what nobody here collects. Every claim below is checkable against the files this site ships, so the file and line numbers are given: open the game page, hit view-source, and check.

The one thing that leaves your browser: a GoatCounter pageview counter

The game page loads a counter from stats.dankdev.com, a self-hosted GoatCounter instance. It is two tags, and they are the whole of it — html/index.html, lines 25 and 26:

<script>window.goatcounter={path:function(p){return location.host+p}};</script>
<script data-goatcounter="https://stats.dankdev.com/count" async src="https://stats.dankdev.com/count.js"></script>

The first tag sets one rule and nothing else: record location.host joined to the path, so a view of this page is filed as dankgames.com/deadweight/legal/privacy/ rather than a bare /legal/privacy/. That exists so one counter can serve several of the same maker's sites without their paths colliding. The second tag downloads count.js from stats.dankdev.com and runs it asynchronously, after the page has been parsed, and points it at the endpoint https://stats.dankdev.com/count.

What that request carries

Two kinds of statement, kept apart on purpose, because only one of them can be proved from the code you can read here.

Provable from this site's own files. Those two tags are the only off-site load on any page here. Nothing else in this webroot makes a network request of any kind: there is no fetch(, no XMLHttpRequest, no navigator.sendBeacon and no WebSocket anywhere in html/index.html or in the twelve scripts under html/assets/ — grep for them and you get nothing back. The page path handed to the counter is the host-prefixed string described above.
Not provable from here. What count.js does once it runs, because that file is served by stats.dankdev.com and is not part of this repository. Per GoatCounter's own documentation it sends a single GET to the /count endpoint carrying the page path, the page title, the referring URL if your browser sends one, and your screen size; and — as every HTTP request unavoidably does — that request reaches the server with your IP address and your User-Agent header. GoatCounter is documented to use those two to derive a rotating, non-reversible hash for counting a visit once, and to record a country, rather than to store the address itself. This notice has not decompiled the served count.js to prove that last sentence, so read it as what the counter is documented to do, not as something measured here.

Legal basis, and retention

Counting pageviews on a site with no accounts is done under the operator's legitimate interest in knowing which pages people actually use, so that the useful ones keep working — GDPR Art. 6(1)(f). It is a mild interest, so it is balanced by keeping the data at its most aggregate: totals per page and per day, with no profile to attach them to and nothing that follows you off the page.

Retention: the operator has not published one. Rather than print a comforting number this page cannot verify, it says so. No retention period for the counter's server-side totals has been published, and inventing one here would be exactly the kind of claim this notice exists to avoid.

Cookies and identifiers — re-measured for this notice

Measured on 29 July 2026 by grepping the files this site ships: document.cookie appears zero times in the game page and in all twelve scripts under html/assets/ — outside this notice, the only other place the word cookie appears anywhere in this webroot is the one-line summary of this page in html/llms.txt. So this site sets no cookie, and GoatCounter is a cookieless counter by design — it stores no identifier on your device, which is why it has nothing to recognise you with on your next visit. You do not have to take that on trust: open the game and look at the Cookies section of your browser's storage panel.

What the game stores on your device, and only there

The game writes to localStorage in your own browser. Five key names, and that is the complete set — the list below was re-derived by grepping dw_ across html/, which returns these and nothing else:

Key	What it holds
`dw_theme`	Your theme choice, the literal string `light` or `dark`. Written only when you press the Theme button.
`dw_audio`	Whether the blips are on: `on` or `off`.
`dw_ladder_v1`	Your ladder run — one record per cleared rung (level, best deaths, best time), which is what the totals line above the board adds up.
`dw_best_*`	Fewest bodies used to clear one particular room, one key per room: `dw_best_2026-01-27` for ladder level 1, `dw_best_classic` for the original hand-built slice room. A single number.
`dw_run_*`	A run in progress on one room, e.g. `dw_run_2026-01-27`, stored as your input tape — the compacted list of moves you pressed — so that reloading the page replays it and puts you back exactly where you were.

None of that ever leaves the device. It is written with localStorage.setItem and read back by the same page; there is no code path in this site that sends any of it anywhere, for the plain reason given above — this site makes no network requests at all beyond loading its own files and the counter.

To erase it: Reset run on the game page, then the confirm step, deletes dw_ladder_v1. Clearing this site's data in your browser removes all five. Separately, the page tidies up after itself on load — a dw_run_ record whose room key is more than two days old is deleted automatically (MAX_AGE_DAYS = 2 in html/assets/run-store.js), with the twelve ladder rooms exempted, because their keys are fixed seeds rather than dates and sweeping them would delete your progress every boot.

What there is none of

No accounts. There is nothing to sign up for and nothing to log in to.
No server. The site is static files. There is no application backend, no database and no API belonging to this game.
No leaderboard. Times and death counts stay in your browser. Nothing is submitted, ranked or published.
No uploads. Nothing you do here is transmitted. Sharing a clear copies a link to your clipboard whose ?r= parameter is your input tape, encoded — if that link travels, you are the one sending it, to whoever you choose.

The first three were audited from the outside and recorded as TRUE in this project's own cold-start notes (COLDSTART.md), against the claim “no account, no server, no leaderboard”, with the evidence written down as: “driven: zero off-origin requests on every page in this audit except the goatcounter beacon, which the driver aborts”. That same measurement is what backs the fourth: a request that is never made cannot carry a file off your machine, and apart from the counter beacon this webroot makes none.

Other hosts, named

Loaded from another host: exactly one — stats.dankdev.com, the counter described above.
Linked, not loaded: the game page's footer links to polyatic.com, smallcord.com and dankdev.com — two sibling sites by the same maker, and that maker's own portfolio site, which this notice also links to below. A link is an ordinary navigation — nothing is sent to any of them while you sit here — and once you follow one, that site's own privacy notice applies.
This site itself is served from dankgames.com; the game lives at /deadweight/ and this notice at /deadweight/legal/privacy/.

That list is enforced, not just written down: test/privacy-hosts.test.cjs is a committed test that reads every HTML file in this webroot from disk (it never touches the network), collects every off-site host those files load or link to, and fails the build if any of them is missing from the visible words on this page. Hiding a host inside a <script> body or an HTML comment does not count as naming it — the test strips both before it looks.

This page, and reaching a person

The notice reads dw_theme so that it matches the theme you chose in the game, and writes nothing at all; it does not load the counter, so reading a privacy notice is not itself a counted event. It was written on 29 July 2026 and describes the site as it shipped that day; a material change to what is collected means this page changes with it.

This domain publishes no mailbox of its own. The same operator publishes privacy@polyatic.com on the polyatic.com privacy notice — that is the address for a privacy question about this game.