Privacy
What Skulls stores, what it does not, and who can see it. Written to match the code; last changed 13 November 2026.
What is stored on the server
- Your account: the name you chose, your password as a one-way hash (the password itself is never stored), the day you joined, and a random 12-digit ID.
- Your profile: your bio, wall colour and effect, your character's look, the furniture of your room, and the pictures you upload (profile photo, banner, house icon, pictures in chat).
- Sign-ins: for each device, when it signed in, when it was last used, and the browser's name, so you can see and end them. They end after 30 days.
- Houses: rooms, roles, members, bans, mutes, reports, and a log of what staff and members did (last 500 entries per house).
- Messages: the last 500 messages of each room and direct chat, their reactions, and which message you last read in each room.
- Friends and blocks: who you are friends with, open requests, and who you blocked.
- Recovery codes as one-way hashes.
What is not stored
- Voice and shared screens. They go straight from browser to browser, encrypted, and never pass through the server. The server only helps the browsers find each other. (To connect directly, the people in a room learn each other's network address, as in any voice call.)
- No e-mail address, phone number, real name, birthday or location is asked for.
- No advertising, no trackers, no analytics.
- Where you walk in a room is passed on to the people in that room and then forgotten.
Pictures
Before a picture leaves your device it is shrunk and re-encoded, which removes hidden data such as the place it was taken. Pictures are served only to signed-in people.
Who can see what
- Your profile and your room: people who share a house with you, and your friends. You can close your room.
- Messages in a room: the people who may enter that room. Direct chats: you and that friend.
- Reports you send: the staff of that house, with your name.
- The person who runs the Skulls server can read what is stored on it.
Other services your browser contacts
The pages load everything from the Skulls server itself: no outside fonts, scripts or trackers. One exception: to set up a voice connection your browser asks a public address-discovery server (STUN) run by Google what your network address is. That server sees your address, as any website you visit does, and nothing about your account.
YouTube videos in a room. People can play a YouTube video for a room. It is shown by YouTube's own player (in its "no cookie" mode), so your browser then connects to YouTube, which sees your address and what is played. The player is not loaded in your browser until you press "Play it here" (or start a video yourself). The Skulls server only asks YouTube for the video's title.
Your choices
- Delete any message you wrote, take down any picture you uploaded, leave any house, remove or block anyone.
- End any device's sign-in, change your password.
- Delete your account (Profile → Account): your houses, your room, your messages, your pictures and your friendships are deleted from the server at once.
Cookies
One cookie keeps you signed in. Your browser also remembers which house was open last and your character's look. Nothing else.