Atlas of Doors

Atlas of Doors is a free to play browser game: nothing in it is behind a wall, and the only thing sold is an optional Diamond Key, on the web, at a price you can see before you pay. Playing it produces gameplay data. This page sets out, in plain language, what that data is, what we do with it, and what an anonymous device id means.

What we collect

As you play, we record your in-game events and choices, for example:

• which door you open and which card you play
• fight outcomes, run progress, and the timing of these actions
• whether you interacted with a screen before leaving it, and how long that took. On the path-choosing screen, if your tap landed on something that does nothing, we also record which part of the screen that was — one of ten fixed words such as "the heading" or "beside the planks". It is recorded only when the tap did nothing, never when you actually chose something. Your device works the word out and sends only the word: no tap position, no coordinates, and nothing written on the screen ever leaves your device. It exists because more new players tap that screen and get nothing back than manage to tap a path, and until now we could see that it happened without being able to see where
• on the map screen, what kind of thing your first touch landed on — one of seven fixed words: a door, the explanation note, the close button on that note, the top bar, a line of text, the tall Descent pillar on your first map, or nothing at all. It is the KIND of thing, never which particular door and never anything written on it. Your device works the word out and sends only the word: no tap position and no coordinates. It exists because first-time players who pick one particular starter deck reach the map just as often as everyone else and then open a door far less often, and we can currently see that they reached out without being able to see what they found
• a coarse device bucket (mobile or desktop) and a rounded screen width
• which browser family you play in and its main version number — "Samsung Internet 25", never the full version string and never the detailed description your browser sends, which can name your exact phone model. We record it because players on one browser were finishing far fewer runs than everyone else and we had no way to ask whether an older version was the reason
• whether one visual effect (the frosted glass behind the game's menus) rendered fully, fell back to a simpler version your browser supports, or was switched off because you asked for reduced transparency. It is a single letter describing what got drawn, not anything about you
• whether your device asks for reduced motion, so we can check the game reads well with the animations turned down
• a coarse band for how fast your connection is (for example "slower than 0.5 Mbps"), and how long the game took to become playable, so we can tell a slow load apart from a game nobody wanted. We record the band, never a precise speed measurement, and some browsers do not report this at all
• the country your connection is coming from, worked out by our hosting provider from your network address at the moment your device asks for the page, and stored as a two-letter country code only. We never store your network address itself, and we never keep a city or any coordinates — those are offered to us for free and we deliberately throw them away. The country exists for one reason: the game takes noticeably longer to load in some parts of the world than others, and without it we cannot tell "our game is heavy" apart from "this player is a long way from the nearest server". Your browser is never asked for your location and no permission prompt is involved
• how the game performed while you played: how long the slowest single tap took to respond, whether the screen shifted around while it was loading, how smoothly the animation ran, and how many kilobytes your device had to download. We record how big and how slow things were and what KIND of file the slowest one was (a picture, or code) — never the addresses of the files themselves. For the few slowest taps we also record which button or card the tap landed on and which screen it was on, as the element's technical name from our own code (for example the name of a button), along with how the waiting split between the game being busy, our code running, and the screen redrawing. We never record the words on that element, anything you typed, or where on the screen your finger was. When a tap had to wait on the game's own code, we also record which of our code files was running and the name of the function inside it. That is the single exception to the line above about file addresses, and we draw it deliberately: these are about a dozen file names we wrote ourselves, identical for every player who reaches that screen, and knowing which one was busy is the only way to turn "this tap took half a second" into something we can actually fix. It is never the address of a picture, never a page you visited, and never anything from your address bar
• whether the game finished loading before you left. If you close the tab while it is still loading, we send one note saying how long you waited and how far the loading had got. This is the only way we can see people who leave before the game starts — until we added it, those players were invisible to us and we had no way of knowing how many there were
• a diagnostic report when the game crashes on your device: the error message and the technical stack trace the browser produced, which part of the game it happened in, and the game version. Web addresses inside that report are stripped down to the page path before it is sent, so nothing from the address bar travels with it, and we send at most a handful per session rather than one per crash. This exists because a crash used to reach us only if a player thought to tell us
• a count when your browser reports something that is not a crash: browsers also raise notices that nothing actually broke — the commonest is one saying it needed an extra frame to finish measuring the layout — and a note when a script from somewhere other than us fails in a way the browser will not describe. We send the notice's own wording and the page path, once per kind per session, and never a stack trace. We keep counting these instead of ignoring them because it is the only way to tell "we fixed it" apart from "we stopped listening"

Each event is tagged with an anonymous device id: a random identifier created and stored in your own browser. There is no login. We do not ask for, and the game does not record, your name, email, password, or phone number.

What we do with it

We store this data on our servers and keep it. We use it to understand how people play, to balance and improve the game, and to design new content. The balancing only ever looks at how everyone plays in aggregate. It is never tuned against a single player.

What an anonymous device id means

The device id is a random value kept in your own browser's storage (its local storage, with a backup copy in the browser's on-device database so it survives routine cache cleanup and we don't miscount a returning player as a new one). It is not your name, your email, or an identity built from your IP address, and we cannot use it to contact you. If you clear your browser's site data, or play from a different browser or device, a new id is generated, and we have no way to connect the old one back to you.

Email and sign-ups

The game itself never asks for an email to play. From time to time we offer separate, clearly labelled forms, such as a feedback survey or a live-stream sign-up, where you can choose to give an email for that one stated purpose. Those forms are kept apart from the anonymous gameplay data above.

Accounts and comments

If you choose to comment on an update or a dev-log article, you first create a comment account. You can sign up with an email and password, or sign in with Google. This is separate from playing: the game itself stays anonymous, and you only make an account if you want to post.

For a comment account we store your email address, used to sign you in, confirm the address, and reset a password. We also store a display name you pick or that we take from your Google profile, and the comments you post. Your comments and display name are public; your email is never shown to other players. If you sign in with Google, we receive your basic Google profile for this purpose only.

You can delete your comments, and you can ask us to delete your account and everything tied to it, at any time.

Email about new seasons

There is one optional email we may send you beyond the account mail above: a note when a new season opens. It is off unless you turn it on. Nothing is ticked for you, and creating an account does not sign you up for it.

You can turn it on or off at any time from Settings, under "After you're registered", and every message we send carries a way out. Switching it off takes effect immediately and does not affect your account, your progress, or your comments.

We record when you made that choice and the exact wording you agreed to, so that what you consented to stays a matter of record rather than of our memory. If you never answer, we treat that as a no.

Advertising cookies (our marketing partners)

We buy adverts to find new players, and we work with third-party advertising partners to measure which of those adverts actually work. Today our advertising partners are Reddit and TikTok. Both are measured the same way, under the same choices and rules described below, and one answer on the cookie bar covers both. A yes covers only the partners the cookie bar named when you gave it: if you said yes before TikTok was added, TikTok receives nothing until you answer again. If we add others in future, we will name them here and on the cookie bar first.

To learn which adverts bring people who actually play, we can let Reddit and TikTok each set a measurement cookie in your browser (the Reddit Pixel and the TikTok Pixel) and send each of them a note at five moments: when you start a run, when you reach the second floor, when you finish a run however it ends, when you win one, and when you come back to play on a later day.

This happens only if you say yes on the cookie bar. Saying no is one tap on that same bar and is remembered just the same, so you are not asked again. Until you answer, no cookie is set and nothing is sent. The game is identical either way.

If you would rather choose in detail, "Manage options" splits this into six parts you can switch on or off one at a time: the Reddit and TikTok measurement cookies themselves; which advert brought you; your play milestones (starting a run, reaching the second floor, finishing a run, winning, and coming back on a later day); device matching (your screen size and Reddit's and TikTok's own ids); and sharing and selling to other companies, both described on their own below. "Accept all" turns all six on together; "Reject all" leaves them off. Each part is off until you turn it on, and you can leave the last two off while keeping the others on.

Recording your screen while you play

This one is not about adverts at all, so it is its own switch and is off unless you turn it on. Switching it on lets Microsoft Clarity save a replay of your session: what was on your screen, where you tapped, and how far you scrolled. We watch those replays to find the places where the game confuses people, which a list of numbers cannot show us.

What is recorded. The screens the game drew and your taps and scrolls on them, plus the anonymous device id already described above, the game's version, which screen you were on, and the name of the run. Text is masked before it is recorded, so anything you type is never captured. There is no camera, no microphone, and no recording of anything outside this page.

Where it goes and how long it lasts. To Microsoft, who run Clarity and can access what it records. They keep a replay for 30 days and the heatmaps for nine months, after which the replay is gone; we cannot extend that, and we do not keep our own copy. What Microsoft does with it is governed by the Microsoft privacy statement. Saying yes sets two cookies on this site: _clck and _clsk, which let Clarity tell one session from the next.

To change your mind, open Settings, then Cookies, and switch screen recording off. The recording stops immediately and both cookies are removed. Replays already saved sit out their 30 days at Microsoft.

Sharing and selling to other companies

The four measurement parts above are about our adverts: they let us, Reddit and TikTok work out which advert found a real player. This one is a different question, so it is a separate switch and we describe it separately.

Switching it on gives us permission to pass that measurement data to other companies, including selling it to them, for their own purposes rather than ours. Those are purposes we would not control and cannot describe in advance, which is exactly why it is not bundled into the others.

We are not doing this today. No company receives this data, and nothing is being sold. The switch exists so that, if we start, we already have your answer on record rather than assuming it. If we do start, we will name here who receives the data and for what, before anything is sent.

It is off unless you turn it on, "Accept all" turns it on along with the rest, and you can turn it back off at any time in Settings, then Cookies. Turning it off stops any future sharing; it cannot recall data already sent, which is another reason we would rather ask you plainly now.

When you say yes, Reddit sets two cookies on this site: _rdt_uuid, an identifier Reddit creates, and _rdt_cid, the id of the advert you arrived from, if any. At each of those moments we tell Reddit which moment it was and when, together with those identifiers, your screen size, your network address and your browser's description of itself, so that Reddit can match the visit to the advert. We pass the network address on to Reddit for that purpose only; we do not store it ourselves, and none of this is joined to the anonymous play statistics above or to any account.

TikTok works the same way. When you say yes, TikTok sets its cookies on this site: _ttp, an identifier TikTok creates, and _tt_enable_cookie and ttcsid, which tell one visit from the next. If you arrived from a TikTok advert, we keep that advert's id (ttclid) in your browser's storage. At each of those moments we tell TikTok which moment it was and when, together with those identifiers, the page address without its query, your network address and your browser's description of itself, so that TikTok can match the visit to the advert. We pass the network address on to TikTok for that purpose only; we do not store it ourselves, and none of this is joined to the anonymous play statistics above or to any account. We never send TikTok an email address, a phone number or an account id.

What Reddit does with what it receives is governed by Reddit's privacy policy; what TikTok does with it, by TikTok's privacy policy. TikTok may process this data outside the European Economic Area. We use it for one thing: to see which adverts are worth paying for. We do not build audiences from it to follow you around with adverts.

To change your mind, open Settings, then Cookies, and switch ad measurement off. That stops both scripts and removes their cookies immediately. Your answer, and when you gave it, is kept in your browser's storage so we do not ask twice; clearing the site's data clears it too.

Saving your progress

The game is playable without an account, and by default your progress lives only on the device you play on. If you want it kept somewhere safer, you can save your progress to an account from the settings menu, using the same email-and-password or Google sign-in as above.

In the App Store app you sign in with Apple or Google instead, from the same place in Settings. With Apple, we receive an account id from Apple, the email address Apple shares with us (Apple lets you hide your real address behind a private relay address, and we only ever see the address Apple gives us) and, the first time only, the name you let Apple share. With Google, we receive your Google account id, email address and basic profile name. We use them only to sign you in and keep your progress, exactly as above; they are never used for advertising or tracking, and never joined to the anonymous play statistics.

When you do, we store your game progress — the Keys, perks, Pacts, Codex entries, records and Descent frontier your Atlas has accumulated — against your account, so you can pick it up on another device. That is all it holds: no in-progress run, no messages, and nothing about how you played beyond what your Atlas already shows.

Your saved progress is kept separate from the anonymous play statistics described above. We do not link the two, and we cannot tell from those statistics which account a player belongs to.

You can sign out at any time, which leaves your progress on the device untouched. Deleting your account deletes your saved progress with it.

Deleting your account

If you made an account, you can delete it yourself, in the game, in one tap. It is the same in a browser, from the home screen, in the App Store app and in the Google Play app.

How: open Settings, tap Delete account, then confirm. It happens straight away, not in 30 days, and you see Your account is deleted. when it is done. On the website it is the same: sign in at play.atlasofdoors.com, open Settings, tap Delete account.

What is removed: your sign-in (the email address and the account itself), your display name, your forum comments and reports, and the progress saved to the account. If you signed in with Apple, we also ask Apple to cancel the sign-in it gave us.

What stays: the progress saved on this device stays on this device; if you want that gone too, uninstall the app or clear the site's data in your browser. Diamond Keys you bought stay with the device that bought them, and the record of the payment itself is kept because tax law requires it, but it is no longer linked to any account. The anonymous play statistics described above were never linked to the account, so there is nothing there to remove.

If you cannot sign in any more (a lost password, a closed email address), send us a message through the feedback page saying Delete my account with the email address the account is registered to, or write to pumanitro@gmail.com from that address. We confirm with you at that address and delete the account within 30 days.

Buying Diamond Keys

Who you are buying from. Atlas of Doors is made and sold by Software Home Patryk Janik, a sole proprietorship registered in Poland, whose registered address is Bielkowo 9c, 73-108 Bielkowo, Poland, reachable at pumanitro@gmail.com and through the feedback page. Payments are processed by Stripe; we never see or store your card number. The charge appears on your statement as SOFTWARE HOME IIJ.

What a Diamond Key is. A Diamond Key is an in-game item. You can earn them by playing: every Descent V win pays one, with no cap and no limit, and a season's first Descent III win pays one as well. You can also buy them. Diamond Keys buy exactly these things in the game: a revive when a run ends (2 keys); an Heirloom, which is a card you choose and then start every run with (7 keys); the Verge deck (7 keys); and, once you have won Descent V, a climb into the Deep, the descents past V (3 keys each time you go one descent deeper). The Heirloom and the Verge deck are bought once: after that you can change which card the Heirloom is as often as you like, and that costs nothing. They buy nothing else. It can never be exchanged for money, transferred to another player, or cashed out, and it never changes your odds or the game's difficulty.

Prices. Diamond Keys are sold in packs: 2 keys for $1.99, 7 keys for $4.99, 16 keys for $9.99 and 44 keys for $19.99. There is no way to buy a single key. The smallest pack works out at $1.00 a key, and the bigger packs cost less per key; every pack shows its own per-key rate beside it in the game, so you can compare them without doing the sums. The price you see is the price you pay: any tax that applies is already included, and nothing is added at checkout. Prices are set in Polish zloty, and the dollar price is fixed beside them: a dollar buyer pays exactly the figure above, not a conversion of it. Where Stripe cannot offer your own currency (for example in Egypt, Iraq or Nigeria), you are charged the dollar price above, exactly as the Vault shows it. At checkout Stripe, our payment provider, may offer you the price in your own currency, and that is also what lets it offer the payment methods used in your country. The amount in your currency is worked out by Stripe at its exchange rate, which includes a conversion fee of 2 to 4 percent that goes to Stripe, not to us; the exact amount is shown before you pay, and the Pay button names it. You can always switch back to the original price in the currency selector on the same screen, in which case your own bank may apply its conversion instead. Apart from that conversion, the price is the same for every player: we do not set prices per person, and we never change a price based on how much you have played or spent.

Delivery, and the 14-day withdrawal right. Diamond Keys are delivered immediately, as soon as the payment succeeds. Because this is digital content delivered at once, the checkout asks you to tick a box confirming that you ask for immediate delivery and acknowledge that you lose the 14-day right of withdrawal. That tick is required before the payment goes through, and the exact wording you ticked is recorded against your payment, together with the time you ticked it. Your claim code is shown on screen straight away and again every time you open the Vault. If you want a written copy of what you agreed to, write to pumanitro@gmail.com with that code and we will send it. This is the arrangement described in Article 38(1)(13) of the Polish Consumer Rights Act. Without that tick, nothing is charged and nothing is delivered.

Refunds. If something goes wrong, write to pumanitro@gmail.com with your claim code and tell us what happened. We refund in full where keys were charged for and not delivered, where you were charged twice, or where the game was at fault. A refund returns the whole pack: we do not refund part of one. What a refund does to your keys: a refund takes the pack's keys back. The pack leaves your purchase record, so its claim code stops working, and the next time the game on the device you bought on talks to our server, those keys come off your Diamond Key balance. If you already spent them, your balance goes below zero and you cannot spend Diamond Keys until play earns the difference back. This applies to refunds through the App Store, Google Play and the website alike. Nothing you earned by playing is ever affected by a refund. Your statutory rights are not affected by anything on this page.

Getting your keys back on another device, or after clearing your browser. Bought keys belong to the purchase, not to the browser. There are two ways to restore them, and you do not need an account for either:

• The claim code. Every purchase gets an 8-character code. It is shown when you buy and again every time you open the Vault on the device you bought on, so you do not have to write it down in the moment. On another device, open the Vault, tap Restore, and type it in. The keys reappear. If you lose the code because you cleared that browser, write to us with the date and amount of the charge and we will look it up.
• Sign in. If you were signed in when you bought, the purchase is attached to your account and appears on any device you sign in on.

Your keys never expire and never lose value. Diamond Keys are not tied to a season. A new season resets Keys, the Keyring and your Descent progress; it does not touch Diamond Keys, and it does not touch anything you bought with them. We will never raise the price in Diamond Keys of something you have already bought keys for. Prices in Diamond Keys can go down. They will not go up.

The cookie the payment form sets. When the checkout form loads, Stripe sets a cookie called __stripe_mid on this site, and sometimes __stripe_sid. These are strictly necessary for fraud prevention: they are how Stripe tells a real purchase from a stolen card being tried on a hundred sites. They are not advertising cookies, they are set by Stripe rather than by us, and they carry no part of your game data. They load only when you open the payment form, never just from playing. They are not covered by the cookie bar described above because a payment cannot be processed without them; if you do not want them, do not open the payment form.

Children. The shop is for the person paying. Use only a payment method that is your own. We never tell a player that they need to buy anything, we never suggest that someone else should pay for it, and we never put a timer or a countdown on a price.

Where you can buy. Diamond Keys are sold on the website, in the App Store app through Apple In-App Purchase, and in the Google Play app through Google Play billing. The version on CrazyGames does not sell anything. Keys you earned by playing work everywhere.

Changes

We may update this page as the game grows. The version published here is the one that applies.

Google Play and the Google Play logo are trademarks of Google LLC. Apple and the App Store are trademarks of Apple Inc.

Last updated October 2026.