Security model
The design assumes a hostile client — reading the network, editing code, replaying requests — and stays correct anyway.
Hidden information stays on the server
A concealed value is released only for a position the server's replay has proved that player reached, never because the client asked. A rewritten client plays under the same uncertainty an honest one does.
The server replays the match
The deal is fixed before either player sees a card, and every move is replayed server-side against it — that replay's score is the score; the client's own scoring has no authority. A hash chain seals the move sequence for integrity and sync only.
After both players finish, the deal is released so a player can re-derive and re-score it themselves. We do not publish a commitment to the deal before play — “fixed before either player saw a card” is stated, not verifiable.
We are not certified
No independent testing-lab certification and no authority approval, for any game — that requirement is yours to satisfy. Raise it early and we will say plainly what we can document.
Both players get the same deal
A match is one deal played by two people — except in Spades, where each also sees their bot partner's hand while the opponents' stay concealed. Neither can be dealt a better game, and a loser can watch the winner's replay of the same cards. That is narrower than “luck plays no part”: once players diverge, one can take on variance the other avoided.
What a finished match is reused for
One thing crosses the boundary between accounts: a finished match's deal and score can be served, read-only, as a practice opponent — ours or another partner's. That pool is shared across operators, with nothing at stake in it.
- Nothing is written back — no rating, counter, or record against your player. Practice is not a match.
- The name shown is the one on the match — your displayName from mint. Omit it at first mint to keep a player's name off another platform's board; a nameless account gets our own handle. See Identifying your player.
- The deal was already released to those who played it — never reused for a new match.
What this means for you
- You do not have to trust our client, because we do not either.
- No fraud tooling needed for the game layer: a dispute is a question we can answer from the replay record — ask your platform contact. No partner-facing route returns a replay.
- Session tokens are short-lived and scoped to one game, so a leak cannot reach another game or player.