Play
The server decides↑
Everything that matters is worked out on the server inside a transaction: catches, rewards, prize money, route unlocks, the Worlddex registry. Anything valuable is rolled with a cryptographic random source rather than an ordinary one.
Autoclick detection↑
The gap between clicks is measured on the server, never trusted from the browser. Clicking inhumanly fast is refused.
Your account↑
Sessions are held in a cookie the page itself cannot read. Passwords are hashed. A lost password is reset by email.
Backups↑
The player database is backed up hourly and again before every deployment, and deployments cannot overwrite it — uploads land in a separate folder from the database on purpose.