Safety
Protected accounts. Server-validated matches.
AeroRival limits the data sent to each player, enforces online match rules in the API, and provides clear controls for account sessions.Protection designed around the game
No internet-connected application can promise zero risk. Below we describe the safeguards in place, the data other players can see, and what you can do to protect your account and private-room invitation.
Fair play
In online rooms, the interface displays only the state that the API allows each player to receive.
The opposing fleet stays hidden
Before the match ends, the API does not send the complete opposing fleet. You see attack results and aircraft already destroyed, not positions that should remain secret.
Server-validated rules
The API validates board size, all three aircraft, overlaps, the current turn, repeated attacks, and the winner.
Transparent result
After the match ends, both players receive the complete boards so they can review both fleets and every attack.
Account and session
Authentication keeps sensitive credentials out of storage that page scripts can access.
Password and email
Passwords are not stored in plain text. Online play requires a verified email, and the account provides password reset and change flows.
Protected session
The access token is short-lived and remains only in memory. Session restoration uses a rotating HttpOnly refresh cookie; “Remember me” moves expiry to 30 days after every successful refresh.
Session controls
You can sign out of the current session or every device. Resetting the password invalidates all active sessions.
Private rooms and visible data
Restricted access reduces exposure, but an invitation is only as private as the people with whom you share it.
Private invitation
A room accepts exactly two authenticated, verified users. Its code or link is not publicly listed, but it should be sent only to the person you want to play.
Minimal player data
Your opponent sees your public name, username, and room status, not your email address. To resume a room, the browser stores locally only its identifier and invitation code.
Report responsibly
Use the Contact page for unexpected behavior or a security concern. Do not send your password, tokens, complete room code, or another person’s data.
Have you noticed a security problem?
Tell us what happened, which page you were using, and the approximate time, without including passwords, tokens, or another person’s data.