Keeping your favourites and account safe

The free game starts with an anonymous browser session. The session token lets the server associate actions with that visitor. It is a credential: copying it into a message or publishing browser storage can expose the session.

An account helps you return from another device. Use the available Google sign-in or an existing password account. Email-code registration appears only when delivery is configured; the production server does not show login codes in an API response.

Favourites are saved choices, not ownership of the underlying photographs. They do not give permission to republish media. If a card disappears after a rights review, contact support with its ID. Include a request ID for an error and keep passwords and tokens private.