How can we help?

The games in our library

Esma3 Kitaab has 31 games, one on each story, and we made all of them ourselves. They sit on our own server and open inside our pages, so you never have to install anything.

• Always free: no game has a price, subscription or paid extra.
• No account needed: every game starts immediately, signed in or not. A profile adds a saved coin balance, a rank and a daily bonus.
• Make-believe money: coins are just for fun. They can't be bought, sold, passed on or cashed out.
• Plays anywhere: use a phone, tablet or computer with a current browser. Full screen gives the best view.

Profiles, coins and ranks

• Joining: use an email address and password, or your Google account. You need to be 18 or older, and we ask for a UK mobile number.
• Starter coins: each new profile begins with 50,000 coins.
• Daily bonus: collect 10,000 free coins from My profile once every 24 hours.
• Ranks: opening a game while signed in earns 10 XP (each game counts once per 30 minutes). There are 10 ranks from Newcomer to Grand Archivist, and every promotion adds 5,000 coins.
• Forgotten your password? Use the contact form and choose "I've lost my password" and we'll help you back in.

How we guard your login and details

Everything about your profile is handled by our server. It is never kept in your browser and never appears in a public table or listing.

• Private storage: each profile is a separate protected file in a folder shut off from the web. Browsers can't open or list it, and the file itself refuses to load if someone tries. There is no public-facing database, and no profile data, tables or queries are displayed anywhere on the site.
• Password hashing: before anything is saved, your password goes through PHP's built-in bcrypt hashing. It can't be reversed, even by us.
• Session protection: signing in gives your browser one essential session cookie. Scripts can't read it (HttpOnly), it only travels over HTTPS (Secure), it carries SameSite protection and it gets a fresh ID at every sign-in.
• Brute-force lock: five wrong passwords in a row blocks sign-in to that profile for 15 minutes.
• Google check: if you use Google, our server verifies the sign-in token with Google before accepting it. We only receive your name, verified email and Google account ID.
• No payment data: we never request or hold card or bank details, because there is nothing to pay for.

How our forms work

Every form on Esma3 Kitaab (join, sign-in, contact and Player Care) is processed on our server.

• Your browser passes the form to us over an encrypted HTTPS connection.
• The server checks what you entered, then either saves your profile or sends your message.
• Contact and Player Care messages travel from our server to our team inbox through an authenticated mail service, with your address as the reply-to so we can answer you directly.
• A private note of every submission goes into a protected server log (passwords are never recorded). It can't be reached from the web and is deleted when it is no longer needed.
• Hidden spam traps keep bots out without making you solve puzzles.

Our policies at a glance

Fixing common problems

• A game won't load: press Restart above the game, check your connection and update your browser. Ad blockers and script blockers sometimes get in the way.
• I can't sign in: use the same method you joined with (email or Google). After five failed tries, wait 15 minutes.
• My coin total looks wrong: balances are stored on our server. Sign out and back in, and if it still looks off, tell us.
• The age question keeps appearing: your browser may be blocking site storage, for instance in private mode. Just answer it again.

Still need a hand?

Use the contact form or the Talk to Player Care button at the bottom of every page. A real person reads every message, normally within two working days.