We don't save any meaningful data besides game runs, so on initial start, you request a unique ID from the server that is stored in a JSON file under appdata. This unique ID is not exposed through the API and used as an identifier in case you want to update your username.
It's semi secure, but good enough for the data stored and has the neat side-effect that you don't need to sign up or login or anything, without having to collect or store a device ID (which also has all sorts of data privacy hassles connected).
- Laura