diff --git a/apps/accounts/src/accounts.app.ts b/apps/accounts/src/accounts.app.ts
index dfd9fa0..c3a901b 100644
--- a/apps/accounts/src/accounts.app.ts
+++ b/apps/accounts/src/accounts.app.ts
@@ -209,9 +209,15 @@ const app = new Hono<App>()
 		return c.json({ accountId: id, disallowInAppPurchases: false })
 	})
 
-	// Privacy settings for an account. The client deserializes this into an
-	// object, so it must return `{}` (not `[]`).
-	.get('/accountprivacysettings/:id', (c) => c.json({}))
+	// Privacy settings for an account. A bare `{}` fails the client's deserializer
+	// ("Deserialization returned null") — it needs the fields, so echo the id back and
+	// report recent history as visible. Nothing stores per-player privacy yet.
+	.get('/accountprivacysettings/:id{[0-9]+}', (c) =>
+		c.json({
+			accountId: Number.parseInt(c.req.param('id'), 10),
+			isRecentHistoryVisible: true,
+		})
+	)
 
 	// ---- Profile mutations ---------------------------------------------------
 	// Set the player's display name (persisted on the account row).
diff --git a/apps/accounts/src/test/integration/api.test.ts b/apps/accounts/src/test/integration/api.test.ts
index 76742ff..468fbf2 100644
--- a/apps/accounts/src/test/integration/api.test.ts
+++ b/apps/accounts/src/test/integration/api.test.ts
@@ -177,6 +177,13 @@ describe('auth-gated endpoints', () => {
 		expect(await res.json()).toEqual({ accountId: 42, disallowInAppPurchases: false })
 	})
 
+	test('GET /accountprivacysettings/:id echoes the id with the privacy flags', async () => {
+		// A bare {} fails the client's deserializer, so the fields have to be there.
+		const res = await exports.default.fetch(`${ORIGIN}/accountprivacysettings/145`)
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ accountId: 145, isRecentHistoryVisible: true })
+	})
+
 	test('PUT /account/me/displayname 401s without a token', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/account/me/displayname`, {
 			...form({ displayName: 'Bob' }),