Privacy policy

The short version

• You can play everything without an account, and no data about you is stored on our servers when you do.
• An account is an email address and a password, used only to sign you in.
• Analytics are anonymous page counts with no cookies and no cross-site tracking.
• There are no ads, no ad networks, and your data is never sold or shared for marketing.

Playing as a guest

Your progress on a puzzle — the squares you have filled, the words you have guessed — is kept in your own browser’s local storage, on your device, under a key for that puzzle and date. It never leaves your device except as the content of a submission (your current board) that the server checks and does not store. Clearing your browser data removes it.

If you create an account

Sign-in is by email address and password, handled by Supabase Auth on our behalf. Supabase stores your email and a hash of your password; we never see the password. A session cookie (named sb-…-auth-token) keeps you signed in; it is strictly necessary for the account to work and is the only cookie the site sets.

With an account, the site stores:

• A username and optional display name, which are public: they appear on the leaderboard and on any playlists you make public.
• Your puzzle sessions — which puzzles you played, your entries or guesses, and when you finished — which is what a streak, a daily score and a leaderboard rank are computed from.
• Playlists you create, private by default.

Session data is cached briefly in Upstash Redis to keep the site fast; the cache holds nothing the database does not.

Analytics

The production site loads Umami, a privacy-focused analytics service, to count page views and see which puzzles are played. Umami sets no cookies, stores no personal data, and does not track you across other sites; IP addresses are not retained. It is not loaded at all on preview or development builds.

Where data lives

The site is hosted on Vercel and its database on Supabase, both in the European Union (Frankfurt). Those providers process data on our behalf under their own privacy terms.

What we do not do

• No advertising, ad networks, or retargeting pixels.
• No sale, rental or sharing of personal data for marketing.
• No social-media embeds or third-party scripts beyond those named above.
• Nothing identifying in a “Report a problem” link: it carries the page and the date, not you.

Your rights

You can see and change your username and display name in your account. To export your data or delete your account and everything stored under it, email miradil.zeynalli@gmail.com from the address you signed up with; deletion is carried out within 30 days and removes your leaderboard entries with it. If you are in the EU or UK you have the rights the GDPR gives you, including to complain to your data protection authority.

Children

The site is suitable for all ages, but accounts are for people aged 16 or over. Younger players can play everything as a guest.

Changes

If this policy changes, the date at the top changes with it. Anything that affects account holders materially will be announced on the site before it takes effect.

See also the terms of use and about page.