Privacy

What we store

• Your email address. Used only to send you the one-time sign-in link and to recognise your account when you come back.
• Your nickname and avatar. The display name and pixel-art icon you picked at signup. Shown on shared scores and in your play history.
• Your play history. One row per finished game: which module, when, your score, the outcome (won / lost / walked away), and which lifelines you used. This is what drives the per-module notes unlock and your score history.
• A signed session cookie. A small token that tells the site you're logged in. It expires after 30 days of inactivity and is never read by anyone else's site.

What we don't store

• Tracking cookies or cross-site identifiers. No Google Analytics, no Facebook pixel, no Mixpanel, no ad networks. The analytics we do use (see below) are cookieless and anonymous, so there's no cookie banner.
• Behavioural profiling. The only third-party scripts are Google's font CDN and Cloudflare's cookieless Web Analytics beacon — neither builds a profile of you or follows you across the web.
• Your IP address, beyond the short-term cache used to rate-limit sign-in emails. That cache resets after 15 minutes and is never written to disk.
• Anything we'd share with, sell to, or give to anyone outside the project. We don't have advertisers, partners, or data deals.

What we measure

To see what's working and what to fix, we measure usage in two ways — both anonymous and aggregate. Neither uses cookies, so there's no cookie banner, and neither can tell who you are or whether you've played before.

• Cloudflare Web Analytics. Cloudflare (the service that hosts this site) counts page views and visits and notes rough referrer, country, and device type. It's cookieless, doesn't fingerprint your browser, and doesn't store your IP address.
• First-party gameplay events. When a game starts and finishes, we record the module, the outcome (won / lost / walked away), and the score to our own Cloudflare Analytics Engine. No name, email, IP, or account id is attached — just anonymous counts that tell us which modules get played and finished.

Who can see your account data

The admin (Aasif) can view your email, nickname, avatar, and play history for troubleshooting and to improve the game. No one else has access. There is no team, no third-party processor, and no shared dashboard.

How long we keep it

• Account data — until you ask us to delete it. We don't auto-prune dormant accounts (yet).
• Sign-in tokens — the one-time link tokens are deleted after they're used, or expire after 10 minutes if unused.
• Rate-limit counters — auto-reset on a 15-minute window.

How to delete your account

Email aasif@aasifj.com from the address on your account with the subject "Delete my account." Everything — email, nickname, avatar, play history — gets wiped within a few days. A self-serve delete button is on the roadmap; until then, this is the manual path.

Guests

Play as Guest doesn't create any server-side record of you. Your in-progress game and any finished sessions live in your browser's sessionStorage and disappear when you close the tab. If you sign in later in the same tab, those completed sessions get folded into your new account's history so you don't lose them. After that, the local copy is cleared.

Contact

Questions, concerns, or anything that sounds off — email aasif@aasifj.com or open an issue on the GitHub repo.