This platform

Privacy

What this site comes to know about you, how it comes to know it, and what can be taken away again. Everything below describes something the software actually does — where it does not do a thing yet, this page says so rather than promising it.

Playing without an account

You never need an account to look around or to play. The first time you arrive, this browser is given a cookie holding 32 random bytes and nothing else. From it we work out an opaque key, one way only, and that key — not the cookie — is what this browser's activity is recorded against: a page opened, a game loaded, an attempt begun or finished, a score. This page counts as a page opened, like any other.

If you set a score, the board shows a name invented for that browser, like WakingOsprey196. It is worked out from the key every time it is shown and is never stored anywhere, and it stays the same for as long as the cookie lasts, which is what lets you find your own row again next week.

What this site keeps in your browser

This is the whole list of what we put there. None of it carries an advertising identifier, because there is no advertising here.

__gf_sid — 400 days: Which browser this is. Set by our own measurement service on its own hostname, unreadable by any script on the page, and sent only to us.
__gf_player — 30 days: Your signed-in session, and only if you are signed in. The 30 days move forward each time you use the site, and never past 180 days from the sign-in that started it. Signing out ends it immediately.
__gf_player_csrf — the same lifetime: A value your browser hands back to us so we can tell a form you submitted from one another site submitted for you. Readable by this page's own scripts, on purpose — one nothing can read is one nothing can send.
gf.session and gf.buffer — this tab only: The current visit's id, and anything measured but not yet delivered. Both are gone when the tab closes.
gameflow.leaderboard.display-name — until you clear it: The last board name we told you, remembered so a board can point at your row on a later visit. It is a public name and not a credential.

What an account holds

Your email address: The one you registered, or the one Google gives us. It is what a confirmation or a password-reset link is sent to, and it is what makes two sign-in methods one account.
Your password, as a hash: We never hold the password itself, and cannot recover it or tell you what it was.
The name you chose: Up to 40 characters. This is the name a board can show — see below.
A Google account id, if you attached one: The opaque id Google issues for you here, your address, and the name on that Google account. Nothing else, no access to anything else, and no profile picture: we do not read one and have nowhere to put one.
Which browsers belong to you: The opaque keys above, for every browser you have signed in on.
Your sessions: As hashes of the cookie rather than the cookie itself, with when each was opened, when it expires and whether it was signed out. Expired rows are deleted outright a month later.
An age band and a gender, if you chose to give them: Both optional, both blank until you answer, and both withdrawable. See below.
When you last answered those two questions: A moment in time, written every time you save an answer — including the save that clears both. It records that you decided and when, never what you decided, and clearing the two fields above does not clear it.

Our servers see your IP address, as every web server does. It is used to slow down guessing against the sign-in and signup forms, where it is held for at most an hour, and it is written to our own server log when a sign-in is refused. It is never stored on your account and never reaches the measurement store.

Signing in puts your name on your past

This is what an account is for, and it is worth being blunt about. When you sign in, this browser's opaque key is attached to your account — permanently, because the measurement record is only ever added to and nothing rewrites it. Every score this browser has ever set, including ones set before the account existed, starts showing your name in place of the invented one. No score row is rewritten to make that happen; the name is worked out fresh each time a board is drawn.

A board shows your name only after you have confirmed that it is the name you want published. A name Google gives us is not published before then — a real name arriving on a public leaderboard nobody asked is exactly the thing that gate exists to stop.

Signing out ends the session and gives this browser a fresh key, so what you do afterwards is not attached to you — and where that second half does not land, the site says so rather than reporting a clean sign-out. It does not undo what came before: the key you were using stays attached to your account. That is deliberate, and it is also the honest limit of what signing out buys you.

A browser somebody else used

Sign in on a shared, borrowed or café browser and that attachment reaches backwards as far as that browser's cookie goes — up to 400 days. Whatever the last person played there without an account becomes part of your history, and their scores start carrying your name on public boards. Signing out bounds the other direction only: what happens next.

We would rather write that down than let you find it. If it happens, tell us: a member of staff can destroy the attachment, which makes that browser anonymous again for good and drops every board row it set back to an invented name. It cannot be attached to anybody, ever again — that is what makes it a remedy rather than a swap.

Age and gender

An account has two optional fields, an age band and a gender. Your profile page asks for both, and answering is optional — they start blank and stay blank unless you fill them in. They exist so we can say something about who plays these games as a group, and for nothing else: they are never shown on a board, never shown to another player, and never attached to a score.

The questions are only ever asked while you are signed in, because the fields live on the account row and there is nowhere to put an answer without one — so nothing asks an anonymous visitor. Both answers are picked from a fixed list rather than typed — seven age bands, four genders, no box to write in. Rather not say sits at the top of each list and is the blank rather than an answer of its own: choosing it stores nothing, exactly as never answering stores nothing.

Optional here is a property of the software and not a promise in this paragraph. One route records these two fields, it accepts no answer for either of them, and it is the only thing that writes them — so giving an answer and taking it back are the same single write. There is no separate withdrawal to go and find, and no state these questions can leave you in that you cannot leave again.

Two things that write does not undo, and you should have both. Saving records the moment you last decided, and clearing them is itself a save: the two fields go back to blank, that moment moves to the clearing, and the row goes on saying that you decided something and when — never what. And a deletion does not clear either field. The account row is kept, marked deleted and off every public surface, still holding whatever you last answered, where staff can read it; the section on deleting your account below sets out everything else that act does and does not reach.

What the measurement store holds

Play is recorded in a store of its own, separate from accounts. A row there carries the opaque browser key, which game and which version, what happened and when, the country your connection resolves to and whether the device is a phone, a tablet, a desktop or something we could not tell. It carries no name, no address, no account id, no IP address and no browser user-agent string.

Games are written by our own creators and a game may attach its own details to what it records. We refuse the property names that usually carry personal data and blank out values shaped like an email address, a phone number or a card number, and we mark the row when we do — but the precise claim, and the only one we will make, is that no platform-supplied identifier reaches the event store, and game-supplied properties are filtered on a best-effort basis. A game that was determined enough could still get past it.

Rows in that store are deleted by the store itself 13 months after the moment they describe. Separately, the raw batches your browser sends are archived to a file store as they arrive, and that archive is not on a clock — it is what lets us rebuild the measurement store after a bug, and nothing in this system can delete from it.

Deleting your account

There is no delete button, and there is no self-service route. A deletion is a request: write to [email protected]. A member of staff performs it by hand, and the platform records who did it, when and why.

What a deletion destroys, in one act:

the address and the password on every sign-in method on the account — overwritten in place, which is also what frees that address to be registered again, by you or by anybody;
the attachment between every browser you signed in on and the account. Those keys become anonymous again and can never be attached to anything;
every session the account holds, here and on our staff console. A browser still signed in stops being signed in on its very next request.

What a deletion leaves standing, and you should know all of it:

your scores. Board entries are neither removed nor rewritten. They fall back to the invented name, so anybody who held a rank keeps it, anonymously.
the account row itself, marked deleted, still holding the name you chose — and the age band, the gender and the moment you last answered them, if there were ever any to hold. It is off every public surface. Staff can still read it.
the sign-in rows, holding a placeholder where the address was;
a record of the deletion, which nothing can edit or remove;
the measurement rows, as anonymous residue, until they age out of the 13 months — and in the raw archive, which is not on a clock. Nothing re-attaches them to anybody.

Coming back means a new account and a new browser key. Nothing from before is joined to it, and that is the design working rather than a gap in it.

One lag worth naming: the deletion is immediate in the account database, and the counting side learns of it through a copy refreshed every five minutes, with a full rebuild weekly as a backstop. A "how many players" figure can still be counting the old attachment for some minutes afterwards, and for longer than that if the copy stops.

What this platform cannot do yet

There is no way to be sent a copy of your data. Nothing here answers that request today, and this page will say so until something does.
There is no page for editing your account, and no page for deleting it.
Choosing a new password does not end sessions already open on other browsers, and there is nothing here that ends them for you. Signing out on each of them does; so does deleting the account.
This page describes what the software does. It is not a statement of your rights under any particular law: we have not yet written down which law we hold ourselves to, and this page does not invent one.

Who else touches any of this

Render: Runs our servers and our account database, in Frankfurt.
Cloudflare: Sits in front of the site, holds the game files and the raw archive, and is what turns your IP address into the two-letter country the measurement store keeps.
ClickHouse Cloud: Holds the measurement store described above.
Resend: Delivers the three emails this platform sends — confirm an address, reset a password, claim a staff account. Each is a single sentence and a link with an expiry, with no tracking pixel. Resend necessarily sees the address it is delivering to.
Google: Only if you attach a Google account, and only at the moment you do.

Writing to us

A deletion request, a browser wrongly attached to you, or anything else on this page: [email protected].

Written against the platform as it stood on 3 August 2026.