Privacy

What is collected

Your email address, given when you sign in. It is used to send the six-digit sign-in code and, if ever needed, to reach you about your account.

What you choose to publish: display name, username, bio, and whether your profile is public. Your time zone, which decides which day a game belongs to and therefore your streak.

How you play: for each grid, the guesses you made, the time each one was made, whether you solved it, and what it earned. The greens and XP ledgers, the projects you funded, and the draw tickets those produced.

No analytics, no advertising identifiers, no tracking across other sites. No payment data — nothing is sold. No health or location data.

Why

To run the game: the guesses are what the server replays to decide what a grid was worth. Without them there is no score and no greens.

To keep it fair: the times a guess was made are kept so that unusual patterns can be looked at by a person. They are never used to suspend an account automatically.

To show what you asked to show: a public profile exists because you set it to public, and shows only what this policy lists.

Who else sees it

Supabase hosts the database and handles sign-in. Vercel hosts and serves the application. Resend sends the sign-in emails. Each of them processes data on our instruction and for no other purpose.

Nothing is sold, rented, or shared with advertisers. Public profile pages are, by definition, visible to anyone — that is what making a profile public means, and it can be turned off at any time from the profile screen.

How long

As long as the account exists. There is no automatic purge scheduled, and saying otherwise would be an undertaking that nothing enforces.

Your rights

If the GDPR applies to you, you may ask for access to your data, correction, erasure, a copy in a portable form, or restriction of processing. Display name, username, bio, time zone and profile visibility can be corrected yourself from the profile screen.

You delete your account yourself, from Profile and settings. If you have won a draw it is anonymised rather than deleted — your address, name, bio, username and photo are erased, and the row proving your win stays: a draw already held has to remain verifiable.

You may also complain to your local data protection authority.

Contact

Write to the address published in the legal notice below. It reaches a person, not a queue.