What is kept, and why

The short version

The daily puzzle is worked out in your browser from the date, so the whole game runs without an account. Sign in and a handful of rows are kept so a streak can follow you between devices. That is the entire purpose of the data described here.

Playing without an account

No account is needed. The board, the clock, your streak and your practice results are written to this browser and stay there.

One exception, stated plainly: when you finish the daily, the app posts the result to the server without first checking whether you are signed in — the play pages are served from a CDN and the sign-in cookie is deliberately unreadable by page scripts, so the page genuinely cannot tell. If you are signed out, the server refuses that request and keeps nothing from it.

Practice works the same way, and does it far more often than once a day: every practice board you finish is posted as you finish it, blind, for exactly the same reason. Play ten practice boards signed out and ten such requests are sent. The server refuses each one and keeps nothing from any of them, the same as it does for the daily.

Who is responsible, and how to reach them

This policy covers Onsday, the site at www.onsday.com. For anything on this page — a copy of your data, an erasure, a correction, or a question about how any of it works — write to contact@onsday.com. That address is the controller’s contact point for privacy requests, and it is read by a person.

You can exercise the copy and erasure rights yourself, immediately, in account settings — you do not need to write to anyone first, and doing it yourself is faster. The address is there for everything the controls do not cover.

If you think this site has handled your data wrongly, you have the right to complain to your national data protection authority, and you can do that without contacting us first.

What the server keeps once you sign in

• Your light or dark theme, and the time you last changed it. While you are signed in, a change you make on a device is copied to your account so your other devices can start with the same look; a device that has only ever used the defaults sends nothing. Nothing else about how the product looks is copied — motion, layout and density stay on the device. They are included in your data export and deleted with your account, and account settings shows which choices follow your account.
• Any custom theme you build — its name and its ten colours — up to 10 per account, while you are signed in. Which one you have selected is stored the same way your light or dark theme is, and copies to your other devices. Deleting your selected theme, on any device, returns you to a built-in theme rather than leaving a blank one. They are included in your data export and deleted with your account.
• Your email address as Google reports it, and whether Google says it is verified. It has one job: recognising which account is yours the next time you sign in. It is never displayed to anyone, and no email is ever sent to it.
• Your display name — the one name the product actually shows. It starts as the generated pseudonym below, but account settings lets you switch it to your Google name or to one you type; which of the three you are currently using is stored alongside it, so settings can show the right option selected.
• The pseudonym generated for you when the account was created — two words and a number, in the shape of SwiftHeron42. It is kept even after you switch to a different name, so switching back returns the name you started with rather than a new one.
• The name and profile-picture address Google returns with the sign-in, which the sign-in library records on the account row. Both are shown — the name as your display name, the picture on your account page — if and only if you choose your Google name in settings; otherwise neither appears anywhere in the product. They appear in your data export regardless, because they are held whether or not they are in use.
• The Google account identifier and the sign-in tokens that come with it, which are what let a session be established without asking you to sign in again.
• One row per live sign-in session: an opaque token, which account it belongs to, and when it expires. The cookie in your browser carries that token and nothing else.
• One row for every daily puzzle you solve: which game, which day in UTC, which difficulty, how long the solve took, how the row reached the server, and when it was written. At most one row per game per day. A solve you played ranked also records how many moves you made, how many hints you used, and which ranked attempt it belonged to.
• For games that support server-verified ranked play: after a ranked solve verifies, we keep its action sequence and timing, including available undo, redo, reset, hint-use and invalid/no-op markers. This powers behavioral telemetry across games; the experimental per-game Play Profile remains limited to games where its game-specific signals are meaningful. These readings are behavioral proxies, not validated cognitive or clinical measurements. Raw logs are included in your data export and removed automatically when your account is erased.
• If you opt in to the Play Profile validation study: your consent, and your answers to a short questionnaire, kept separately from your gameplay data and used only to check whether the Play Profile’s measurements hold up against an established scale. Included in your data export. Withdrawing — from Settings — deletes both immediately.
• One row for every ranked attempt you start: which game, day and difficulty, the moment the server opened it, the moment your solve arrived, and what became of it. The two timestamps are the server’s own clock, because a ranked time has to be one we measured rather than one your device reported. The moves you made are replayed to check the solve and are not stored — only the count survives.
• Your current and longest streak for each game, and the last day you solved.
• Your running point total for the current season and how many ranked solves it came from. Computed once, when a ranked solve is verified, from that difficulty’s base points, how it compared to the day’s median time, and your streak — and never recomputed afterwards, so a later day’s median cannot rewrite an earlier day’s score.
• Weekly cohort standings (which weekly group you were in, your rank in it and the outcome) are stored so your ring history can be shown to you; they are exported and deleted with your account.
• Your fastest recorded practice time and how many practice solves have reached the server, per difficulty per game. Practice stays unranked regardless of what is stored here — a board regenerates on demand, so an unlimited supply of attempts always stands behind any practice time.
• If you turn on streak reminders, one row per device you allowed them on: the browser push address the reminder is sent to, the keys that let only us deliver to it, and when you granted it — plus your time zone, so a reminder lands in your evening rather than at 4am. A notification is only ever sent with permission you granted, and never contains anyone else’s data. Your data export lists the devices by their push address; the delivery keys are left out, because they secure the channel rather than describe you. Removing the account, or turning reminders off for a device, deletes these.
• The language you pick in account settings, if you pick one, so the site opens in it on any device. Without a pick, the language the site last showed you — decided from your browser’s and system’s languages — recorded when you open the lobby. Reminders and other notifications are written in the first of those two there is, else in English.
• The date the account was created.
• Your current membership tier, and one row per tier you have ever chosen at /upgrade — which tier, which billing cycle, when it started, when a later choice replaced it, and the price at that moment (net, VAT, and the total), viewable as a billing history at /me/billing. No card number or payment detail is ever asked for or stored. Free during early testing. Nothing is charged now — choosing a tier there changes this row for real without charging anything. When a real provider exists, this section will say so and name it.
• Your Rating — one number estimating how fast you solve, shared across every game rather than kept separately per game — and how confident that estimate currently is. Computed only from ranked solves, the same ones the daily board and season ladder read, never from an ordinary daily solve. Every time it changes, the change itself is kept: the day, the game, and the number before and after. This is what lets “why is my Rating what it is” have an answer rather than only a current figure.
• A duel rating, and how many finished duels it has counted: a number that starts at 1200 and moves with each duel you finish, by how the result compared with what your two ratings predicted. Each duel keeps what it moved your rating by. Duel times are self-reported, so the rating is shown only to you, on your own Duels page, and never on any board or ranking.
• For each duel you finish, a race timeline: up to 120 points of how your move count grew over your own clock — the same count and time your opponent already saw live while you played, never the board itself. It is kept so both of you can see the race afterwards, and erasing your account removes it with the duel.
• A photo, if you upload one in account settings — JPEG, PNG or WebP, up to 4 MB, stored with Vercel Blob and shown beside your display name. Only one file type check happens on the way in: what the file actually is, compared exactly against that short list, never against what its name or extension claims. Replacing or removing a photo deletes the previous file rather than leaving it behind, and erasing your account deletes it too, before the account row itself is removed.
• Which achievement badges you have unlocked, and when — evaluated automatically from the activity already listed here (streaks, solves, practice, season standing). Unlocking one never removes or changes anything else stored about your account.
• The last time your session was read — updated on any page load while signed in, roughly five-minute resolution, never more precise than that. It is what a friend or teammate’s online dot reads, and what Duels shows an opponent as your last activity; see below for who that reaches.
• A solve diagnosis, if you turn the setting on in account settings and choose “with report” on a ranked daily attempt: a private, per-day report of how that solve went. It is generated only when you explicitly turn the setting on — off means none is ever generated, not merely hidden — and is visible only to you; no teammate, captain or staff member can see it. Your team can see an aggregate figure (an average across contributors) only once at least two members have contributed a report that day, and it never shows any one member’s own numbers. Turning the setting off stops your future solves from contributing to that aggregate; it does not erase reports already generated.
• One row per live chess match you play against another person, matched from the same queue that pairs duels: the current board position, the moves made so far, and the result. This is what lets a match resume correctly if you reload the page. Erasing your account removes every match you were part of.
• One row per live Wall Race match you play against another person, matched from the same queue that pairs duels: the current board position, the moves made so far, and the result. This is what lets a match resume correctly if you reload the page. A match that neither player finishes stays stored as unfinished — there is no resignation or timeout for this game yet. Erasing your account removes every match you were part of.
• If you join a timed course, one row per course you entered: which course, your progress through it, your total time, and your final placing once it settles. Alongside it, one row per leg you open: which course and position, when the server opened your window and when you submitted, what became of it, and how many hints you used on it. The moves you make in a leg are replayed to check the solve and are not stored, the same as a ranked daily attempt above. Both are exported and deleted with your account.

What other players can see

Your display name and your time, but only for a ranked solve. The daily board shows the fastest ranked solves for today, and a row on it carries the name you have chosen, your finishing time, your position, and whether the solve claimed a hint. Anyone can read it, signed in or not.

An ordinary daily solve never appears there. Only a ranked attempt does — one you started deliberately, which the server timed from beginning to end and replayed move by move to check. If you have never played a ranked attempt, you are not on any board.

The season ladder shows your display name beside a running total — every point you have earned this season, and how many ranked solves earned it, summed across every game you rank in. It reads from the same ranked solves as the daily board, so the same rule applies: a solve the server timed and replayed, never one your device merely reported. If you have never played ranked, you have no season and no row on the ladder.

A friend can see your ranked standing even when a board would not show you. Both the daily board and the season ladder can be filtered to just the people you have added as friends, and that filtered view is not limited to the global top 100 — so a friend sees your ranked time and position on a day you placed too far down for the public board. It is the same kind of information the boards already publish, a display name beside a verified time; what a friendship adds is being seen when the global cut-off would leave you off.

You become someone’s friend by opening an invite link they chose to give you — there is no friend request to accept and, as everywhere else here, no way to look a person up by name or email. A link works once and expires after seven days. Removing a friend, from your friends page, takes that visibility away again.

Your team is treated the same way. If you are in a team, both boards can be filtered to just its members, and — like the friends view — that view is not limited to the global top 100, so a teammate sees your ranked time and position even on a day you placed too far down for the public board. You join a team by its invite link, the same as the roster and chat you already share with them; leaving the team ends this visibility.

Whoever you duel — a friend, or a stranger from the matchmaking queue — sees your time on that one board. Queuing needs no friendship and pairs you with whoever else is waiting for the same game and difficulty; either way the match shows your display name, your photo if you uploaded one, and a time on one unranked board. Declining a duel, or letting it expire after seven days, is shown to the other player as exactly that. Erasing your account removes every duel, however it started.

While a duel is in progress, your opponent also sees your move count and elapsed time update live, and whether you have finished. Never your board itself — the trust model is still “the other player can see the same board”, their own copy generated from the same seed, not a live view of your actual grid. Once the duel is finished, both of you can replay that as a chart of how each move count grew over time.

Chess is different: matching two players into a live game means each of you sees every move the other makes, in real time, for as long as the match lasts — that is the whole of playing chess against another person. Either player may resign at any time, and erasing your account removes every live match you were part of, along with everything else.

Wall Race works the same way: a live match means each of you sees every move the other makes, in real time, for as long as the match lasts — that is the whole of racing another person for the far side of the board. Unlike chess, there is no way to resign a Wall Race match yet, so one neither of you finishes simply stays open. Erasing your account removes every live match you were part of, along with everything else.

A friend or teammate can see whether you were recently active — a dot beside your name, on or off: whether you loaded any page signed in within roughly five minutes. No live feed, and it goes stale rather than announcing when you sign off.

On Duels, an opponent can also see roughly when you were last active — “Active now”, or “Active 3 h ago” — read from that same stamp. Only a friend sees it, or any opponent if your profile is public; a stranger from the matchmaking queue sees nothing of it while your profile is private or friends-only.

Your profile — pronouns, country and a short bio — is yours to share or not. You fill these in, if you want to, in account settings, and a visibility setting decides who may open your profile page: private (the default) means only you, friends means the people you have added, public means any signed-in player; a signed-out visitor is shown nothing, so a profile is never an open-web page. The only way to reach one is a link beside a name on a roster or friends list, and erasing your account removes these fields with everything else.

Nothing else about your account is visible to anyone else: not your email, not your Google name unless you chose it as your display name, not your streak, and not your practice times. There is still no way for one account to look up another.

Because that name is published beside a time and, now, a season total, which name shows is the player’s choice to make — the generated pseudonym, your Google name, or a name you type, in account settings. You can also choose to compete anonymously: you keep your rank, your times and your points, and every board shows you as “Anonymous” instead of any name.

Signing in after playing as a guest

If you played on this browser without an account and then sign in, the daily history saved here is offered to your account once: up to the last thirty solves plus the streak counters. Anything a browser reports is marked as such, and marked rows may add a day the account lacks or raise a streak, never overwrite a day already recorded — nor will they ever count towards a ranked board. A browser’s history belongs to one account only, so if somebody else signs in on the same browser nothing is offered.

A practice best time set on this browser, if faster than what your account already has, is offered the same way, per difficulty — merging can only lower a stored practice time, never raise it. How many practice solves your account has recorded is never touched by this: it is not sent by this merge, and grows only from practice played while signed in.

What stays on this device

These live in this browser’s local storage, nearly all of them under keys beginning game:v1:. Four are exceptions to “never leaves the device”. Three sit under that prefix: the daily history in the section above, offered to your account at sign-in; your practice best time per difficulty; and your account’s database id (game:v1:authed-id), stamped here on every signed-in visit to the lobby whether or not you have accepted any cookie category. The browser sends that copy to PostHog only after you accept Analytics cookies, so a returning player can be told apart from a new one there. Separately, the server can send the same internal account id with the server-side product events described under Analytics even if this browser has declined that category. Neither path sends your name or email. Finish a practice board while signed in and two things are sent — how long that board took, and the fact that it was solved. Your solve count itself is never sent, by this or by the merge: the server keeps its own tally of the practice solves that reached it, which is why the two numbers can differ. See “What the server keeps once you sign in” above. The fourth is PostHog’s own identifier in the last bullet below — the one that is not under the prefix — which leaves with every event once you have accepted analytics cookies. Everything else in this list stays on the device:

• Unfinished daily boards — the puzzle you are part-way through, and its clock.
• The practice run in progress — its board, moves and clock.
• The difficulty you last chose, for each game.
• Your light or dark theme — a copy is also kept on your account if you are signed in (see above).
• Your analytics preference.
• Whether this browser is signed in (game:v1:authed) — a flag, not an identifier, that only decides whether navigation draws the entries a signed-out visitor cannot use.
• Whether you accepted analytics cookies (PostHog) and, separately, marketing cookies (Google Analytics) — and, if you accepted analytics cookies, PostHog’s own identifier for this browser.

Clearing this site’s data in your browser removes all of it, including the daily history and this browser’s own copy of your practice statistics — the server’s copy, if you were signed in when it was set, is untouched.

Analytics

Visits are counted with Vercel Web Analytics, which is cookieless: it stores nothing on your device, and it cannot recognise you on any other site.

It is not merely a tally, and it would be an understatement to call it one. Vercel documents that each page view records which page was opened and which site referred you, alongside facts read off the request itself — country, operating system, browser and device type. Returning visits within a day are recognised through a hash Vercel computes on its own servers from the request and a salt it changes daily, so nothing is written to your device and one day’s figures cannot be joined to the next.

It runs unless you switch it off. The switch is here, and the same one is in account settings. The preference belongs to this browser rather than to an account, and it is honoured whether or not you are signed in, so you do not need one to use it.

Using it reloads the page. That is the point rather than an inconvenience: switching it off has to stop the script loading at all rather than load it and ask it to stay quiet, and a script already on a page cannot be taken back off it.

PostHog is used in two different ways. Its browser analytics is optional: the browser SDK, its persistent local-storage identifier, heatmaps, session replay, performance timings and surveys load only after you accept Analytics cookies. Separately, some actions by a signed-in account create product events on the server — for example account, play, team and membership milestones. Those server events do not load PostHog in your browser, do not contain a session replay, and are not controlled by this browser’s Analytics-cookie switch. They use the account’s internal id plus the event and the product fields needed to measure it; this site does not send PostHog your email address or display name. To avoid reporting the same team activation milestone more than once, a team row also keeps the highest activation definition version already reported; zero means none, and deleting the team deletes it.

The two optional browser-side categories below go beyond Vercel’s cookieless tally, and neither browser SDK runs by default: a dialog asks the first time you visit, and each runs only if you accept it. Accepting one does not accept the other — they are independent answers, and the two switches below reflect and change them separately. The same choice is also one tap away, wherever you are on the site:

Both reload the page too, and for the same reason as the switch above. Declining, or never accepting, means that category’s script never loads on this browser.

Marketing email

We may occasionally send email about new games, features, or events, and a weekly summary of your own play (how many puzzles you solved and on how many days, with a link to your week). This is opt-in and off by default. You turn it on yourself — with the unticked checkbox offered once, alongside confirming you are old enough to use the site, or with the toggle in account settings at any later time. Each time you turn it on or off, we record when and through which of those you did it, in a consent history kept alongside your account and removed when the account is.

Turning it off again is just as immediate, and there are two ways to do it: the toggle in account settings, or the one-click unsubscribe link carried in every marketing email you receive. Either takes effect at once, for every future send.

This is separate from service email — messages about your own account or the service itself, such as a security notice or a change to these terms. Those are not marketing and are sent whether or not you have opted in, because they concern the service you are using rather than anything we are promoting.

Marketing email, when sent, is delivered through Resend (see “Who else is involved”). Each send is recorded with the audience it was aimed at and the actual list of addresses it went to, pinned at the moment it was sent — never the content of your inbox or whether you opened it.

Asking never to be emailed again

This works with no account or sign-in required, because it needs to work for someone who was invited and never signed up at all. It is checked before a team invite, a site invite, a broadcast — marketing or service — and an account-approval or pre-approval notice: an address on this list receives none of those. It is not checked before the sign-in link, because that link is how you get back into your own account — refusing to send it would lock a suppressed address out of the account itself, not just its inbox.

Every marketing email carries a one-click unsubscribe link in its footer. Following it withdraws marketing consent if the address belongs to an account, or adds the address to this list if it does not — either way, nothing else about the account is touched.

The request is stored as a one-way hash of the address, never the address itself, in a row with no link to any account. This is one of only two things the system keeps on purpose after you delete your account — the other is a record of any moderation action taken on or by an account, described in “Erasing your account” below. Both survive for the same reason: erasing your account cannot also erase the record that you do not want to be emailed, or the erasure itself would be the way to start receiving mail again. (An account-approval entry, described in “Account approval” below, is also not removed automatically — but unlike these two it is removed whenever you ask.)

The hash cannot be turned back into your address, and the row is used for exactly one thing: refusing to send.

Invite emails, when sent, go through Resend — see “Who else is involved”.

Account approval

Every account on Onsday is reviewed before it becomes fully active — you can still play the daily puzzle without one. When you sign in for the first time, on any provider, the email address you sign in with is stored so we can review it and let you in once it is approved. You do not need to sign in again once that happens.

Unlike the “never email me again” list, this is stored as the address itself, not a hash — we need to be able to write to it, and to recognise it when you sign in. Alongside it we keep whether the review is pending, approved, invited or declined, when it was made and decided, which staff member decided it, and an optional internal note.

This entry is keyed by your email address and is not linked to any account until it is approved — you can be on the list without ever completing a sign-in. Because it is not linked to an account, it is not part of “Download your data”, which covers account rows only, and deleting an account does not remove it. To have a review-list entry erased, write to contact@onsday.com and we will remove it.

When you sign in — with Google, Microsoft, Apple, or an email link — the email address is checked against this list, and against existing accounts, to decide whether your account is already approved. The approval email, when sent, goes through Resend and is subject to the “never email me again” list above; see “Who else is involved”.

Cookies

A visitor who never goes near sign-in, never picks a language and never accepts marketing cookies in the dialog is given none at all — with the one narrow language exception below. Signing in involves four, and every one of them is strictly necessary to sign you in or to protect the sign-in from abuse; all four are unreadable by page scripts and are sent only to this site.

• authjs.csrf-token — proves a sign-in or sign-out request came from this site rather than another one. Written the moment you reach the sign-in page.
• authjs.callback-url — where to return you once Google sends you back. Written at the same moment.
• authjs.pkce.code_verifier — a one-time secret binding the code Google returns to the request that asked for it. Added when you are sent to Google, lasts fifteen minutes, and is thrown away the moment you return.
• authjs.session-token — written once you are signed in, and the only one that outlives the sign-in. It carries the token for the session row listed above. Signing out ends both.

On the live site the first three reach you with a __Host- or __Secure- prefix, which is a browser-enforced restriction on how they may be sent.

The site picks its language by one rule: the language you picked in Settings, then your browser’s languages in your browser’s order, then your system’s, then English. Two cookies carry the parts of that a page request cannot, and both hold only a two-letter language code.

• locale — written only when you pick a language in Settings, so the site keeps showing it. Picking again replaces it.
• system-locale — written only when none of your browser’s languages is one the site speaks but your system’s is, because a request carries the browser’s languages and not the system’s. Removed again as soon as your browser’s languages decide on their own.

Two more are set only if you accept marketing cookies in the cookie dialog, and only by Google Analytics — accepting analytics cookies (PostHog) sets no cookie at all, because PostHog is configured to keep its identifier in this browser’s local storage instead.

• _ga — a randomly generated identifier Google Analytics uses to recognise repeat visits, lasting up to two years.
• _ga_CBKXHM467Q — holds the state of your current session for this site’s Google Analytics property, also lasting up to two years.

Declining, or never answering, marketing cookies in the cookie dialog means neither is ever set. Withdrawing consent afterwards in the switch above stops new events but does not itself delete a cookie already on your device — clearing this site’s data in your browser does.

Taking a copy of everything

“Download your data” in account settings gives you a JSON file containing everything the server holds about you: your profile, the linked sign-in account, every solve, every streak, and every practice best recorded on the account. Two things are left out deliberately — the sign-in and session tokens, which are secrets rather than facts about you, and anything from the device list above, which never reached the server in the first place.

Erasing your account

The delete control in account settings removes the account row and, by cascade, the linked sign-in account, every session, every solve, streak, practice best, notification and consent-history entry (see “Marketing email” above). It is one statement, it takes effect immediately, and it cannot be undone or recovered. You are signed out as part of it. Anything still in this browser is yours to clear.

Messages you posted in a team, and direct messages you sent or received, go with the account. They are not kept, not anonymised and not replaced with a placeholder — a note saying somebody removed said something is still a record of them, and the surviving half of a conversation is exactly what erasure is for. Teammates, and anyone you messaged, see gaps.

One thing survives it. If a moderator has ever taken action on an account, or if the account belongs to someone who moderates, the record of what was done and why is kept — with the account identifier still on it, which after erasure points at nothing. Everything else about the account is gone. This record is not used to contact anyone or to rebuild a profile; it exists so a decision can be reviewed, appealed and answered for. A moderation log that the subject of the decision can erase is not a record of anything, and neither is one a moderator can erase.

PostHog is separate from this site’s database. The account-delete control does not currently submit a deletion request to PostHog, so analytics events already held there can remain until PostHog’s project retention or a separate deletion request removes them. If you want those analytics records deleted too, write to the privacy contact above and include the account you are asking about. This is an implementation gap, not a promise that account deletion has already removed the processor copy.

A second thing survives it, only for a banned account. Deleting a banned account keeps a one-way hash of the Google account identity it was signed in with — never the identity itself, never anything else about the account — so signing in with that same Google account again is refused rather than starting fresh. This is what stops a ban from being undone by deleting and rejoining; an account in good standing that is deleted keeps nothing at all. The hash cannot be reversed into a Google account, is checked for exactly one thing, and is never used to contact anyone.

Your display name is your choice, changeable at any time in account settings — the generated pseudonym, your Google name, or one you type. Switching back to the generated name returns the one you started with, not a new one.

How long it is kept

Server rows are kept until the account is erased — solves, streaks and practice bests have no automatic expiry. A streak needs to carry forward indefinitely to mean anything; solves and practice bests are kept for as long, with no separate rule that clears them sooner. A sign-in session lapses after twenty-four hours without a visit, and signing out ends it at once. What is on this device lasts until you clear it.

Who else is involved

• Google — sign-in only. Google tells this site who you are; this site tells Google nothing about your play. Google is a US company; sign-in data that reaches it is covered by Google’s own transfer safeguards for the EU-US Data Privacy Framework and standard contractual clauses.
• Microsoft — sign-in only, on the same terms as Google above: Microsoft tells this site who you are and nothing about your play reaches it. Microsoft is a US company and relies on the same category of transfer safeguards.
• Neon — the hosted PostgreSQL database the rows above live in, hosted in the United States (AWS US East). Neon is a US company, and the data reaches it under the same category of transfer safeguards as the other US providers on this page.
• Vercel — hosting, delivery, the analytics described above, and Blob storage for a profile photo if you upload one. Serving a page necessarily means Vercel handles the connection it arrives on, including your IP address. Vercel is a US company; it relies on the EU-US Data Privacy Framework and standard contractual clauses to move data outside the EEA where that happens.
• Resend — delivers invite email (a team invite or a site invite, whichever kind you send), the sign-in link if you choose email rather than Google or Microsoft, and, once approved, marketing email. It sees the recipient’s address, the message text, and nothing else about your account or your play. It also notifies this site, through a signed webhook, when a message it delivered permanently bounces or is reported as spam — the same processor, put to a second purpose: the notification does one thing, adding that address to the suppression list above so no further mail is sent to it.
• PostHog — product usage analytics, not advertising. Browser-side analytics and the persistent browser identifier run only after you accept Analytics cookies. Separately, signed-in actions can create server-side product events even when that browser category is declined; those events use the account’s internal id plus event-specific product fields, not your email address or display name, and they do not contain a browser session replay. This site’s PostHog project runs on PostHog’s EU servers, hosted in the European Union. Product events are kept according to the retention configured for this PostHog project; session recordings are kept for 30 days. Accepting browser analytics also turns on heatmaps of clicks and scrolls, page-performance timings, in-product surveys and session replay.
  • Session replay — every session is recorded in full, from the first moment, not a sample: a replay of what you did on the page.
  • Masking — this project has no masking configured for these recordings beyond whatever PostHog’s recorder applies by default.
  • Console output — recordings capture your browser’s console output.
  • Retention — recordings are kept for 30 days.
  • IP addresses — discarded at ingestion and not stored on the event.
• Google Analytics — the measurement this site would use for any future advertising or campaign tracking, and only if you accept marketing cookies in the same banner, independently of the PostHog answer. Like Google sign-in, data reaching Google Analytics leaves the EEA under Google’s Data Privacy Framework certification and standard contractual clauses. Google Analytics keeps event and user-level data for [retention period — confirm in GA4 Admin → Data Settings] before deleting it automatically.

That is the whole list. Nothing is sold, and nothing is shared with advertisers or data brokers.