PRIVACY POLICY

Last updated: October 2026

What We Collect

We collect the minimum data necessary to operate the service:

Email address — collected by Stripe at checkout to send your payment receipt. We do not store this ourselves.
Session data — a temporary token tied to your puzzle session (stage progress, time remaining). The access token expires; the stored run record can remain after play ends.
Alias — if you complete the puzzle, you choose a display name for the leaderboard. This is public.
Acquisition source — a broad campaign label such as YouTube or Reddit, stored with a checkout attempt. We do not store full referral URLs for this measurement. Aggregate checkout and gameplay counts help us improve the service.
Puzzle events — a log of your in-game interactions, used to validate puzzle completion and detect cheating. Linked to your run record.

Run Records

We store the IP address used to start a run, along with session progress and gameplay events, for operation and abuse prevention. You do not need to create a player account. Your chosen alias and verified results are public.

Payments

All payments are processed by Stripe. We never see or store your card details. Stripe's privacy policy governs how they handle your payment information.

Cookies

Your browser stores an access token in session storage to resume the current run, a broad campaign source in session storage, and personal-best records in local storage. An HttpOnly access cookie lets this browser resume a paid run after its tab is closed; it expires with the access token, within 26 hours. A separate cookie is used when the site is password-protected for preview. Clearing browser storage can remove access to your run and your local records.

Data Sharing

We do not sell, rent, or share your data with any third parties, except service providers used to operate the game: Stripe for payments, Railway for hosting, Cloudflare for domain and traffic services, and Sentry for error monitoring when enabled. The interface also requests fonts from Google Fonts.

Data Retention

Run records and gameplay event logs currently remain in our database after a session ends; automatic deletion is not yet implemented. Winner aliases, certificates and leaderboard entries are retained as part of the public record. Contact us to request review or deletion of data associated with your run.

Your Rights

To request deletion of any data associated with your session or alias, contact us at [email protected]. We may ask for your run reference or certificate ID to locate the record and verify your request.

Contact

[email protected]