Privacy

The short version

You can play every game here without an account, and if you do, nothing about you reaches us at all. Making an account adds exactly one piece of personal information: an email address, so that a streak can survive a new phone.

Everything below is detail on those two sentences. It is long because being specific is the only way to be honest, not because there is a lot going on.

Playing without an account

This is the default, and it is what most people will do forever. In this mode the game runs entirely in your browser and makes no request to our servers beyond fetching the page itself. Your scores, your streak and your settings are written to your own browser's local storage, on your own device.

What is kept there:

• Your settings for each game — theme, difficulty, units, globe style, and so on.
• Today's result for each game, so reopening the page shows your score rather than restarting the day.
• A short history of past days, so the game can show a streak. Entries older than 90 days are deleted automatically the next time you open the site.
• Which stories you have already read, so practice rounds tend to show you new ones.

This is not a cookie, it is not transmitted anywhere, and clearing this site's data in your browser settings erases it permanently. We cannot read it, recover it, or see that it exists.

The device identifier

The first time you play, your browser generates a random identifier — a UUID, a string of 36 characters with no meaning — and stores it locally under the key ps:device. It is not derived from your hardware, your network, or anything about you; it is a coin flip repeated 122 times.

While you have no account, that identifier is not sent anywhere. It exists so that if you later make an account, the scores this browser already holds can be attached to it instead of being thrown away. Clearing your browser data generates a new one, and the old one becomes permanently unclaimable.

What an account stores

An account is optional. It exists to do the three things a single browser cannot: survive a wiped device, sync between your phone and your laptop, and let you compare a score with a friend. Creating one stores the following, and nothing else:

• Your email address, lowercased. This is the only piece of personal information we ask for. It is the recovery address and the sign-in method; it is never shown to other players, never sold, never rented, and never used for marketing.
• A display name, a handle and an avatar token, if you choose them. These are visible to people you have accepted as friends. The avatar is a short token like nyansapo-3 naming one of our own drawings — there is no image upload.
• A time zone, if your browser offers one. It is advisory and used only for display, such as telling you how long is left in the day. Puzzle days are decided in UTC for everybody, everywhere.
• Timestamps: when the account was created, and when it was last used.
• Which sign-in methods are attached — email, Google, or both.

Signing in

There are no passwords on PlaySapien, and we would rather never store one.

By email. We send a six-digit code to the address you give us. What we store is a cryptographic hash of that code, not the code; it expires after ten minutes, can be used once, and is destroyed after five wrong attempts. The same mail also carries a link that does the same thing, for convenience on a desktop. Asking for a code always answers the same way whether or not that address has an account, so no one can use this page to discover whether you have one.

With Google. If you choose Google sign-in, Google tells us your email address and a stable identifier for your Google account, and we store those two things. Google learns that you signed in to PlaySapien. We receive nothing else — no contacts, no profile, no Google activity — and we ask for nothing else.

Your session. Once you are signed in, your browser holds one cookie. It is HttpOnly, Secure and SameSite=Lax, which means it cannot be read by scripts and is not sent to other sites. On our side we store only a hash of its value, never the value itself, alongside when the session was created and last used, a truncated description of your browser, and the two-letter country our host reports — which is there so the "your devices" list can say Firefox, Ghana and let you spot a session that is not yours. No city, no street, no precise location, no IP address retained by us. Sessions last a year and renew on use, so signing in is roughly a once-per-device event.

What a signed-in game sends

When you finish a game while signed in, your browser posts the result: which game, which day (in UTC), which mode, your score, the maximum available, how long you took, and a small block of detail — the per-round scores and the shareable grid of squares. That is the same information the game already shows you on its own results screen.

Only the first result for a given game and day is kept. A second submission is rejected rather than overwriting the first, so the number on the board is the one you actually got.

Streaks are never stored as a number we increment. They are recalculated from your results every time one arrives, which means a bug can never permanently corrupt them and merging two devices is correct by construction.

Your local copy keeps being written either way. The server is the durable copy; your device stays the fast one, and the game keeps working on a plane.

Friends, and who can see your scores

There is no global leaderboard, and that is deliberate. Scores are reported by your browser, and a web game cannot stop a determined person from reporting a perfect one. Keeping boards friends-only means the only audience for a fake score is people who know you. It also means your results are visible to nobody except the people you have personally accepted.

To add a friend you share an invite code — eight characters, rotatable, revocable at any time. We store the friendship (who, with whom, its state, and when), and your current invite code. There is no directory, no search by email, and no way for a stranger to find you. Removing a friend removes their access to your results immediately.

We also store short in-app notices — "your chain was accepted", "X wants to be friends" — until you have read them.

If you submit a word chain

Word Chain lets you submit a puzzle of your own. If you do, we store the words, an optional credit line, and the result of an automated review: a quality rating, the reviewer's written reasoning, and a safety category if one was flagged. Approved chains may be published to every player, with your credit if you gave one.

One thing here does not go away when you delete your account. If a submission is rejected for a safety reason, a record of it — the words and the reason — is kept in a moderation log. When you delete your account, your name is removed from that record and it is retained without an author. The log exists to make a pattern of abuse visible across submissions, and it would fail at that if anyone could erase it by deleting and re-registering. This is the only exception to the deletion rule below, and it is written here rather than done quietly.

Who else is involved

Cloudflare hosts the site, the API and the database. Like any web host, their servers receive the technical details every request carries — your IP address, the page requested, your browser and operating system, and the time — and use them to deliver the page and protect the site from attack. They retain those logs for a limited period as our processor. We do not build profiles from them and do not link them to your account. See Cloudflare's privacy policy.

[email provider] delivers the sign-in codes and the occasional notification. They process your email address for that purpose only.

Google Fonts serves the three typefaces the site uses. That request tells Google your IP address and roughly what browser you are using, as any request to any server would. Google states that it does not use Google Fonts requests to build advertising profiles. A content blocker will stop the request and the site falls back to fonts already on your device.

Google, additionally, if and only if you choose Google sign-in, as described above.

That is the complete list. There is no analytics provider, no advertising network, no tag manager, no session recorder, no A/B testing service, and no third-party embed.

Cookies

One cookie, set only after you sign in, holding only a session identifier. No cookies are set for anonymous play, and none are used for advertising, analytics or tracking. Because the cookie is strictly necessary for a function you asked for, there is no consent banner — there is nothing to consent to.

How long things are kept

• Sign-in codes — ten minutes, then they expire and are cleaned up.
• Sessions — one year from last use, or until you sign out or revoke the device.
• Results and streaks — for as long as your account exists. They are the point of the account.
• Local browser history — 90 days, pruned automatically on your own device.
• Moderation records — indefinitely, with the author removed on account deletion, as described above.

Deleting your account

There is a delete button on your profile. It removes your account, your email address, your sign-in methods, your sessions, your results, your streaks, your friendships, your invite codes and your notices. This is a real deletion from the database, not a flag, and it cannot be undone. The single exception is the moderation log described above, which keeps the words and the reason with your name removed.

You can also just stop using the account — but if you want it gone, the button is there and it works.

Your rights

Depending on where you live you may have a legal right to access, correct, export or delete the personal information a service holds about you, and to object to its processing. On PlaySapien that amounts to one email address and a list of puzzle scores, all of which you can see on your profile and remove with the delete button. If you want any of it in a file, or want something corrected, write to us at the address below and we will do it.

We do not sell or share personal information, and we have never had any to sell.

Children

The games are suitable for all ages and can be played entirely without an account, which collects nothing. We do not knowingly create accounts for children under 13. If you believe a child has made one, write to us and we will delete it.

Security

Sign-in codes and session identifiers are stored only as hashes. The session cookie is HttpOnly and Secure. Sign-in attempts are rate-limited. We store no passwords, because we never collect any. If something does go wrong in a way that affects you, we will tell you at the address you signed up with.

Changes

If what PlaySapien collects changes, this page is rewritten before the change ships and the date at the top changes with it. Information collected under this version will not be repurposed under a later one.

Contact

Questions about this page, a request about your data, or anything else: [your contact email].

PlaySapien is run by [your name or business name], [postal address, if you publish one].