Privacy Policy

Last updated: July 2026

The short version: we collect the minimum needed to run a trivia game with a leaderboard, we don't sell your data, and we don't run third-party analytics or advertising trackers. The longer version follows.

What we collect

If you play as a guest (no account), we generate a random identifier that lives in your browser's local storage. Your guesses and score are stored against that identifier so the game can remember your progress. It contains no personal information and isn't linked to you unless you later create an account.

If you create an account, we store your email address, your chosen username, and a hashed version of your password. Passwords are hashed with argon2 and never stored — or recoverable — in plain text. If you sign in with Google, we don't see your password at all; we store only your Google account ID and email address so we can recognize you next time.

Gameplay data — your guesses, scores, and daily challenge results — is stored in our database to power the leaderboard, your personal stats, and your streaks. Usernames appear publicly on the leaderboard; your email address never does.

Cookies and browser storage

• Local storage: your anonymous session identifier, so guest progress survives between visits.
• A refresh-token cookie (logged-in players only): an httpOnly cookie that keeps you signed in for up to 30 days. It's not readable by scripts and isn't used for tracking.
• A short-lived state cookie during Google sign-in, used solely to protect the sign-in flow against forgery. It's deleted as soon as sign-in completes.

That's it. No advertising cookies, no cross-site trackers, no third-party analytics scripts.

Third-party services

If you use the contact form, your message (and the email address you provide with it) is relayed to our inbox by Web3Forms, a form-delivery service. If you sign in with Google, Google's own privacy policy applies to the sign-in step itself. The site runs on standard cloud hosting infrastructure, which processes requests (including IP addresses) as any web host does.

How we use your data

To run the game: validating guesses, computing scores and streaks, showing the leaderboard, and keeping you signed in. We may email you about your account if something genuinely requires it (for example, a security issue). We don't send marketing email, and we don't sell, rent, or share your personal information with anyone for their own purposes.

Deleting your data

You can have your account and its associated data deleted at any time — just contact us from the email on your account and we'll take care of it. Guest session data can be discarded on your end by clearing your browser's local storage.

Changes

If this policy changes in a way that matters — for example, if we ever add analytics or advertising — we'll update this page and the date at the top. Questions? Ask away.