Privacy

You can play every part of this game without telling us who you are. There is no account requirement, no email capture, and no tracking of you across other websites by us. What we store is what the game needs to work: which puzzles you have played, and how they went.

On your first visit we set one cookie of our own, wt_uid. It holds a random identifier and a signature, it is http-only, and it lasts a little over a year.

It is there so the daily puzzle can be one run per player with no restarts. It contains no personal information, it is not shared with anyone, and it is not used to build a profile of you. Deleting it makes this browser a new player, which will cost you your streak.

We use Google Analytics to understand how many people play and whether they come back. It sets its own cookies — _ga and one beginning _ga_ — which let it recognise this browser on a later visit. That is the whole reason it is here: without it we can count visits but cannot tell one person returning three days running from three people arriving once each, and that is the number which decides whether this game is worth continuing.

What it receives is the page you are on, an approximate location derived from your IP address, and the same aggregate events described below — which board, how many guesses, whether a hint was used. It never receives a word, a run identifier, or your email address if you have an account. Google acts as our processor and may store this outside your country.

You can opt out of it on every site at once with Google's browser add-on, or by blocking cookies for this site. Either costs you nothing here except the streak described above.

Your settings, your scratchpad marks, your in-progress board, your streak and your statistics are stored in your own browser's local storage. They do not leave your device except where the run itself is recorded as described below, and clearing site data removes them permanently.

• Runs. For each puzzle you play: the identifier above, which puzzle, which board, your guesses and their tallies, whether you solved it, how long it took, and whether you used a hint or Assist.
• Product events. A small set of named events — arrived, started, solved, shared — with the board and puzzle number. No word you typed, no run id, nothing that identifies you personally.
• A home region, if you set one. A city you choose from a list, for the city standings. We do not use your IP address to infer it and we never store your location.

This data lives in a Postgres database hosted by Supabase. It is not sold, and it is not shared with anyone other than the processors named below.

Accounts are optional and exist only so a streak survives a new device. If you create one we additionally store your email address, and a reference linking it to the game history this browser already had.

Authentication is handled by Supabase Auth. If you sign in with a password, that password is handled by Supabase and never reaches us. If you sign in with Google or GitHub, we receive your email address and nothing else — no contacts, no profile details, and no ability to post anything anywhere.

To delete an account and the history attached to it, see your rights below.

• Vercel — hosting. Serves the site and keeps standard server logs, including IP addresses, for operational purposes.
• Supabase — the database and, if you use one, authentication.

• We do not sell your data, and we never will.
• We do not send marketing email. An account gets you no mail beyond sign-in.
• We do not store your IP address in the game's own database.
• We do not record the words you type as guesses against any identity beyond the run they belong to.

This site is not directed at children under 13 and we do not knowingly collect data from them. There is nothing here that requires an age, and anonymous play collects no personal information at all.

Everything stored on your side — the cookie, your settings, your streak, your statistics — is removed the moment you clear this site's data in your browser. That needs no request and no permission from anyone.

An address for data requests is not published yet. If you have created an account and want it erased, the fastest route today is to clear this site's data — that removes everything on your side — and the account link becomes inert with nothing attached to it that identifies you.