Privacy policy

Guest play and device storage

You can play Classic and the daily riddle without a game account. The browser stores preferences and some game state, including your draft, music settings and display settings. Google sign-in uses browser persistence to keep an account signed in. Clearing site data removes local settings and can sign you out; it does not automatically erase server-side account records.

Account and game information

When you choose Google sign-in, Firebase Authentication handles authentication. We use your account identifier, and may display the name and email supplied by Google to you in the account interface. We do not receive your Google password.

We store information needed to run your account: your chosen username and profile appearance, saved results, riddle attempts and timezone, achievements, Gold and cosmetic records, player cards, lineups, trades, friend requests and challenges, guild membership and guild messages, war availability votes, selected war rosters and your last-read chat position. These records let us restore progress, calculate rewards and operate competitive features.

What other players can see

Your game username, selected profile appearance, badges and eligible scores may appear on leaderboards, guild rosters and social screens. Guild chat and war-poll votes are visible to members who can access that guild. Friend and trade participants can see information needed for their requests and exchanges. Public challenge links can reveal the challenge information they are designed to share. Do not put personal or sensitive information in a username or chat message.

Contact messages

The contact form stores your topic, message, optional reply email, and submission time for the game creator to review. Supplying an email is optional. If you want a reply, provide one. To limit spam, the form stores a daily changing hash of the connection IP address and limits submissions; it does not store the raw IP address in the contact-message table. Hosting providers may process connection details and logs separately.

Do not send passwords, payment details or identity documents. Use the form for bug reports, data corrections, feedback and account or privacy requests.

Service providers and purposes

Firebase/Google provides sign-in, and Cloudflare infrastructure hosts the game and its database. These services process information needed to deliver, secure and maintain the game, under their own policies. We use game records to provide features, prevent duplicate rewards and abusive transactions, and respond to support requests.

Google privacy policy · Cloudflare privacy policy

Optional rewarded ads in the iPhone app

The updated iPhone app supports optional Google AdMob rewarded ads in the Shop. Live ads offer 50 Gold, up to three rewards per account per day, resetting at midnight Eastern. Test ads do not award Gold. Classic also offers an optional rewarded ad to unlock its existing one reroll per draft. Completing a test reroll ad can use that existing reroll, but does not grant Gold. Ads appear only when you tap the watch button. The website does not load AdSense ad-serving scripts.

Google’s advertising SDK and its participating providers may process IP addresses, device or app identifiers, diagnostics, and ad interactions to deliver, measure and protect advertising. This integration requests non-personalized ads and does not request permission to track you across other companies’ apps and websites. Non-personalized ads can still use device storage and process data. Where required, Google’s consent form appears before ads can load. You can revisit the form with “Ad privacy choices” in the iPhone app’s Shop when that option is required.

To verify rewards, we store an ad session linked to your game account, its date and verification status, and Google’s unique reward transaction. We send Google a random session code rather than your Firebase account identifier or sign-in token. Gold is credited only after the server verifies Google’s signed reward callback. Reroll verification records also identify the draft, round and draw that the reward unlocks. These records prevent duplicate rewards and enforce the daily Gold limit and one-reroll draft limit.

See Google’s privacy policy and My Ad Center for Google’s data practices and advertising controls. Browser controls can restrict cookies and storage; restricting essential storage can affect sign-in and device settings.

Your choices and privacy requests

You can play without signing in, sign out, clear browser data, and choose what to share in public game features. To ask about access, correction or deletion of your account data, submit an Account / privacy request through Contact. Include your game username and a reply email. We may need to verify control of the account before acting.

Game records are kept to support ongoing accounts and competitive history. Support messages are kept while needed to handle requests. This release has no automatic deletion schedule; contact us to request deletion. Some records may need to remain for security, transaction integrity or legal obligations.

Children and policy updates

If you are under 13, do not create an account or submit personal information through the contact form. If you believe a child under 13 supplied personal information, contact us so we can review and address it. We may update this policy as features or providers change; the date above identifies this version.