Privacy Policy

Game And Room Data

The game processes the puzzle you open, letters entered into the grid, room status, completion state, and short technical data needed to run and protect the service. A private invite link contains a room identifier only. Each browser creates and stores its own room member key so an invited player can join without an account; the member key is not included in the invite link.

During solo play, this browser can keep puzzle-scoped letters, revealed cells, elapsed time, and the safe public puzzle ID for up to 30 days so you can continue later. The record is removed after completion and invalidated if that public puzzle version changes. It contains no solution key.

We do not ask invited players to create an account. The site does not include live payments or live ad units.

Optional Analytics

Where the analytics choice is available, Google Analytics 4 Standard and Vercel Web Analytics load only after you select Allow analytics. Before that choice, after rejection, and after withdrawal, the site sends no Google Analytics or Vercel Web Analytics request, event, identifier, or cookieless ping. We do not replay activity that happened before consent.

With consent, we use Google Analytics to understand approved public page visits, broad acquisition channel and external referring hostname, foreground engagement, browser return patterns, coarse device/country reporting, Core Web Vitals, and allowlisted aggregate game events such as starts, invites, joins, two-player input, completion, repeat play, and bounded room failures or recovery.

Vercel Web Analytics provides a second, cookie-free aggregate view of approved public page visits, referrers, coarse location, browser, operating system, and device type. It receives no custom game events. Public shared puzzle URLs collapse to /play/shared; private-room, internal, API, unknown, and cross-origin page views are dropped.

We never send puzzle IDs, answers, clues, cells, entered letters, room or member keys, invite links, private-room URLs, query strings, fragments, raw referrer paths, account/payment data, raw errors, or stack traces. Google Signals, User-ID, Ads linking or personalization, Advanced Consent Mode, Tag Manager, cross-device identity, audience export, replay, heatmaps, persistent fingerprinting, and automatic click/scroll/form capture remain disabled.

Legal Basis And Recipients

Optional analytics cookies and measurement are based on your consent under UK data-protection and electronic-communications rules. The consent choice itself is stored so the site can remember your instruction; it is not a visitor, account, or session identifier.

Google and Vercel, with their approved subprocessors, process consented analytics data for us under their respective data-processing terms. Processing may take place outside the UK using the contractual and transfer safeguards described by each provider. Hosting and infrastructure providers may separately process short technical logs needed to deliver and secure the service.

Retention

The analytics choice and Google Analytics cookies are limited to 180 days. The Google Analytics event-data retention setting is 14 months, with reset on new activity turned off. Vercel discards its anonymous visitor session after 24 hours and keeps page-view reporting aggregated. Aggregate reports may remain after event-level retention expires. Essential private-room browser storage has the separate durations described in the Cookie Policy. Solo progress expires after 30 days or is removed when the puzzle is completed.

Your Choices And Rights

Use Privacy choices in the footer to opt in later or withdraw immediately. Withdrawal stops future Google and Vercel analytics and removes the known Google Analytics cookies for this site. You can also clear site data in your browser; clearing room storage may disconnect that browser from an active private room.

Because the site supplies no Analytics User-ID or account identity and Vercel reporting is anonymous and aggregated, historical provider deletion cannot reliably identify every earlier browser record from an email address alone. Contact us at privacy@kreydlabs.com for an access, correction, erasure, restriction, objection, or analytics deletion request. We will explain the practical browser/client-identifier or scoped provider process rather than promise identity matching that the service does not have.

Advertising

The production site is fully ad-free: its advertising provider switch is off, so it does not load live Google AdSense ads or render placeholder ad frames. The codebase contains a dormant manual-display contract for one right-hand desktop rail on eligible public solo Mini, Midi, Maxi, and Daily pages only. It excludes mobile and narrow-height screens, query URLs, private or shared rooms, setup and completion states, the homepage, legal pages, Split Clues, and Crossword Race.

Activation would require a separate owner decision, a Google-certified TCF CMP, reviewed policy and configuration changes, report-only CSP evidence, and production network verification. Auto Ads are not part of that contract. The existing analytics choice is separate and is not advertising consent or a Google-certified CMP.

Complaints

If you are in the UK, you can complain to the Information Commissioner's Office if you think your privacy rights have not been handled properly.