Privacy

Last updated: 2026-10-26

This page explains exactly what VerySeriousWork records when you play, and exactly what it does not. It is written to be read by a player, a parent or a school without a translation layer.

The short version

We count how many devices played each game, how many times, and for how long — and, if you press the heart on a game, that one more device liked it. While a game is open on your screen, we also get a small periodic ping saying which game that is, so we can show a live "N playing" count — nobody can tell it is your device behind that number, and the number itself says nothing about any one device. If you arrived by following a link somebody made with our Share button, we also record which of our own share buttons made that link, and nothing else about how you got here. We do not know who any of them are, and we have no way to find out.

There is no login, no account, and no email address to give (the one optional box for one is on the feedback form, and it is used only to reply to you). You are never asked who you are: the app gives you an auto-generated name (like SwiftQuokka42), and you can replace it with a nickname of your own from the account menu. Your name, generated or typed, is never part of the anonymous play record described below. It does reach our servers, and other players, in the multiplayer features that show names: Guess the Word rooms, Piano's shared room (where your chosen avatar is shown alongside it), Stack's online Duel rooms and Gobbler's room with its daily and weekly top-10 lists, and online Chess games. Every typed name is filtered for profanity; see Typed nicknames below for exactly where each goes and how long it is kept.

This site also uses Google Analytics and shows Google-served ads on the home page. Both started on 2026-08-29, and we say so plainly rather than leaving it to be discovered. See Google Analytics and Google AdSense below for exactly what each means and what it sends to Google. The ads appear on the home page only: in a left and a right rail beside the game list on wide screens, and in a banner below the list. They never appear inside a game, a round, or a score screen.

What is recorded

The app sends us seven kinds of ordinary message. Two happen by themselves while you play (a finished round, and the small "still on this game" ping, which only repeats while a game screen is actually open on your device). The other five only happen if you go out of your way to press a specific button: a heart or star, Save & share on a piano recording, Submit to gallery on a drawing, Send on the feedback form, and the heart on a gallery item. All seven are listed in full below.

A few features cannot work without a server, so they send more: the multiplayer rooms (and what you do in the game while you are in one), Guess the Word, Chess, Gobbler's top-10 lists and death reports, Go-Kart's recorded racing line, and the two galleries. Each has its own section further down. Those sections and the seven messages are everything the app sends us about you or what you do. Your browser also asks our servers for things — the live "N playing" and like counts, the lists of open rooms, the list of words the nickname filter excuses, the site's own pages, sounds and images, and, while Chess's evaluation bar is switched on, the position of the board you are looking at (see Chess: the evaluation bar below) — and none of those requests carries anything that identifies you beyond what any web request carries (see The web server's ordinary log below). Google Analytics and Google AdSense are separate: they are described under their own headings, not in this list.

When you finish a round

The app sends us these values:

Plus one value we work out at our end rather than receive: the country the request came from, as a two-letter code like DE (with a state or province where the database has one). See Country below.

Some things on the site have no rounds at all — the piano is free play, with nothing to win and nothing to finish. Those send the same values and no others, when you leave the screen instead of when a round ends: the time is how long the screen was actually open and visible, the difficulty is always 1 because there is nothing to pitch, and the fourth row above always reads "left", because there was never anything to finish. Nothing extra is collected to make that work, and nothing about the list above changes.

The last row is the newest and the one to read twice. It is one word from a list of eight we wrote ourselves, and it is usually absent — see The Share button below for exactly what it can and cannot say.

While a game is on your screen

So we can show a live "N playing" count on the home page and on that game's own screen, your device tells us which game it currently has open every 20 seconds, for as long as that game stays on screen:

This is the one message in this list that repeats on its own rather than being tied to a single event — it stops the instant you leave the game screen (switch games, go back to the home page, or close the tab), and starts again the moment you open another one. The live number itself still works exactly as before: it lives in our server's memory for as long as your device keeps sending it, and it is only ever "right now" for anyone reading it.

We also record, in our database, the start and end time of each unbroken streak of these pings for a device on a game (a gap of more than 50 seconds starts a new streak) — not each individual ping, just when a streak began and last continued. This lets staff see a chart of how many devices were online in the past, not only right now. It is still keyed only to the same random per-device id as everything else in this list, kept under the same 400-day window as play records (see How long it is kept), and never shown to anyone with a way to trace it back to a device — the live count on the home page is still a plain, untraceable total, unchanged.

The count anyone sees is never traceable to a device. The number on a tile or a game screen is a plain total, with no way to work backwards to who is in it — the same "counted, never identified" shape the like total above already has.

When you press Like or Favourite

Each game has a heart and a star under its tile on the home page (they used to also appear inside each game; that in-game copy was removed, and nothing about what is sent changed). Pressing either sends us four values, and only when you press one — never automatically:

We send the whole answer every time rather than "the player just pressed the heart", so that a message arriving twice cannot accidentally undo your like.

Only the like total is ever shown to anyone. Favourites are yours: they reorder your own home page and are never counted, published or shown to another player. And the number on a game is a total — there is no way, from it, to tell which devices are in it.

When you save a piano recording

The piano has a Record button. Pressing it captures which keys you press, when, and how hard, plus the sustain/soft pedals and the transpose knob — none of that is sent anywhere while you record (playing in a shared room is separate: see "Piano's shared room" below). It only leaves your device if you then press Save & share in the panel that appears after you stop recording, and even then it sends only what you asked it to (the last row is the one thing our server makes for you in return):

You have to type a name before you can save a recording. A name is checked the same way a typed nickname or multiplayer room name is (see "Typed nicknames" below): if it's rejected, nothing is saved and you're asked to pick a different name. A recording saved before names were required has no name at all and keeps showing "Recording #N" until (if you saved it) you rename it.

Saving is a deliberate action, not something that happens by playing the piano: recording captures nothing off your device until you press Record, and nothing reaches our server until you press Save & share afterwards. If you never press either button, this section does not apply to you at all.

When you submit a Pixel Art drawing

Pixel Art is a drawing tool. Drawing, tracing over a reference picture and saving a piece to "My Creations" all happen on your device: the drawing, its title and the picture are not sent anywhere (the screen's ordinary anonymous play record, described under "While a game is on your screen", is). A drawing only leaves your device if you then press Submit to gallery, and even then it sends only what you typed and drew:

Nothing you submit is listed in the gallery until a person who helps run this site has looked at it and approved it. The piano gallery below follows the same rule for a public recording. Editing an already-approved drawing immediately takes it back off the public gallery until it is approved again — there is no way for an edited-but-unreviewed version to be shown publicly, even briefly. A title that fails the profanity filter is rejected before anything is stored, and logged the same way described in The operator-visible blocked-text log below.

When you submit feedback

Every page of the site has a Feedback button (it is hidden while a game is in the middle of a round), including the Privacy, Terms and How it works pages, and the Contact page shows the same form on the page itself. Pressing the button opens a small form, and nothing is sent until you press Send on it:

Plus the same country value every other message here carries, worked out the same way — see Country below.

This is the one place on the site with a free-text box, and it is worth being direct about what that means: whatever you type in the message (or the email field) is read by a person running this site. Please don't put anything in it you would not want a stranger to read — we do not check what you type before it lands in front of us, only after. The email address is not checked either; it is taken at face value and used only if we choose to reply, never shown to anyone else and never used for anything but that.

Submitting feedback is capped at 2000 characters for the message and 254 for the email field, and at 8 submissions per 15 minutes from one network address (people who share a network, such as a school, share that allowance) — an anti-abuse limit, not a content filter. Feedback is kept for 400 days, the same as play records, and then deleted automatically, or sooner if we act on it and remove it by hand — see "Staff-deleted feedback and recordings: a Bin, then a shorter retention window" below for exactly what "remove it by hand" means.

When you like a gallery item

Every Pixel Art piece and Piano recording that's visible in its public gallery has a heart next to it. Pressing it sends us four values, and only when you press one — never automatically:

This is a different heart from the one described in When you press Like or Favourite above — that one is about a whole GAME (one of the eight tiles on the home page); this one is about one specific piece of art or one specific recording somebody shared. Liking a piece or recording that is not currently visible in its public gallery (pending review, rejected, unlisted, or removed) is refused and nothing is stored — the same rule that keeps a like from ever outliving or preceding whatever it's attached to.

Only the like total is ever shown to anyone. There is no route that answers "what has device X liked" — the same "never read back a device's own reactions" stance the whole-game heart already takes.

How long these are kept: unlike play records, we do not currently delete gallery likes on any schedule. A like stays on file, beside the random device id, until the same device changes it, even after the piece or recording it was for has been deleted. Pressing erase everything gives your device a new id, which leaves the old rows connected to nothing you do.

That is the whole list, for all seven messages. There is nothing else in any of them.

What is not recorded

Explicitly, and by design:

• No name in the play record. Display names like SwiftQuokka42 are auto-generated by the app and are never part of the anonymous play record described above. You can type your own instead, from the account menu — one nickname for the whole site, shown in Go-Kart's standings and filtered for profanity before anyone else sees it — and a typed nickname is never part of that record either. A name does reach our servers in the multiplayer features that show it to other players, whether it is the generated one or one you typed: Guess the Word rooms, Piano's shared room, Stack's online Duel rooms, online Chess games and Gobbler's room, with its daily and weekly top-10 lists. (Online Crosstiles is not on this list: it shows only a random name our server picks, never yours. The Scoreboard is not on it either: a team name you type there is sent once, to look up the team's colours, and is not kept, logged or shown to anyone; see Scoreboard below.) Piano's shared room also shows your chosen avatar — one of sixteen fixed animal emoji, never an upload — to the other people in a Piano room. See Typed nicknames: Go-Kart and Gobbler's multiplayer room below for exactly where each name goes and how long it is kept.
• No score and no progress level in the play record (it does carry the difficulty you picked, shown above). How well you did is your business. Apart from the few features that need a server to work — the live multiplayer rooms, Gobbler's daily and weekly top-10 lists, Go-Kart's fastest recorded lap, Guess the Word and Chess, each described below — it stays on your device and is not transmitted.
• No audio. The Tuner listens through your microphone only to find a pitch, and the Noise Meter only to measure how loud the room is. Both work on your device and record, keep and send none of the sound. See Tuner: your microphone stays on your device and Microphone: Noise Meter below.
• No IP address in the play record or the database. See Country below for how this works. The one place an address is written down is the web server's ordinary log, described under The web server's ordinary log below.
• No device or browser details in the play record — no user agent, no screen size, no fingerprinting of any kind. (Your browser's identification does appear in that same ordinary web server log, and Google Analytics receives what it always receives: see below.)
• No page addresses and no referrer in the play record. The play record does not hold the address of any page — not ours and certainly not the one you were on before — so it cannot tell what else you were doing. The one exception is narrow and worth stating plainly: if you arrived through a link somebody made with our own Share button, we record which button made it. See The Share button below. Page addresses do appear in two other places, both described on this page: the web server's ordinary log, and Google Analytics.
• The Privacy, Terms, Contact and How it works pages record nothing of their own. They are plain pages: no analytics, no ads and no request to any third party, and reading them sends nothing to our stats server. (Like every page, loading one is an ordinary request to our web server, which appears in its ordinary log: see The web server's ordinary log below.) They do run two small scripts of our own, loaded from this site. One reads the light-or-dark choice you made in the app, which is stored on your device, so the page matches it; it writes nothing and sends nothing. The other adds the Feedback button and, on the Contact page, the feedback form. Neither sends anything when a page loads: nothing leaves your device unless you press Send on the feedback form, and then it sends exactly what When you submit feedback above lists, no more.
• Two third parties: Google Analytics and Google AdSense. See Google Analytics and Google AdSense below for exactly what each sends. No tag managers beyond gtag.js itself, no external fonts or scripts, and no ad network besides AdSense. Every other request your browser makes goes to a server that runs this site (the main site and its real-time game servers) and nowhere else.

Google Analytics

We use Google Analytics 4 to see which pages get visited, roughly how people move through the site, where visitors come from, and which games get played and finished. It is separate from the first-party stats described above, which stay on our own server; what Google receives is listed below.

What this means in practice:

• Google Analytics sets its own cookies in your browser and Google receives the data it always receives for any site running its script: which pages you viewed, in what order, roughly where you are, and enough about your browser/device to distinguish your visits from someone else's. Google's own privacy policy governs what Google does with that once it reaches them — ours does not, and cannot.
• Once you have played a game for a few seconds, and again when you finish it, we tell Google Analytics which game it was and, for a finished game, a rough length ("under 30 seconds", "30 seconds to 2 minutes", "2 to 5 minutes", "over 5 minutes"). The tools (calculator, timer and so on) send nothing of this kind. We add no score, difficulty, name or room code to it. Like every Google Analytics hit, it still carries what Google always receives: its visitor-id cookie, your IP address and your browser type.
• If you arrive from a link that carries campaign tags (for example an advertisement or a post we wrote), Google Analytics also sees those tags (only those: other parts of a link's address after the "?" are not passed on) and the site you came from, so we can tell which of our links brought people. Pages with a private link (a room code, a challenge, a recording or drawing that is not listed) are reported with the private part replaced by the word "redacted".
• Google Analytics's standard engagement measurement is on: scrolling, links you click that leave the site, and how long a page is in front of you.
• Its visitor-id cookies (_ga, _ga_ followed by letters and digits, and _gid) last up to two years (_gid, one day). "Erase everything" in the app expires them and switches Google Analytics off until you reload or reopen the site, so it cannot write them again in the meantime; when the site is next loaded, Google Analytics may set a new, unrelated one. You can also clear them in your browser settings.
• We have not enabled Google's advertising features (no remarketing, no ad personalization, no Google Signals) — Consent Mode is configured to deny those signals outright. This is measurement only.
• It is subject to the same Global Privacy Control opt-out as the rest of this page: a browser sending GPC never loads the Google Analytics script at all.
• Google Analytics is only switched on in the live site's own build; development and test builds never contact Google. It has the same opt-out as the anonymous play counts described above.

Google AdSense

We show Google-served ads on the home page only, where you pick which game to play: in a left and a right rail beside the game list on wide screens, and in a banner below it. Ads never appear inside a game, during a round, or on a score screen — those stay exactly as ad-free as the rest of the site always has been.

What this means in practice:

• Each ad is requested non-personalized. It reuses the exact same Consent Mode signal Google Analytics already sets (ad_storage, ad_user_data, and ad_personalization all denied) — Google gets no advertising ID, no interest profile, and no cross-site tracking signal from this site. The ad you see is chosen from the page's content and your rough location only, the same as any non-personalized ad on any site.
• Loading the ad script and requesting an ad tells Google that a page on this site was viewed, on top of whatever the Google Analytics section above already describes — the same kind of request any site running AdSense sends. Google's own privacy policy governs what happens to that once it reaches them, same as with Analytics.
• The side rails reserve their space on the page even before any ad is configured for that side, so that turning an ad on later never nudges the game grid or resizes the page around you mid-visit — an unconfigured side just shows as empty space, not a bordered placeholder box. The banner below the game list reserves nothing: it only exists once an ad is configured, and it sits under everything else on the page, so it can't move a tile you're about to tap.
• It is subject to the same Global Privacy Control opt-out as the rest of this page, and GPC is the one thing that overrides the "always reserve the space" behaviour above: a browser sending GPC never loads the AdSense script and never sees any ad at all — the rails' space and the banner simply don't exist in the page.
• Each placement needs the shared publisher id plus its own slot id (right rail, left rail, bottom banner) to show an actual ad; a placement with either half missing shows nothing and sends nothing to Google for it. Those ids are public by nature (every browser receives them) and are built into the site, so a normal deployment needs no setting at all; an individual installation can turn ads off. Development and test builds never show ads or contact Google.
• We chose home-page-only, not in-game, deliberately: this is a mixed-audience site that children will inevitably play, and an ad placed inside active gameplay or on a screen a child lingers on (an end-of-round score screen, say) is exactly the kind of accidental-tap risk we designed the rest of this site to avoid. Static placements on the browsing page — the side rails and the banner under the game list — that never move and never overlap a tile you might tap, were the deliberate trade-off instead.

Where a visit came from, without keeping IP addresses

Every request on the internet arrives carrying an IP address; that is how replies find their way back, and it cannot be switched off. What matters is what a server does with it.

Ours looks the IP up against a bundled offline geography database, writes down the two-letter country code and — where the database has one — a state or province, and discards the address. Our stats server never writes the address to its database or to its own logs, and never sends it anywhere. The table that stores play records has no column it could go in, and there is an automated test that fails the build if one ever appears or if an address turns up in one of that server's log lines. One other log does hold addresses, and we say so plainly at the end of this section.

The lookup uses an offline database derived from MaxMind's GeoLite2 data, used under CC BY-SA. It is bundled with our server, so no request about a player ever leaves our machine.

Country accuracy is approximate — around 99% at country level, and the bundled data ages between updates. It is good enough to answer "which countries is this being played in" and is not used for anything else.

A state or province is much less reliable than the country it sits beside. We added it because the operators' dashboard wanted to answer "which state" as well as "which country", but the underlying data is nowhere near as accurate at that finer grain — treat a single row on the dashboard with real suspicion, and a broad pattern across many rows with more confidence than any one of them. It is still never anything finer than a state or province: never a city, never a postcode, never a pair of coordinates, and that ceiling is enforced in the database schema itself, not just in the code that writes to it.

Visits recorded before this state/province column existed have no state or province at all, and there is no way to add one after the fact — the address a visit arrived on is discarded immediately, by design, which is the same reason no address is ever kept for any visit. The dashboard shows those older rows as an explicit "not recorded" note rather than folding them in with a state the database genuinely doesn't know, because those are two different kinds of gap and only one of them is a real "we don't know."

A visit from a private network address (a local test, a VPN, a misconfigured deployment) is never looked up at all — it is recorded as "Private network" rather than guessed at, using a reserved code (ZZ) that is not a real country and cannot be confused with one on the dashboard. A private-network visit never carries a state or province either.

The web server's ordinary log

The web server that sends you our pages keeps the standard access log that nearly every website keeps. For most requests, one line in it records the time, the address you asked for, the network (IP) address the request came from, and the browser identification and referring page your browser sent with it. The requests that carry the anonymous play record, the "still on this game" ping, the heart and star on a game and the live counts, Guess the Word's check of whether you have played a period's word, and Gobbler's top-10 lists and death replays are switched off from this log. Every other request, including loading a page, is in it. Anything in the address of a request is in its line too: Guess the Word's live room connection, for example, puts the room code and your device's random id in its address, so that line holds the id and the network address side by side. This log is not written to the database and stays on our own servers. We have not set up automatic expiry for it on this deployment, so it persists until we clear server logs by hand. A server in front of ours, where there is one, keeps a log of its own in the same way.

Our stats server, the part behind the play record and the features that need a server, keeps a request log of its own too, and "switched off from this log" above does not reach it. That log never contains the network address a request came from. It does record the web address of each request it handles, including anything after a question mark, so two kinds of request leave a line there holding your device's random id: Guess the Word's check of whether you have played a period's word, and Guess the Word's live room connection. It is not written to the database, and it has no automatic expiry on this deployment either, so it persists until we clear server logs by hand.

The Share button

Every game has a Share this game button. It copies a link, and it offers to hand that link to WhatsApp, X, Facebook, Reddit, Telegram, your email app, or your phone's own share sheet.

Two things about it are worth knowing.

The buttons do not talk to those companies. They are ordinary links. Nothing loads from WhatsApp or Facebook, no script of theirs runs on our page, and none of them is told you were here unless you go on to actually send the message yourself.

The link carries one word saying which button made it — ?from=whatsapp, and that is the entire addition to it. When somebody opens that link, the app reads the word, removes it from the address bar immediately, and includes it with the rounds they finish during that visit. So we can see "eleven devices arrived from a WhatsApp link this month" and nothing more precise than that.

What it deliberately cannot do:

• It cannot say who shared it or who followed it. There is nothing in the link identifying either person. It is the same word for everybody.
• It cannot say where you were. It names one of our own eight buttons; there is no field for a URL, a group, a chat or a search term, and the database column it lands in refuses any value that is not one of those eight words.
• It does not follow you. It lasts only while the page stays open: it is held in the page's memory and is not stored on your device, so a device that arrived from a link once is not labelled that way afterwards, and rounds you play tomorrow are not attributed to it.
• It is usually not there at all. Most visits are a bookmark, a typed address or a search result, and those are simply recorded as arriving directly. That is normal, and the staff page shows it as the largest bar on the chart.

The piano gallery

Saving a piano recording asks you to tick a box: "Make it public." What that box controls, in full:

• Unticked (the default): the recording is saved so the link you're given works — anyone who has the exact link can play it back — but it is not listed anywhere and cannot be found by browsing. Like every saved recording, it still has a status of "pending" and appears, with its name and length, in the list the people who run this site use to review recordings; it is not put in the gallery.
• Ticked: the recording is submitted for gallery review with a status of "pending." An operator reviews it before it appears in the gallery. This is a manual step by a person who helps run this site — nothing you save becomes publicly listed purely by the passage of time or by ticking the box yourself. Once an operator approves it, it appears in /play/piano/gallery, newest first, labelled with the name you typed (or "Recording #N" for one saved before names existed). If an operator rejects it, it never appears in the gallery — you can still see it (with a "rejected" status) from "Your recordings," and the direct link keeps working regardless of the outcome either way.
• Renaming an already-approved recording immediately removes it from the public gallery and puts it back to "pending" until an operator reviews the new name. There is no way for a name nobody has reviewed to be shown publicly, even for a moment — the same rule the Pixel Art gallery below already follows for an edited drawing.

Either way — ticked or not — the recording itself is playable by direct link immediately; the review step only ever controls whether it can be found by browsing the public gallery. What's stored server-side is the note/pedal/transpose data, the name, and the device id described above — the device id is never shown on the by-id or gallery pages. Our server does send it to the staff's browser along with the review list, but no screen of the dashboard shows it. Any note an operator leaves when rejecting a recording is staff-internal only and is never shown to you.

You (the person who saved it) can delete or unlist it yourself, from either /play/piano/gallery's "Your recordings" section or the recording's own replay page — no account or sign-in needed, just a private key your browser remembered at save time; losing that (clearing your browser data, or switching device) means losing the ability to manage that recording yourself. Separately, if a public recording needs to come down for another reason, the people who run the site can also remove it from the same password-gated staff page used for play stats. Either way, once removed, the link 404s and the recording drops out of the gallery immediately — see "Staff-deleted feedback and recordings: a Bin, then a shorter retention window" below for what happens to the recording itself after a staff removal specifically (your own self-serve delete removes it outright).

Every saved piano recording, public or not, is deleted automatically after the same 400 days described below.

The Pixel Art gallery

Same review step as the piano gallery above — submitting a drawing does not put it in front of other players right away. What happens, in full:

• You press "Submit to gallery": the drawing is sent with the title you typed and saved server-side with a status of "pending." It is not listed anywhere and cannot be found by browsing — the gallery shows only approved pieces. A pending piece can still be opened by anyone who has its exact link, the same way an unlisted piano recording can.
• An operator approves it: the drawing appears in /pixel-art/gallery, newest first, labelled with your title. This is a manual step by a person who helps run this site — nothing you submit becomes public purely by the passage of time or by pressing a button yourself.
• An operator rejects it: the drawing never appears in the gallery. You can still see it (with a "rejected" status) from your own device's "My Creations"/"Your submissions" list, and you can edit and re-submit it.
• You edit an already-approved drawing: it is immediately removed from the public gallery and goes back to "pending" until an operator reviews the new version. There is no way for a version nobody has reviewed to be shown publicly, even for a moment.

What's stored server-side is the drawing, the title, and the device id described above — the device id is never shown on the by-id or gallery pages. Our server does send it to the staff's browser along with the review list, but no screen of the dashboard shows it. Any note an operator leaves when rejecting a piece is staff-internal only and is never shown to you.

You (the person who submitted it) can edit or delete it yourself, from "My Creations" (the gallery's "Your submissions" list shows each piece's status) — no account or sign-in needed, just a private key your browser remembered at submit time; losing that (clearing your browser data, or switching device) means losing the ability to manage that submission yourself. Separately, the people who run the site can remove any piece — approved or not — from the same password-gated staff page used for play stats; once removed, it drops out of the gallery and off the by-id page immediately and permanently (unlike the piano gallery's staff removals, this one is not a soft delete/Bin entry).

Submitted drawings are kept indefinitely until you or an operator deletes them — there is no automatic expiry the way play records and public piano recordings have.

Timer: what it keeps on your device, and the embeddable widget

Some of the tools described from here on (the Tuner, Dice, Calculator and Group Maker) are still being finished and may not be available on every version of the site. Each section says what a tool does with your data, so that this page is already accurate on the day a tool launches.

Timer (/play/timer) is a set of timers — countdown, stopwatch, interval, workout, hourglass, bomb fuse and a chess clock. It is the same free-play shape as Piano and Pixel Art, built to keep as little as possible, and everything it remembers stays on your device.

On your device only. One localStorage key, pfg.timer.v1, holds: the durations you recently used and the ones you pinned, your saved workout routines (the exercises are chosen from a fixed list, and a routine is called "Routine 1", "Routine 2" … — you never type a name), your alarm choices (sound, volume, repeat, vibrate, keep-screen-on, notify, speak), and the state of each timer you have started (running, paused or finished; one left untouched for a month is no longer offered once Timer next opens, and is cleared from storage the next time Timer saves anything; Reset removes it at once), so a refresh or an accidentally closed tab picks up where you were. While a tab is open, your browser also remembers, in that tab only and until it is closed, which timer is open, so that a reload reopens it. None of it is ever sent anywhere. "Erase everything" in the account menu deletes the key.

No text you type is stored or sent. There are no timer titles, routine names or messages. The date-and-time for "count to a date" is picked with your browser's own date picker and turned into a length of time (the date itself is not kept); the search box on the timer list is a local filter and is not kept.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded — see "When you finish a round" above), and the same "N playing" presence ping. Timer adds nothing to that: no timer settings, durations, laps, routines or exercises are reported. There is no score, so nothing is ever ranked.

Notifications, wake lock, vibration and speech. Notifications and spoken cues are off until you turn them on in Timer's settings. Keeping the screen on and vibrating are on by default, and only where your browser has them: the screen is kept on only while a timer is running, and vibration happens only when an alarm rings. All four can be switched off in the settings. Your browser is asked for notification permission only when you press "Notify me when this tab is hidden" — never on page load. Spoken cues are off by default and use only a voice that is installed on your device; some browsers' default voices stream audio from a remote service, and Timer refuses to use those, so no spoken text ever leaves your device.

Share links. A link such as /play/timer/t/AQAC… is a compact code containing only the kind of timer, its settings (numbers and choices such as a workout's exercises), the alarm sound you picked and two display choices, light or dark and whether to show its buttons — no name, no text, nothing about you, no account. Anyone who opens it gets that timer, ready but not started; opening one does not start it, does not change your own saved alarm sound, and does not touch any timer you have saved (starting the shared timer does replace your saved run of that same kind). A code that is not one of ours is shown as "This link isn't a valid timer". Like any web address, the link is visible to this site's own server when it is opened. The page address sent to Google Analytics has the code replaced by a fixed placeholder.

The embeddable widget (/embed/timer/<code>). The same code can be shown in an <iframe> on another website. That page is built so it cannot be used to follow the people who see it: it does not load Google Analytics or AdSense, sends no play record or presence ping, makes no data request of its own (its content-security policy forbids fetches and beacons), and stores nothing in the visitor's browser — not localStorage, not a cookie — apart from a crash-recovery counter in sessionStorage if the widget itself crashes. It cannot ask for notification permission, hold the screen awake, vibrate or speak. It plays the alarm sound only after the visitor taps something inside the frame. Its single link, "Made with Timer", opens the full game in a new tab. The site that embeds it can of course see its own visitors. This site's server still receives the request that loads the frame, as it does for any page (so it sees that request's network address and the code in the address), but the frame sets no identifier and records no play.

Metronome: what it keeps on your device

Metronome (/play/metronome) is a tempo tool, free play like Piano and Timer. Everything it remembers stays on your device and is never sent anywhere.

On your device only. One localStorage key, pfg.metronome.v1, holds your tempo, your rhythm (beats per bar, beat note, subdivision, grouping, which beats are accented, normal, quiet or silent, swing, count-in, polyrhythm), your sound and volume, the trainer settings, your picture-delay correction and whether you want a vibration on the downbeat. A second key, pfg.toolVoice.v1, holds one yes/no: whether you switched on Quiet mode (no jokes) — shared by the tools that have jokes. "Erase everything" in the account menu deletes the first key; the second is a display preference like the light/dark theme and stays. Whether you muted the site's sound (the speaker button, or the M key) is kept on your device too; like the theme it is a display preference and stays after "Erase everything".

No words you type are stored or sent. There are no titles or names; every setting is a number, a yes/no, or a choice from a fixed list (a tempo you type in is kept as a number). The jokes are written in advance and chosen at random on this device.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded — see "When you finish a round" above) and the same "N playing" presence ping. The metronome adds nothing to that: no tempo, rhythm, tap or trainer result is reported. There is no score, so nothing is ranked. All sounds are made on your device — no audio file is downloaded — and the Metronome does not use your microphone or camera.

The tap-along check compares your taps with the clicks, in your browser, to show you a verdict and a chart. Your last 16 timings are kept in the page's memory only while it is open (the Clear button empties them); they are never stored or sent.

Wake lock and vibration. Stage mode asks your browser to keep the screen awake while the beat runs, and the optional downbeat vibration (off until you switch it on) uses your device's vibration motor, only where the browser has them. Neither needs a permission prompt and neither sends anything.

Tuner: your microphone stays on your device

Tuner (/play/tuner) listens to your instrument through your microphone to tell you which note it is playing and how far off it is. It is one of the two places the site uses your microphone (the other is the Noise Meter, described further below), so here is exactly what happens.

The sound never leaves your device. Your browser hands the Tuner a live stream from the microphone. The Tuner looks at a fraction of a second of it at a time, works out the pitch, and throws that fraction of a second away. Nothing is recorded, nothing is uploaded, nothing is saved, and no sound or pitch is sent to anyone — not to us, not to Google, not to any other service. There is no recording feature to turn on by accident. While the microphone is open the Tuner shows a chip saying so ("On this device only").

You are asked first. The first time you press Start tuning the Tuner explains why it wants the microphone and waits for you to press Continue; only then does your browser show its own permission prompt (unless you have already allowed this site). Saying no to either leaves the rest of the site working as before, and the Tuner explains how to change your mind.

It stops when you stop. The microphone is switched off when you press Stop, when you leave the page, whenever your browser reports the tab as hidden (switching tabs, minimising the window, or moving to another app on a phone or tablet), and for as long as a reference tone is playing (some phones turn the sound down or send it to the earpiece while a microphone is open). If the tab is hidden when you answer your browser's prompt, the microphone is switched straight back off. It does not turn itself back on when you return to the tab; you press Listen again. Your browser also shows its own indicator while a page is using the microphone.

Taking permission back. To stop the site being allowed to ask at all, open your browser's site settings for this page (usually the lock or tune icon beside the address) and set Microphone to Block. The Tuner then says the microphone is blocked and how to undo that.

On your device only. One localStorage key, pfg.tuner.v1, holds your instrument and tuning, the reference pitch (A4), whether you read the notes as a transposing instrument, whether you prefer the strobe or the needle, whether reference tones keep playing after you let go, and whether you have already read the microphone explanation. It holds no sound and no notes you played. "Erase everything" in the account menu deletes it. The shared Quiet mode key, pfg.toolVoice.v1 (no jokes; shared by the tools that have jokes), is a display preference like the light/dark theme and stays. The jokes are written in advance and chosen at random on your device.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded — see "When you finish a round" above) and the same "N playing" presence ping. The Tuner adds nothing to that: no note, no pitch, no instrument and no setting is reported. There is no score, so nothing is ranked. The reference tones are made on your device — no audio file is downloaded.

Screen wake lock. While it is listening, the Tuner asks your browser to keep the screen awake, where the browser has that. It needs no permission prompt and sends nothing.

Lucky Wheel: what it keeps on your device

Lucky Wheel (/play/lucky-wheel) is a decision wheel, free play like Piano and Timer. You type the choices yourself — one per line — and everything it remembers stays on your device and is never sent anywhere.

On your device only. One localStorage key, pfg.luckywheel.v1, holds the text you typed in the choices box and which of the six wheel styles you picked, plus your spin time, colour and sound settings (the weights you give choices are part of the text). The first time you visit, the box holds a short example list (Pizza, Tacos, …) that is not stored until you change something. "Erase everything" in the account menu deletes the key.

The text you type stays here. Your choices are drawn on the wheel and shown on the page by your browser; they are not in the address bar, not in the share link, not in any request to this site or anyone else, and not in Google Analytics. Before they are stored or shown, invisible and direction-changing characters are removed on your device; the wheel itself uses at most 24 choices of 40 characters each. The result of a spin is chosen on your device with the browser's secure random generator and is not reported.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded — see "When you finish a round" above) and the same "N playing" presence ping. Lucky Wheel adds nothing to that: no choices, no result, no style. There is no score, so nothing is ranked.

Dice: what it keeps on your device

Dice (/play/dice) is a 3D dice tray, free play like Piano and Timer. Every die's value is chosen on your device with your browser's secure random number generator (crypto.getRandomValues) before the dice move; if your browser has none, the tool says so and rolls nothing.

On your device only. One localStorage key, pfg.dice.v1, holds your dice look, the dice you last picked, your roll history (the last 50 rolls: what you rolled, the total and the time) and your saved rolls (up to 20, each named after its dice). Your history and saved rolls stay on your device and are never sent anywhere — not in the address bar, the share link, any request to this site or anyone else, or Google Analytics. Everything read back from the key is checked before it is used, and "Erase everything" in the account menu deletes it. (The shared "Quiet mode" switch for the jokes is a display preference, like the theme, and is kept.)

Shake to roll. If you turn it on, your phone's motion sensor is read to notice a shake. The readings are used for that and thrown away; nothing is stored or sent, and your browser asks permission first on some phones.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. Dice adds nothing to that: no notation, no result, no history. There is no score, so nothing is ranked.

Calculator: your tape and variables stay on your device

Calculator (/play/calculator) is a free-play tool like Dice and Timer. Every sum is worked out on your device by the calculator's own code; nothing you type is sent anywhere to be calculated, and there is no currency conversion (which would need a live rate from a server).

On your device only. One localStorage key, pfg.calculator.v1, holds your tape (the lines you typed, and which of them you switched to the other reading), so anything you wrote there — including variables such as rent = 1200 and any figures in them — your angle setting (degrees, radians or gradians) and whether you prefer exact or decimal answers. The tape stays on your device and is never sent anywhere: not in the address bar, the share link, any request to this site or anyone else, or Google Analytics. Everything read back from the key is checked before it is used (a bad line is dropped, lines are capped at 200 and 200 characters each, control characters are stripped, and the text is only ever shown as text and handed to the calculator's own parser, never run as code), and "Erase everything" in the account menu deletes it. The copy button writes only the result you asked for to your clipboard. (The shared "Quiet mode" switch for the jokes is a display preference, like the theme, and is kept.)

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. Calculator adds nothing to that: no expression, no result, no tape. There is no score, so nothing is ranked.

Password Generator: nothing it makes is kept or sent

The Password Generator (/play/password-generator) makes random passwords, passphrases and PINs. The promise is simple and the code is built to keep it: what it generates never leaves your screen.

Made on your device. Every value is drawn with your browser's own secure random number generator (crypto.getRandomValues). If your browser does not have one, the tool says so and makes nothing: it never falls back to a weaker source. Nothing about the choice is requested from any server.

Never stored, logged or sent. A generated value lives only in the page while it is open. It is not written to localStorage or sessionStorage, not put in the address bar, the tab title or the share link, not printed to the developer console, not included in the anonymous play record, not in Google Analytics, and not in a feedback report or an error report. It is wiped when you leave or close the page, and when you close the tab it is simply gone.

What it remembers. One localStorage key, pfg.password.v1, holds your settings only: which kind you last chose, the length or word count, which character sets are on, which symbols are allowed, the other on/off options (leaving out look-alikes, capitalising words, adding a digit, skipping obvious PINs), the separator, and how many to make at once. No value, ever. "Erase everything" in the account menu deletes the key. (The shared "Quiet mode" switch for the jokes is a display preference, like the theme, and is kept.)

The clipboard. The tool writes to your clipboard only when you press a Copy button, and never reads it. It cannot clear the clipboard afterwards (a browser needs a permission prompt for that), so a clipboard manager or another app may keep a copy: paste it where you need it and clear it yourself if that matters.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. The Password Generator adds nothing to that: no value, no length, no kind, no settings.

The word list. Passphrase mode draws from the EFF large word list, which is part of this site's own files (loaded from this site, only when you open Passphrase mode). It is not fetched from the EFF.

What it will not do. It has no "check my password" box, because typing a real password into any web page is a habit worth not teaching; no breach look-up, because that would be a network request; no history, vault or saved list; and no share-by-link for a value.

Group Maker: your class list stays on your device

The Group Maker (/play/group-maker) splits a list of names into groups. A class list is a list of children's names, so the promise is plain and the code is built to keep it: the names never leave your screen, and the operator never receives one.

Made on your device. The list you paste, the groups, the result code and the printout are all worked out in your browser. The tool makes no request to any server that carries your list, so there is nothing for the site to receive, store or log.

By default, nothing is kept. The list lives only in the page while it is open. It is not written to localStorage or sessionStorage, not put in the address bar, the tab title or the share link, not printed to the developer console, not included in the anonymous play record, not in Google Analytics, and not in a feedback report or an error report. Refresh the page, or close the tab, and it is gone. The groups themselves are never kept, whatever you choose.

The list it can remember, only if you ask. There is a switch, Save this list on this device, and it is off. Switch it on and the list (and the split settings: how many groups, the group size, the team-name style) is saved in one localStorage key, pfg.groupmaker.v1, so it is there next time you open the tool on this device. It is never sent anywhere. Because it holds names, the switch tells you not to use it on a shared computer. The Forget list button erases the saved copy at once, switching the saver off erases it, and "Erase everything" in the account menu deletes the key too. The result code on screen contains no names: it is only a number that lets you re-create the same split from the same list.

Gender is optional, and it is only ever part of your list. You may mark a name as female, male or other, either by typing a tag after the name (for example Ava, F) or with the Set genders picker, which just edits that line of your list. Gender is sensitive information about children, so the tool treats it like the names themselves and no more: it exists only inside the list text on your screen, so it is kept only if you switch on "Save this list on this device" (then it is saved as part of that text, in the same one localStorage key, and erased by Forget list in the same way). The chosen gender rule (no rule, same gender only, mixed) is saved as a setting under the same switch; it says nothing about any person. Gender is not stored anywhere else, not sent anywhere, not in the address bar, the tab title, the developer console, the anonymous play record, Google Analytics or an error report, and it is not shown on the group cards or written into Copy as text, Download CSV, Print or Big view. The custom group sizes you enter are also just settings, saved only under the same switch.

The clipboard and downloads. The tool writes to your clipboard only when you press Copy as text, and never reads it; the CSV file is built in your browser when you press Download CSV and goes only to your own device. A clipboard manager or the file itself may keep a copy: delete it if that matters.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. The Group Maker adds nothing to that: no name, no count of names, no group, no setting.

The 3D hat. The optional draw-from-the-hat animation is told which group each slip goes to and nothing else; no name is ever handed to it.

What it will not do. It has no sharing of a class list by link, no cloud save, no accounts and no history of past splits.

Scoreboard: your scores, saved games and teams stay on your device; a team name you type is looked up for its colours

The Scoreboard (/play/scoreboard) is a full-screen score counter for any game: two sides, each a solid colour with a big number, and a tap on a side adds a point. Your scores, your colours, your saved games and your teams stay on your device. There is one exception, described under "Looking up a team's colours" below: while you type a team's name, the name itself is sent to our server to ask whether it knows that team's usual colours.

On your device only. One localStorage key, pfg.scoreboard.v1, holds the two colours you picked, the two scores, the last 200 changes (each a point, a corrected score or a reset), so that Undo still works after you reload the page, and the time of the first and the latest point of the game in progress, so the tool can tell you when a game ran, and which of your saved teams (below) is on each side, which side is on which half of the screen, and whether you switched on swapping the sides when you turn the phone around (the tool reads only which way the screen is turned, never a motion sensor, and asks for no permission). There is nothing you type in it. None of it is sent anywhere: not in the address bar, not in any request to this site or anyone else, and not to Google Analytics. Everything read back from the key is checked before it is used, so a damaged or edited value is ignored and the plain defaults (green and blue, 0 to 0) are used instead.

Saved games, and the name you type. If you choose to save a finished game, a second localStorage key, pfg.scoreboard.games.v1, keeps it: both scores, both colours, when the game ran (the first point to the last) and the name you typed for it. That name is optional (a blank name is saved as "Untitled game"). It is limited to 40 characters, tidied (extra spaces and invisible characters are removed) and shown back only to you, as plain text, on this device. It is never sent anywhere, not even with the anonymous play record described below, and nothing checks or filters it because nobody else ever sees it, so it is yours to name as you like. A list of up to 50 saved games is kept; at 50 the Scoreboard asks you to delete one rather than dropping an old game quietly. Delete removes one saved game from the device (it asks first, and cannot be undone). "Erase everything" in the account menu deletes the saved games and their names, as does clearing this site's data in your browser. Because this list lives only in this browser on this device, a different browser or device starts with none.

Teams, their names and their pictures. If you add teams for a match, a third localStorage key, pfg.scoreboard.teams.v1, keeps them: for each team the name you typed, its main colour, an optional second colour and an optional picture. The name is limited to 30 characters and tidied (extra spaces and invisible characters are removed). It is kept as plain text and shown on the Scoreboard screen of this device, large on that team's half, and in your team list, so anyone who can see the screen can read it, and the picture too. A saved team is never uploaded; the only time a team's name is sent anywhere is the colour lookup described next, which does not save it. Nothing checks or filters the name, so it is yours to choose; pick something you are happy for the room to see. A picture is one you choose yourself from your own device. The Scoreboard does not keep your file: it reads it on your device, checks it really is a picture, draws a small copy (no larger than 192 pixels on a side) and keeps only that copy, so details hidden inside a photo, such as where or when it was taken, or what camera took it, are not kept. The copy is stored in the same key as a piece of text, at most about 60,000 characters. Your saved teams, their colours and their pictures are never uploaded, and a picture is never sent anywhere at all, not even with the anonymous play record described below. Up to 30 teams are kept; at 30 the Scoreboard asks you to delete one. Delete removes a team and its picture from the device (it asks first, and cannot be undone). "Erase everything" in the account menu removes this key too, teams and pictures included, as does clearing this site's data in your browser. Teams live only in this browser on this device.

Looking up a team's colours. While you type a team's name in the team editor, the Scoreboard pauses for a moment after you stop typing and then sends that name, and only that name, to our server to ask whether it knows the team's usual colours. If it does, the two colour choices fill in by themselves, with no message; if it does not, or you are offline, or anything goes wrong, nothing happens and nothing is shown. Nothing is sent for a name shorter than three characters, and if you have already changed a colour yourself the answer is ignored. What is sent is the name as you typed it (cleaned of stray spaces and invisible characters, 30 characters at most), as the body of a single request to this site, with no cookie, no device id, no picture and nothing else from your device or the Scoreboard; a name you type for a team that is a child's is sent the same way and is covered by everything here. Our server looks the name up, replies with two colours or "no match", and then forgets it: the name is not saved, is not written to any log, is not counted, and is not linked to you or your device. (Like every request to this site, the request itself, that something was asked of this page address from a network address at a certain time, appears in the web server's ordinary log described below; the name is not in it.) To stop anyone using this to list every team we know, the server answers only for one exact name at a time (never a list or a partial match) and limits how many names a single network address can ask about in a few minutes. The colours you choose for a team name yourself are remembered only on your device, in a fourth localStorage key, pfg.scoreboard.teamcolours.v1: the team name in a simplified form (lower case, without accents or punctuation), its main colour and its second colour, up to 200 names. They always win over our server's suggestion for the same name, and then the name is not sent at all. "Erase everything" removes this key too.

Number colours. In the Colours sheet you can choose the colour of a team's numbers instead of the automatic black or white. That choice is remembered only on your device, in a fifth localStorage key, pfg.scoreboard.inks.v1: the team name in a simplified form (lower case, spaces tidied) and the colour you chose, up to 100 names. It is never sent anywhere, and "Erase everything" removes it.

Keeping the screen on. While the Scoreboard is open it asks your browser to keep the screen awake, so the phone does not go to sleep mid-match. That is a request to your own browser; nothing is stored or sent, and it is released when you leave the page.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. The Scoreboard adds nothing to that: no score, no colour, no history, no saved game, no team, no picture and no name. The team-name lookup above is a separate request that is not part of the play record and is not linked to it. There is no ranking, so nothing is compared with anyone else.

Microphone: Noise Meter

The Noise Meter (/play/noise-meter) listens to the room through your microphone to show how loud it is. Like the Tuner (see "Tuner: your microphone stays on your device" above), it is one of the two places the site uses your microphone, so here is exactly what happens.

The sound never leaves your device and is never recorded. Your browser hands the Noise Meter a live stream from the microphone. It looks at a fraction of a second of it at a time, works out how loud that fraction is, and throws the fraction away. Nothing is recorded, nothing is uploaded, nothing is saved, and no sound or loudness is sent to anyone -- not to us, not to Google, not to any other service. There is no recording feature to turn on by accident. The only thing that exists is a loudness number, in the page's memory, for the live display and for the summary at the end. While the microphone is open the Noise Meter shows a chip saying so ("Listening on this device only").

You are asked first. The first time you press Start listening the Noise Meter explains why it wants the microphone and waits for you to press Continue; only then does your browser show its own permission prompt (unless you have already allowed this site). Saying no to either leaves the rest of the site working as before, and the Noise Meter explains how to change your mind.

It stops when you stop. The microphone is switched off when you press Stop, when you leave the page, and whenever your browser reports the tab as hidden (switching tabs, minimising the window, or moving to another app on a phone or tablet); the display says it is paused. If the tab is hidden when you answer your browser's prompt, the microphone is switched straight back off. It does not turn itself back on when you return to the tab; you press Listen again. Your browser also shows its own indicator while a page is using the microphone.

Taking permission back. Open your browser's site settings for this page (usually the lock or tune icon beside the address) and set Microphone to Block. The Noise Meter then says the microphone is blocked and how to undo that.

What the numbers are. The Level is a relative 0 to 100 for your device and your room, not a measurement of sound pressure: phone and laptop microphones are not calibrated. Set quiet level takes about three seconds of the room and uses them to decide what "quiet" is; that reference is kept only in the page's memory and is forgotten when you leave. The session summary (the time you listened, the share of that time in each state, the peak and the longest quiet stretch) is shown on Stop, can be copied by you with Copy summary, and is not stored or sent.

On your device only. One localStorage key, pfg.noise.v1, holds your preferences: the view, the "too loud from" threshold, whether the soft chime is on, whether "Focus on voices" is on, and whether you have already read the microphone explanation. It holds no sound, no loudness history and no calibration. "Erase everything" in the account menu deletes it. The shared Quiet mode key, pfg.toolVoice.v1 (no jokes; shared by the tools that have jokes), is a display preference like the light/dark theme and stays.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. The Noise Meter adds nothing to that: no loudness, no state, no setting and no summary is reported. There is no score, so nothing is ranked. The optional chime is made on your device -- no audio file is downloaded. Google Analytics (described above) still counts the page visit -- that someone opened the Noise Meter -- unless your browser sends Global Privacy Control, and it receives nothing from the microphone.

Screen wake lock. While it is listening, the Noise Meter asks your browser to keep the screen awake, where the browser has that. It needs no permission prompt and sends nothing.

QR Code: nothing you type is sent or kept

The QR Code tool (/play/qr-code) makes a QR code from a web address, some text, an email, a phone number, a text message, a Wi-Fi network or a contact card. Everything you type is turned into the code on your own device, in your browser. It is never sent to anyone and never saved.

What you type stays on the page. The web address, the text, the Wi-Fi name and password, the contact details and the caption you add for printing live only in the page's memory. Closing or reloading the page forgets them. There is no history of past codes, on purpose: a Wi-Fi password should not be left lying around. A web address you enter is never opened, fetched or previewed by the tool; it only becomes squares.

What the code itself contains. A QR code is not secret. Anyone who scans a Wi-Fi code can join that network, and anyone who scans a contact code gets those details. The tool says so next to the Wi-Fi form. Choose what you put in a code the way you would choose what to write on a sign.

Downloads and copies stay on your device. The PNG, SVG, copied image and print copy are made in your browser. The file name holds the kind of code and the date (for example qr-wifi-20261013.png), never anything you typed.

On your device only. One localStorage key, pfg.qr.v1, holds your preferences: the last kind of code, the error-correction level, the PNG size, how it prints (one big code or a sheet), the code colours, and the look you picked (dot and corner shapes, the gradient and its end colour, the corner colour, and whether the frame is on). It holds none of what you typed, no picture and no frame words. "Erase everything" in the account menu deletes it. The shared Quiet mode key, pfg.toolVoice.v1 (no jokes; shared by the tools that have jokes), is a display preference like the light/dark theme and stays.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. The QR Code tool adds nothing to that: no content, no setting and no colour is reported. The optional 3D poster preview draws the same image on your device; no image is downloaded or uploaded.

A logo you add stays here too. If you put a picture in the middle of a code, it is read by your browser from the file you chose, drawn on your device and forgotten when you close the page. It is not uploaded, not saved (not in storage, not in the address bar), and not logged. The same goes for the words you put on a frame. Only the look settings listed under "On your device only" go in the same key; never the picture or the words. The file is also checked before your browser tries to open it: its own header must declare a size of at most 8192 pixels a side and about 24 million pixels in all, so a tiny file cannot make the page allocate a huge image.

No dynamic codes. The code you download is the data. Nothing points at a link we control, so there is nothing to track scans, nothing to expire and nothing to switch off later.

RaceCraft: what it keeps on your device

RaceCraft (/play/racecraft) is a free-driving game. The car's physics are worked out and the track is drawn on your own device; no part of a drive is sent to anyone.

On your device only. Two localStorage keys. pfg.racecraft.v1 holds your fastest finishing time on each track, your choices for the on-screen controls and for the graphics quality, and the tracks you chose to save in the track builder (up to 12 share codes, each with the time it was saved) together with your fastest times on those tracks. pfg.racecraft.car.v1 holds four short words: the paint, the stripe, the spoiler and the wheel style you picked for My car. Those four choices only change how your car looks, they are chosen from fixed lists (no typing, no uploads), and they are not part of any share link. None of this is sent anywhere: not in the address bar, not in any request to this site or anyone else, and not to Google Analytics. Everything read back from either key is checked before it is used, so a damaged or edited value is ignored and the plain defaults are used instead. "Erase everything" in the account menu deletes both keys.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. RaceCraft adds nothing to that: no time, no setting, no saved track and no car look is reported. There is no ranking and no leaderboard, so nothing is compared with anyone else.

Track codes stay on your device. A track share code is plain text that you copy and paste yourself. When you paste one, RaceCraft reads it on your device: the code is not uploaded, not looked up anywhere and not logged, and nothing in the game sends a code or a track to anyone.

Sound is made on your device. The engine, the tyre squeal and the chimes are generated while you play, so no sound file is downloaded and nothing is recorded. Nothing plays until you have touched the page, and the site's mute button silences all of it.

Crosstiles: your games stay on your device

Crosstiles (/play/crosstiles) is a word-tile game. You can play against the computer, share one device with up to three other people, or play online with up to three other people. When you play against the computer or share a device, the tiles are dealt, the words are checked and the scores are worked out on your own device; no move, score or player is sent to anyone. One optional extra, the short meaning of each word in the Words panel and in the Hint list, is looked up on this site's server and is described below. Playing online is different, because the other people are somewhere else: it is described in its own part, Online Crosstiles: what the connection carries, further down this section.

On your device only. Two localStorage keys. pfg.crosstiles.v1 holds the game you have in progress: the number that shuffled the tiles, how many players there are, and the list of moves made so far, so that after a reload you can continue from the last move that was played. Because the tiles are dealt from that number, the list is enough to rebuild every rack, so anyone who can open your browser's developer tools on that device could work out what a player is holding. The players are called "Player 1" to "Player 4": there is no place to type a name, so no name is ever stored. A game you have not finished stays on this device, even if you leave the game, until you continue it, finish it, choose Back to setup, start a new game in its place (you are asked first), choose "Erase everything" in the account menu, or clear this site's data in your browser. Everything read back from the key is replayed through the rules before it is used, so a damaged or edited value is ignored and you simply start from the setup screen. The best score you have reached is kept with your other scores on this device, like every game's. The second key, pfg.crosstiles.colors.v1, holds the tile colour you picked for each player: the names of up to four colours from a fixed list of six, in seat order, and nothing you type. It stays until you pick other colours, choose "Erase everything" in the account menu, or clear this site's data in your browser, and a value that is not on the list is ignored.

The word list. The list of valid words is part of this site and is downloaded from this site the first time you open the setup screen. Nothing you play is sent to check a word: that happens on your device.

Word meanings. The Words panel lists every word played, with its score and a short meaning, and the Hint list (pass and play and against the bot only) shows the words your own tiles could make, each with a short meaning. The meanings come from this site's own dictionary, which stays on our server and is never downloaded to your device, so this is the one thing Crosstiles sends. While the panel is on screen, your device asks for the meanings of the words shown in it, and only those: words that are already on the board for everyone at the table to see. If you press Hint, it also asks for the meanings of the Hint list's words you scroll to, which are words your tiles could spell and are not on the board, so they say a little about what is on your rack. Working out that list happens on your device and the list itself is never sent anywhere. The request carries no name, no device id, no game id, no cookie and no score, only the words. The server looks them up, answers, and does not store them or write them to any log. To stop one device flooding it, the server also counts requests per network address for a few minutes, in memory only, and keeps no list of the addresses afterwards. Your device keeps the answers in memory until you leave the game; nothing about them is saved. A word the dictionary has no entry for, or does not show, simply has no meaning line. If the dictionary cannot be reached, the panel says "Meaning unavailable" and the game carries on.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. Crosstiles adds nothing to that: no move, no word, no score and no player count is reported in it, and the only other things Crosstiles sends are the meaning lookup above and, if you choose to play online, the connection described next. Whether a round was played online or not makes no difference to that record: it cannot tell the two apart. There is no ranking and no leaderboard, so nothing is compared with anyone else.

Online Crosstiles: what the connection carries

Choose Online on the Crosstiles start screen to play with other people over the internet. You can open a public game (it is listed for anyone who opens the Online screen) or a private game (reachable only by its six-letter room code or by the /play/crosstiles/room/<CODE> link built from it), and you choose how many people play (two, three or four) and how long a turn lasts. Public games always have a turn timer; a private game may have none.

What the connection carries. While you are in an online game your device keeps one live connection to our real-time server. Over it goes the six-letter room code (when you join a game, or the one our server gives you when you open one), your choice of public or private, how many players and how long a turn lasts, and then, as the game goes, the tiles you place, swap or pass, and your resignation if you resign. Our server checks every one of these against the rules and the word list, keeps the board and all the racks, and sends each player the board and that player's own tiles only. Your tiles are never sent to the other players, and neither is the order of the tiles still in the bag: the other players see how many tiles you hold, not which. Each player's screen shows a list of the words played, with their scores.

Names are always random. Our server gives every player a random name (SwiftQuokka42-style) the moment they sit down, in public and in private games alike, and shows it to the other players. No name of yours is used or sent: not your account nickname, not the generated one your device made, and there is no place to type one. There is no chat and no way to send the other players a message. The one thing you type is the room code, which is about a game, not about you.

Where it is shown. A private game is reachable only through its code or link, and its players see each other's random names and scores. A public game is listed on the Online screen for anyone who opens it, a complete stranger who may never join you: each row shows the random name our server picked for the person who opened the game, how many players it wants and how many are here, the turn length, and how long it has been waiting, and nothing else about anyone. The list shows at most the 50 newest waiting games, and a game leaves it the moment it fills or starts. A waiting public game that nobody joins in time closes by itself after ten minutes. We can switch public games off, for example while we are checking they behave well; while they are off, the list is hidden, a game you open is private, and Crosstiles offers private games and invite links only. We can also switch online play off entirely, and until it is switched on for the site it says so and offers nothing.

How long it is kept. The game lives in our server's working memory only. It is gone when the room closes, and nothing about it is written to the statistics database or to any file: not the moves, not the words, not who played. A finished game's room closes on its own within a few minutes, and a game left untouched closes after half an hour. To stop abuse, our server also remembers the network address of a device that has a game open, in memory only, until that game's room is closed. It is used only to limit how many games one address can open at once, and it is not logged or listed.

If your connection drops. You have a minute to get back in. Your device keeps a private "seat key" for the game in this browser tab only (in the tab's session storage, which is cleared when the tab closes) for five minutes, so reloading the page puts you back in your seat with your own tiles; "Erase everything" in the account menu removes it. If you do not come back in time, the other players are told, and if the game had not really begun it is called off. A second tab holding the same seat takes it over and the first tab is told.

The word list is part of this site and is downloaded from this site; your device does not fetch words from anywhere else, and the live preview of a word in your own tray is worked out on your device. Casual and unranked: nothing is rated or put on a leaderboard, and a player who uses a word-finding tool on their own device cannot be stopped by us.

Tic-Tac-Toe: nothing about a match is saved

Tic-Tac-Toe (/play/tic-tac-toe) is the classic three-in-a-row game, played against a computer opponent or by two people who share one device. The computer's moves, the rules and the score are all worked out on your own device; no move is sent to anyone.

Nothing about a match is saved. Every time you open Tic-Tac-Toe you start from a fresh setup: the game on screen, the score so far and the computer's level are held only while the page is open and are gone when you leave or reload. The two sides are called "You" and "Bot", or "Player 1" and "Player 2": there is no place to type a name, so no name is ever stored. An earlier version of the game kept a match in progress on your device so you could continue it; that saved match is deleted the next time you open the game, and "Erase everything" in the account menu also removes it. The longest run of wins against the computer you have reached is kept with your other scores on this device, like every game's.

What is sent when you play the computer or share one device. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. Tic-Tac-Toe adds nothing to that in these two modes: no move, no score and no level is reported. There is no ranking and no leaderboard, so nothing is compared with anyone else.

Playing online is the one mode that uses the network. Open or join an online game (or follow an invite link) and your browser talks to our real-time server. What is sent is only: whether you are opening a public or a private game, which mark you would like (X, O or random), the room code you are joining, and the square you pick on each turn. There is no name field: our server gives both players a random name (SwiftQuokka42-style), and your device never sends one. A private game is reachable only by its code, or by the invite link built from it. A public game is listed for anyone who opens the Online screen, as a random name picked by our server, the mark the host asked for and how long it has been waiting, and nothing else about you: not your score, not your device id, not where you are. The list shows at most the 50 newest waiting games, and a waiting game that nobody joins closes by itself after ten minutes. We can switch public games, or online play altogether, off, for example while we check they behave well; while public games are off a game you open is private.

While an online game runs, the board, the turn and the result are held on our server, and only there, so that nothing on either screen can change the rules: each move you make is checked there and sent on to both players. It lives in the server's memory only. Nothing about the game is written to the database this site uses for statistics: no game is stored, no move list is kept, no opponent and no result is recorded, no rating exists and no leaderboard shows it, and there is no chat. A finished game is cleared from the server a few minutes after it ends, and a game left untouched is cleared after ten minutes. Each move has a 30-second clock; if you lose your connection you have 30 seconds to come back and carry on from the same position. So that a page reload can do that, your browser keeps a small secret for your seat in session storage (the kind that disappears when you close the tab), and it is removed when you leave the game. Your network address is used only to limit how many games one address can have open at once; it is held in the server's memory for as long as the game's room exists and is not written down by the game server. A rematch needs both players to say yes, and moves you both into a new private game.

Emoji Mixer: your sticker book stays on your device

Emoji Mixer (/play/emoji-mixer) is a toy: you pick two emojis and it draws a new sticker from them. The sticker is drawn on your own device by this site's own code; nothing about what you pick or make is sent to anyone.

On your device only. One localStorage key, pfg.emojimixer.v1, holds your sticker book: a list of the pairs of emojis you have mixed (up to 300, newest first, the oldest dropped once it is full). It stores only which two emojis made each sticker, never a picture, because the same two emojis always make the same sticker. There is nothing you type in it, so no name or text is ever stored. The book stays on this device until you remove a sticker, choose Clear book, choose "Erase everything" in the account menu, or clear this site's data in your browser. Everything read back from the key is checked before it is used, so a damaged or edited value is ignored and you simply start with an empty book.

Pictures and the clipboard. The emoji pictures are files served from this site itself, so showing them contacts nobody else. The clipboard is touched only when you press Copy image, and then only to put the sticker on it; this site never reads what is on your clipboard. Download PNG saves the sticker as a file on your device.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. Emoji Mixer adds nothing to that: no emoji, no pair and no sticker is reported, and there is no ranking, no score and no sharing of a book.

The Eight: what you have found stays on your device

The Eight (/play/the-eight) is a toy: you put two things on a scale and it shows what they make, starting from eight basic ones. Everything it shows is worked out on your own device from a fixed list that is part of this site; nothing you do in it is sent to anyone, and there is nothing to type, so no name or text is ever stored.

On your device only. One localStorage key, pfg.theeight.v1, holds a list of the things you have found (up to 5,000, oldest dropped once it is full) and one number, the most you have ever found. It stays on this device until you choose "Erase everything" in the account menu or clear this site's data in your browser. Everything read back from the key is checked against the fixed list before it is used, so a damaged or edited value is ignored and you simply start again from the eight.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. The Eight adds nothing to that: no item, no result and no count is reported, and there is no ranking, no score and no sharing.

Powder Run: your best distances stay on your device

Powder Run (/play/powder-run) is a ski game: you steer a skier down a mountain that your own device makes up as you go. Nothing you do in it is sent to anyone, and there is nothing to type, so no name or text is ever stored.

On your device only. One localStorage key, pfg.powder-run.v1, holds your best score on each of the three tracks (Green, Blue and Black) and which track you picked last. A best is saved while you play, so closing the page mid-run keeps it, and it only ever goes up. It stays on this device until you choose "Erase everything" in the account menu or clear this site's data in your browser. Everything read back from the key is checked before it is used, so a damaged or edited value is ignored and you simply start with no bests. Which mountain you skied (its random number) is not stored anywhere.

What is sent when you play. The same anonymous play record every game sends (the game id, a random id for the round and one for your device, how long it was on screen, your country derived from your network address and then discarded -- see "When you finish a round" above) and the same "N playing" presence ping. Powder Run adds nothing to that: no score, distance or track is reported, and there is no ranking and no sharing.

Typed nicknames: Go-Kart and Gobbler's multiplayer room

A few places on the site let your own display name — the one you type in the account menu, or the auto-generated one it starts as — be seen by someone other than you. All of them filter it for profanity before anyone else sees it, and none of them is ever part of the anonymous play record described earlier in this page — but they differ enough in scope that each gets its own description below. Piano's shared room is on this list too, and it is the first place your chosen AVATAR leaves your device as well.

Your account-menu nickname: where it goes

Your profile has one display name, shared across every game (SwiftQuokka42-style by default). You can replace it with your own free-text nickname from the account menu.

This name is not kept to yourself. Guess the Word's rooms (every time you create or join one), Piano's shared room, Stack's online Duel rooms and Gobbler's room each send this same account-wide name to our servers, and show it to the other players there. Private Online Chess games do the same; a public Chess game does not use your name at all (our server picks a random one instead). Go-Kart sends no name anywhere.

Where it's shown:

• Go-Kart's live standings panel — purely local, visible only to you, during your own race. Nothing about this use is sent anywhere.
• Guess the Word rooms — shown to the other players in the SAME room (its lobby, its in-round display, and its end-of-round top-3 list) while they are in it. Our server also stores it in the room's own player row, the same way it stores the room's own code and settings; How long it's kept below says how long that row lasts.
• Piano's shared room — shown to the other players in the same room, alongside your avatar, for as long as that room exists. Unlike Guess the Word, it is not kept in our database: it lives only in that room's memory on the real-time server (the one exception is a name our filter rejects, which goes to the blocked-text log described below). See Piano's shared room: your nickname AND your avatar below.
• Stack's Duel rooms — shown to the other player and, in a public room, to anyone browsing the list of open rooms. See Stack Duel's online rooms below.
• Online Chess games — in a private game, shown to the one person you gave the code to. A public game never shows your name: it uses a random one. See Online Chess: the name your opponent sees below.
• Gobbler's room, and its daily and weekly top-10 lists — see Gobbler's live multiplayer room name and the two leaderboard sections below.

What's collected: whatever you type, checked before it's accepted (see "What checks it" below) — a rejected nickname is never saved, and the profile keeps whatever name it had before.

Where the check happens, and what's sent: the check itself always runs on your own device — nothing you type is ever sent anywhere by this check, a rejected attempt never reaches our server, and nothing about a rejected OR accepted attempt on this field is ever logged or reported to us (see "The operator-visible blocked-text log" below for the one thing this promise does NOT cover). Once accepted, an ACCEPTED name is what Guess the Word's rooms, Piano's shared room, Stack's Duel rooms, online Chess games and Gobbler's room send to our servers when you use them.

The check makes exactly one network request, the first time you try to save a nickname: a same-origin request for the current list of operator-added filter overrides (words an operator has added to or excused from the filter through the staff dashboard, without a code deploy). What that call sends and receives, precisely: nothing you typed, ever — it carries no nickname, no device id, and no other identifying information; what comes BACK is a public wordlist, the same one shown in the staff dashboard, used only to decide whether your attempt passes. If that request fails (you're offline, the list can't be reached, anything else), the check silently falls back to checking against the filter alone — your nickname save is never blocked by this call failing.

How long it's kept: on your own device, in localStorage, exactly like the auto-generated name it replaces, until you change it again or erase your data. On our server, a Guess the Word room keeps each player's display name in that player's row for the room, beside your device's random id. Your row is removed when you leave the room or your connection drops (if our server itself goes down, nothing runs to remove it). But if the host closes the room, the other players' rows stay with the closed room until the room has been idle for 7 days, when the whole room and everything in it is deleted (our server checks once a day); a row left behind by our server going down goes the same way. That is much shorter than the 400 days for play records. We do not use the name for anything outside that room's own records. The other places a name goes keep it as described in their own sections below.

What checks it: every account-menu nickname, and every Guess the Word room's stored display name, runs through the SAME evasion-resistant profanity filter Gobbler's multiplayer names already used (leetspeak, spacing/punctuation tricks, and repeated-letter disguises are all caught, not just an exact word match). What it does and does not do — read this part plainly: it catches profanity, not whether what you typed is a real name or otherwise identifying. Typing your actual name is still not recommended; the field is labelled "Nickname" for exactly that reason.

Go-Kart's online race lobby

Pressing Start in Go-Kart's Race mode opens a connection to our real-time server, which fills the field with other players and bots. The address used to open it carries the track, difficulty, number of laps, how many seconds the lobby waits before the race starts, and the kart skin and look you chose; it carries no name and no device id, and like every connection it is written to our real-time server's ordinary log as one line. While you race, the connection sends your steering, gas, brake, drift, jump and boost inputs so the server can run the race, and the other racers see your kart move. If the connection cannot be made you can press Play solo instead, which races bots on your own device and sends none of this. Time Trial does not open the connection.

Go-Kart's recorded racing line

Go-Kart's fastest AI rival learns from the best driving anyone has actually recorded on a given circuit. This is not a typed name, and it doesn't live under "Typed nicknames" for that reason, but it is the one other place this game sends anything to our server mid-play without you pressing a button, so it gets the same direct treatment as everything above.

What's collected: while you play, the app watches your own kart's position and speed round the circuit — nothing else, and nothing about who you are. If you finish a lap that is both a clean recording (no stretch of the circuit was skipped, which can happen if a kart moves fast enough or cuts far enough off the road) and faster than your own best on that Track so far this session — whichever Difficulty you set it at, because your own kart is exactly the same at every one — that one lap's path and speed are sent to our server as one message: which Track, which Difficulty, how long the lap took, and the recorded line itself. (The Difficulty is sent and stored; it only affects which of those stored laps a later race reads back.) No device id, no name, and nothing else about you is attached to it at all — a deliberate choice, different from every other message on this page: what's stored is a record about a circuit, not about a player, so there's nothing to later delete by device the way a piano recording or a Gobbler death report can be.

When a race starts, the app also asks our server for that circuit's stored line. That request names only the Track and carries nothing about you.

Why it's sent automatically, unlike the piano recording or death report above: driving fast is the whole point of playing, not a separate action you opt into — asking for a button press on every personal-best lap would interrupt the race for a message about the race. The trade a fire-and-forget beacon makes: nothing here fails visibly and nothing here is confirmed either — if it doesn't arrive, the game does not tell you and nothing about your own play is affected.

Where it's used: the server keeps the single fastest verified lap ever submitted for each Track, across every player who has ever raced it — a row is still stored per Track and Difficulty, and the fastest one on the circuit is the one any race reads. Never a history, never anything from a slower attempt. Before a lap is kept at all, the server checks it against itself: the time claimed has to be one the lap's own recorded speeds could actually have produced. A lap that fails that check is simply not kept — nothing extra is collected to run the check, nothing is stored about the attempt, and the game tells you nothing either way, exactly as it already tells you nothing when a lap is kept. The next time anyone races that same circuit, at any Difficulty, the field's single fastest AI driver steers that recorded line instead of the game's usual generated one. It is never shown to any player directly — there is no leaderboard, no "current record" display, no name attached to it to show even if there were.

How long it's kept: indefinitely, unlike play records — there is no device id on the row for a "How long it is kept" retention sweep to key off, and nothing here identifies a person to protect by deleting it. A stored lap is only ever replaced, never simply aged out, and only when a genuinely faster one is submitted for that same pairing.

One copy is taken off the server for our own AI tuning. An operator may take a copy of one stored circuit record into this project's own (private, LAN-only) source repository, where it is used as a fixed reference lap for measuring how fast the game's AI drivers are — the comparison that decides whether a difficulty tier is actually hard. That copy carries the same nothing the stored row does: no device id, no name, nothing about a player — just which circuit, how long the lap took, and the path and speed round it, with the date recorded to the day and never to a clock time. It is never served to any player, never fetched while anyone is playing, and is not part of the game you download. Taking it is a deliberate, occasional human action, not something that happens automatically.

Whoever holds the staff dashboard password can review these records, and copy them between our own servers. There is a page inside the password-gated operator dashboard that lists what is stored: which circuit, which difficulty, how long the lap took, when it was recorded, and a sanity check on whether the lap looks physically real. The same page can save those records to a file and load such a file into another one of our own deployments. Nothing new is collected from any player to make this possible — it shows and moves exactly the rows already described above, and it is still true that the server keeps only the single fastest lap per pairing: never a history, never anything from a slower attempt. Loading a file can only ever replace a stored lap with a genuinely faster one; a slower one is refused, and nothing is kept about the attempt.

The saved file carries the same nothing the row does — no device id, no name, nothing about a player — and records the lap's date but never its clock time, so it cannot say when somebody was playing. The full timestamp stays on the server and is shown only on that operator page. The page is reachable only by someone who already holds the staff dashboard password on a device already authorised on our private network; it is not on the public site and no player can see it.

Go-Kart's "ghost" of your own best lap

A translucent kart that traces your own best recorded lap on a Track while you race, so you can see live where you're gaining or losing time against yourself. It reuses the same shape as the recorded racing line just above — your own path and speed round the circuit — but it is a completely separate, local-only feature, not a variant of it.

What's collected: nothing that ever leaves your device. Your own best lap on each Track is kept in this browser's own storage only, replaced whenever you set a genuinely faster one, same ratchet as above. There is no server-side counterpart to this feature at all — no request is ever sent for it, successful or not.

Where it's used: only in your own browser, to draw the ghost kart while you race that same Track again. It never reaches our server, so it can never be shown to, or affect, any other player.

How long it's kept: for as long as this browser's own storage holds it, and only ever replaced by a faster lap, never aged out — same as the server-side record above, just kept on your device instead of ours. It lives under its own storage key, separate from your profile, and "Erase everything" in the account menu removes it along with your progress (see The device id below); clearing this site's data from your browser does the same.

Piano's shared room: your nickname AND your avatar

Piano's "Play with others" room is another place your account-menu nickname leaves your device, and the first place anywhere on this site that your avatar does. Both are described here together because the room sends them together, in the same moment, for the same reason.

What's collected: the display name your profile currently has (auto-generated like SwiftQuokka42 unless you replaced it in the account menu) and your chosen avatar — which is not a picture or an upload, just which one of sixteen fixed animal emoji you picked. No new field is asked for when you create or join a room; the room simply uses what your profile already has.

Where it's shown: only to the other people in the SAME room at the same time (at most four others), for as long as that room exists — in the room's own participant list, and under any key you are holding down while you play, so everyone can see who is playing what. It is never shown anywhere else on the site.

How long it's kept: in the room itself, apart from the server log line and the rejected-name record described below. Both live only in that room's memory on our real-time server; when the room ends (everyone leaves) they are gone from there. Neither is kept in the database this site uses for stats (the one exception is a name our filter rejects, described below), neither is attached to your device's random id, neither is sent to the play-stats server described earlier on this page, and neither is carried into your next room. A player who leaves is dropped from the room's own records immediately, name, avatar and all.

The same server-log caveat as Gobbler's room name applies here (except that Piano's address carries no device id), and for the same reason: both are sent as part of the web address used to open the multiplayer connection, and our server software writes one log line recording that address for every connection it accepts. That line, including whatever your nickname is at the time (even one the filter below goes on to reject and never shows to anyone), is written to disk on our server. We have no automatic rotation or expiry configured for that log on this deployment, so it persists until we manually clear server logs. That line is not written to the database, does not carry your device's id or play history, and is never sent anywhere outside our own server. (A server in front of ours, where there is one, keeps an ordinary log of its own too, with the network address in it: see The web server's ordinary log.)

What the filter does and does not do: your nickname is re-checked against the same profanity/slur wordlist on our server before anyone else in the room sees it, regardless of the check your own device already did. A rejected name is not replaced with a substitute — the other players simply see "Player" instead. That filter catches swearing; it does not check whether what you typed is a real name, or anything else identifying — if you type your actual first and last name, the filter has no way to know that. A rejected name here IS recorded in the operator-visible blocked-text log described below, under its own "Piano room name" surface.

The avatar is not checked against anything, because there is nothing to check: it is one of sixteen fixed choices, so the only thing our server does with it is confirm it looks like one of our own ids before passing it on. It says nothing about you that you did not pick from that list.

Gobbler's live multiplayer room name

Gobbler's real-time multiplayer mode shows a name for you on the in-round leaderboard while you're playing. Unlike Go-Kart's standings, this name is room-scoped and does reach our servers, so it works differently enough to need its own walkthrough.

What's collected: Gobbler has no name field of its own. When you press Play, it uses your profile's display name as it stands at that moment: the auto-generated one (like SwiftQuokka42), or the nickname you typed in the account menu if you replaced it. Whichever it is, it is sent to our real-time server. If it is empty or the profanity filter rejects it, the room shows an auto-generated worm name for you instead.

Where it's shown: to the other players who happen to be in your live room at the same time, on that room's own leaderboard. The one other place is Gobbler's public daily and weekly top-10 lists, described further down, which show the name of a real player's best life. It is never part of the anonymous play record described earlier in this page.

How long it's kept: in the room itself, for as long as the room exists and no longer — it lives only in that room's memory on our real-time server, and when the room ends (everyone leaves) it's gone from there. It is never part of the play records described earlier, and the room does not remember it afterwards: the next time you press Play, the game reads your profile's current name again. The one exception is Gobbler's daily and weekly top-10 lists: when a real player dies, the name ("Anonymous" if it was empty or rejected by the filter) is stored there with the pellets eaten and your device's random installation id, for the short window described under those lists.

That said, there is one more place the name transiently passes through, and we want to describe it honestly rather than gloss over it: the name is sent to our server as part of the web address used to open the multiplayer connection, and our server software writes one log line recording that address for every connection it accepts — the same way it logs every other request. That log line, including whatever name your profile had (even one the filter below goes on to reject and never shows to anyone), is written to disk in our server's ordinary logs. Unless measurement is switched off for you (see Turning it off), the same web address also carries your device's random installation id, so in that log the name and the id sit side by side on one line. We do not currently have any automatic rotation or expiry configured for that log on this deployment, so — unlike the room itself, and unlike everything else described on this page — we can't give you a firm "gone after N days" answer for it; it persists until we manually clear server logs. The log line is not written to the database and is never sent anywhere outside our own server. (A server in front of ours, where there is one, keeps an ordinary log of its own too, with the network address in it: see The web server's ordinary log.) If this matters to you, the safest option is to keep the auto-generated name your profile starts with: it is logged the same way, but on its own it says nothing about you. A browser that sends Global Privacy Control also leaves the installation id out of that address.

What the filter does and does not do — read this part plainly: every name is checked against a profanity/slur wordlist before anyone else sees it, and a flagged name is silently replaced with an auto-generated one instead. That filter catches swearing. It does not check whether what you typed is a real name, or anything else identifying — if a player types their actual first and last name as their nickname, the filter has no way to know that and will let it through unless it happens to also contain a filtered word. We are telling you this directly rather than implying the filter makes typing a name generally safe: it doesn't, and the safest option is still to keep the auto-generated name. A rejected name here IS recorded in the operator-visible blocked-text log described below — see "The operator-visible blocked-text log" for its scope and retention.

Stack Duel's online rooms: your display name reaches a stranger before they join

Stack's Duel mode can be played over the network, against somebody on another device. When you open a room you choose whether it is public or private, and the difference between those two is entirely a privacy difference, so it is worth being plain about it.

What's collected: nothing you type about yourself. There is no name field here at all — the name published for you is your profile's display name: the auto-generated one your device already made (JollyPossum26 and the like) unless you replaced it with a nickname in the account menu, and it is checked by the same profanity filter before anyone sees it. The one thing you do type is a 6-character room code, which is about a room, not about you: nothing is saved from it, nothing is shown back to anyone, and it carries no identity.

Where it's shown, and this is the part that is genuinely new:

• A private room is reachable only by its code, or by the /play/stack/room/<CODE> link built from it. Your display name is shown to the one person you handed that code to, once they are in the room with you. That is the same exposure the piano's shared rooms already have.
• A public room is listed on a browsable page. Anybody who opens Duel's Play Online pane — a complete stranger, who has not joined you and may never join you — sees a row carrying your display name, how long you have been waiting and the room's join code, and nothing else about you. Not your score, not your device id, not your history, not where you are. But the name is genuinely visible to people you have not chosen, which is more than a private room does, and it is why this section exists rather than being folded quietly into one above.

If you would rather not publish even that, open a private room instead and share the link. Nothing is lost by doing so: the game is identical either way.

While a match is running, each side's board — the blocks placed, the shape falling, the score and the rows cleared — is relayed through our real-time server to the other player so you can watch each other play. It is passed straight through and is never stored: our server keeps only the single most recent board per player, in memory, so that somebody who has just joined or just reconnected doesn't stare at a blank square, and it is discarded with the room. None of it is written to the database, attached to your device id, or joined to your play history. There is no chat and no way to send the other player anything but your board.

How long it's kept: a room exists only in our real-time server's memory and is gone when the match ends or the last player leaves. The one exception is a rematch: if both players press Rematch, the same two players, with the same display names (generated, or the nickname you typed), are moved into a brand-new private room (with a new code) and the old room is discarded. Nothing new is collected or stored for that, and it still lives only in the server's memory. Your display name, your board, and the room's code all go with the room. Nothing about an online duel's players, boards or results is ever written to the database this site uses for stats — a duel still records no score anywhere, exactly as the two-players-one- keyboard version always has.

Unlike Gobbler's and Piano's room names above, nothing here passes through the web address used to open the connection, so there is no server log line carrying your name. It is sent as an ordinary message once the connection is already open.

Online Chess: the name your opponent sees

Chess can be played over the network against another person: open the 2-Players tab and choose Online. As with Stack's Duel, you choose whether the game you open is public or private, and that choice decides which name the other person sees.

What's collected: there is no name field in Chess itself. What name goes with you depends on the kind of game:

• In a private game the name published for you is your profile's display name: the auto-generated one your device already made (JollyPossum26 and the like), or, if you replaced it in the account menu, the nickname you typed there. It goes through the same profanity filter first, and a name with hidden or control characters in it is dropped rather than shown.
• In a public game no name of yours is used at all. Our server gives both players a random name (SwiftQuokka42-style). Whatever name your device offers is thrown away the moment it arrives, without being kept, shown or logged. (When you open a public game your device sends no name; when you join a game by code it cannot know whether the game is public, so it sends your name and our server discards it for a public one.)

The one thing you type while playing is a 6-letter room code, which is about a game, not about you: nothing is saved from it, nothing is shown back to anyone, and it carries no identity. You also choose a time limit and which colour you would like, and those are shown to whoever you play. The screen where you choose says which games use a random name before you open one.

Where it's shown:

• A private game is reachable only by its code, or by the /play/chess/room/<CODE> link built from it. Your profile name is shown to the one person you handed that code to, once they have joined you.
• A public game is listed on a browsable page. Anybody who opens Chess's Online tab, a complete stranger who has not joined you and may never join you, sees a row carrying a random name picked by our server (not yours), the time limit, which colour you asked for and how long you have been waiting, and nothing else about you. Not your name, not your score, not your device id, not your history, not where you are. The list shows at most the 50 newest waiting games. The person who joins sees a random name for you, and you see a different random name for them. A waiting game that nobody joins closes by itself after ten minutes.
• We can switch public games off, for example while we are checking they behave well. While they are off, the list is hidden, a game you open is private, and Chess offers private games and invite links only; the game itself is the same either way.

While a game is running, each move you make goes to our real-time server, which checks it, keeps the position and both clocks, and sends the result to both players. The game is held on our server — and only there — for as long as it is being played, so that nothing on either screen can change the rules or the clock. It lives in the server's memory only. Nothing about the game itself is ever written to the database this site uses for statistics: no game is stored, no move list is kept, no opponent and no result is recorded, no rating exists and no leaderboard shows it. The only record is the one every game makes — that this device played a round of Chess, and for how long (see When you finish a round above). There is no chat, and no way to send the other player anything but your moves and the offers the buttons make (a draw offer, a resignation, a rematch). While the evaluation bar is on, your device also asks our server how the current position looks, with the position and nothing else (it is not sent to the other player, and not stored): see Chess: the evaluation bar below.

If you lose your connection — a closed tab, a phone that went to sleep — your opponent sees a countdown, and you have 30 seconds to come back and carry on from the same position. So that a page reload can do that, your browser keeps a small secret for your seat in session storage, the kind that is discarded when you close the tab; it is kept for at most five minutes and is removed as soon as you leave the game. It is never sent anywhere except back to our server to prove the seat is yours. If you do not come back, the game ends and your opponent is told so.

How long it's kept: a game exists only in our real-time server's memory and is gone when the game ends and the players leave, or when the server restarts. The one exception is a rematch: if both players press Rematch, the same two players, with the same names they had in the game before, are moved into a brand-new private game (with a new code, and the colours swapped) and the old one is discarded. Nothing new is collected or stored for that. Unlike a game against the bot (see Chess: a server-held game in progress below), an online game with a person leaves no game row behind at all.

A network address, kept only to stop abuse. To stop one device from filling our servers with games, our real-time server remembers the network address of a device that has opened a game, in its memory only, for as long as that game's room exists. A game's room is closed by the server within a few minutes of a game ending, or within half an hour if a game is left untouched, and the address is forgotten with it. Failed attempts to join a game by code are counted by network address for about a minute, also in memory only. These addresses are never written to a database or to the real-time server's own log, are never shown to anyone, and are gone when the server restarts. While a game's room exists, the address sits in the server's memory in the same record as that game's player names (a random name in a public game; in a private game, the name your profile shows, which may be a nickname you typed), and nothing links it to anything beyond that.

What we cannot promise. Games are casual and nothing is rated. We cannot tell if someone is getting help from a chess engine on their own device, and the game's own evaluation bar is a form of that help, which we offer to both players by default and either of them can switch off for themselves. There is no in-game way to report or block another player yet: if someone behaves badly, use the Feedback button, or simply leave and open a private game with people you choose.

Gobbler's death reports — captured automatically, "Report issue" adds your own note

Something does happen automatically here, and we want that stated plainly rather than implied: a Gobbler death is captured and sent to our server whether or not you ever click "Report issue." We designed it that way so the useful data is never something a button that fails to send can lose.

What's captured automatically, for every real death in a Gobbler room — whether or not you ever look at the death screen: the cause of the death (hit a rival, or left the arena), the id of whoever killed the player (if there was one), and a short replay of the room in the roughly ten seconds before the death — the position of every worm's body that was visible to the server at the time, sampled about eight times per second. Our real-time server captures this continuously for every room, and it is automatically sent to, and stored on, our main server the instant a real death is detected — it does not wait for, or depend on, a button click. If measurement is turned off for you (see "Turning it off" below, for example because your browser sends Global Privacy Control), your device's random installation id is not attached to this automatic capture — the data is still stored (it's about the room, not tied to identifying you), just without anything linking it back to your device.

What "Report issue" does, if you click it: it's a small, near-instant action — it submits your own device's claim about the same death (what you saw, at the moment you saw it) alongside a small snapshot of what your screen was showing, and always carries your device's random installation id (the same one described in "The device id" below) regardless of the analytics setting, because clicking a button is a deliberate action, not passive measurement. The server compares this against the automatic capture above to help a developer tell "the game genuinely glitched" apart from "the player's own screen was lagging." The death screen also has a small, optional textarea where you can type what happened in your own words (up to 2000 characters) — leaving it blank changes nothing about how Report issue works. Whatever you type is stored alongside the same report for a human to read; we don't run any automated scan of it for content, the same as our general feedback form.

Why it exists: so a human can look at what actually happened when a death looked wrong on screen — a worm rendering client-side is an approximation, and comparing it against what the server's real positions were doing is the only way to check whether a death that looked unfair actually was a rendering gap rather than a real hit. Making the capture automatic, rather than click-gated, is what makes this actually useful for diagnosing a bug nobody happened to report at the time.

Where it's shown: nowhere on the site. There is no way to watch a replay of your own death. Reports go into our database for a developer to review later, and there is no public gallery or leaderboard of them, unlike the piano recordings above.

How long it's kept. The same 400-day window as play records (see "How long it is kept" below), counted from the moment of death, whether or not "Report issue" was ever clicked. And "Erase everything" rotates your device id rather than deleting rows already on file — the same honest limit the "The device id" section states.

Gobbler's daily leaderboard

Gobbler shows a small "Today's top pellets" list on its pre-Play start screen — the best score reached, by anyone, in a single life, since midnight UTC. This is separate from the in-round leaderboard described above (which only ever shows the players currently in your room) and from the death-reports capture above it — reading it does not identify anyone and it carries no unlock or reward of any kind.

What's recorded: the moment a real player (not a bot) dies in a Gobbler room, the pellets that life ate, a display name (your profile's name, filtered exactly as described in Gobbler's live multiplayer room name above, or the word "Anonymous" if it was empty or rejected by the filter), and your device's random installation id are sent to our server — but only if that death happened with a random installation id already attached to your session (the measurement setting described under "Turning it off" below governs whether one is). If it isn't a new personal best for that calendar day, the earlier, higher score already on file for your device that day is kept instead and this submission changes nothing.

Where it's shown: the public start-screen list shows only the top 10 names and scores for today — never an installation id, and never any other list a player could use to pick one specific person out of a crowd.

How long it's kept: unlike every other record on this page, this one is not kept for 400 days — a leaderboard row about "today" has no use once today is over, so rows are kept for a short trailing window (between two and four days, depending on the time of day) and then deleted automatically, not retained for a school-year-scale comparison the way play records are.

Erasing everything: the same as everywhere else on this page — see "Turning it off" below — erasing your device rotates your installation id rather than reaching back to delete a leaderboard row already on file, so your erased device's next play starts with no history a future score could be tied to.

Gobbler's weekly leaderboard

Beside the daily list, the start screen also shows "This week's top players": the same kind of list over a calendar week (Monday 00:00 UTC to the next Monday). It is fed by exactly the same server-side record of a real player's death as the daily list and stores exactly the same four things - the pellets that life ate, the display name (as described for the daily list, or "Anonymous"), your device's random installation id and a timestamp - and nothing more. Only the top 10 names and scores are shown, never an installation id. Rows are kept for between two weeks and three weeks and a day (a week's rows are deleted at the first daily clean-up after that week ended two weeks ago) and then deleted automatically. Erasing your device works as described for the daily list above.

The operator-visible blocked-text log

When a name typed into one of this app's server-checked free-text fields (the account-menu nickname when it reaches a Guess the Word room or a Piano shared room, Gobbler's multiplayer room name, the room name in Propwash (a game that is not on every version of the site), a piano recording's name at save or rename time, and a pixel-art drawing's title at submit or edit time) is rejected by the profanity filter described above, we keep a record of that rejection so we can review whether the filter is working correctly — catching real profanity, and not wrongly blocking an innocent word.

What's recorded: the rejected text itself, which one of those six surfaces it came from, the specific word/phrase the filter matched on, and the country your connection appeared to come from (looked up the same privacy-preserving way described earlier on this page — never your address), except for a name sent when joining a Gobbler, Propwash or Piano shared room, which is recorded with no country. When the text was sent while creating or joining a Guess the Word room, saving a piano recording (its name) or submitting a pixel-art drawing (its title), the random device id sent with that request is kept beside it; it is not shown in the dashboard. A rejected rename or edit, and a rejected name sent when joining a Gobbler, Propwash or Piano shared room, is recorded without a device id.

What's deliberately NOT recorded: the account-menu nickname field's own check — the one you see the moment you try to save a nickname — is never reported here. (That check does make one outbound request of its own — see Typed nicknames above for exactly what it sends and receives — but nothing you typed is ever part of that request, so this log still has nothing to record from it.) Only a name that actually reaches our server (by being used to create/join a Guess the Word room or a Piano shared room, a Gobbler/Propwash multiplayer name, a piano recording's name, or a pixel-art drawing's title) and is rejected THERE gets logged. If you never join a multiplayer room, save a named recording, or submit a drawing, nothing you type in the account menu is ever recorded, rejected or not.

Who can see it: a small number of people who help run this site, through a password-gated internal dashboard — the same "operators" who review the site-wide feedback form described earlier on this page. It is never shown to other players, and never published anywhere.

How long it's kept: 90 days, then deleted automatically — a shorter, dedicated window, not the general retention period the rest of this page describes for play records.

Staff-deleted feedback and recordings: a Bin, then a shorter retention window

When a member of staff deletes a submitted feedback message, or takes down a public piano recording, from the password-gated internal dashboard, that content is not immediately and permanently gone. It moves to an internal "Bin" first, visible only to staff, for up to 90 days after the deletion — the same round-day approximation of "3 months" this page's blocked-text log above uses. A member of staff can permanently remove it sooner; otherwise it is deleted automatically once the 90 days pass. Either way, it disappears from wherever the public could see it (the feedback review list, the public gallery, and the recording's own by-link page, which 404s) the moment it is deleted — the Bin is purely an internal safety net against a misclick, not something that keeps the content visible or usable to anyone outside staff.

What's additionally recorded: every deletion, permanent removal, and automatic 90-day expiry is logged in an internal, staff-only activity log — which action happened, what kind of content it was, an internal id for it, and when. This log never stores the content itself (never the feedback message, never the recording) — only that an action happened and to what. Nothing in the staff dashboard can edit or delete an entry in this log; it exists as a record of what staff did, not as more content about you.

Who can see any of this: the same small number of people who already review feedback and blocked-text log entries elsewhere on this page, through the same password-gated internal dashboard. None of it is ever shown to other players or published anywhere.

Guess the Word's server-held rounds and vocabulary rating

The secret word for a round of Guess the Word is chosen and held on our server, not the device, so that a mischievous player cannot read the answer out of their browser's developer tools mid-round. Most other games on this site play entirely on-device with no runtime network traffic beyond the first-party play-stats messages described above. Guess the Word is one of the deliberate exceptions; the multiplayer games, Chess, Gobbler's lists and death reports, Go-Kart's recorded racing line and the Piano and Pixel Art galleries, all described elsewhere on this page, are the others. This section exists so this page is never behind what the server actually stores. That requires two small pieces of server-side state that nothing else on this page has an equivalent of:

• A round. Which word was picked, and the guesses made against it so far — plus whether you've already used that round's one-time "Need a hint?" action (just a yes/no flag, not what the hint said). It is linked to the same random device id described below and deleted automatically after the same 400 days as play records (see How long it is kept).
• A vocabulary rating. One number per device (starting at 1200, moving up or down slightly as rounds finish) plus a count of rounds played, used only to pick a next word that is roughly as hard as the last one was — not too easy, not too hard. It is not a score, not a name, and not a history of what you typed; just a single running number, the same "state, not a log" category Likes and favourites already describes for the heart/star. It resets to the same starting point as everything else on this page when "Erase everything" rotates your device id — see The device id below for why a rotated id, not a cleared one, is what "erase" means everywhere on this site.

Both pieces are stored keyed to your random device id and never to a name, an email or anything else that could identify you, and neither is ever shown to anyone but you (nobody else's rating or round is visible to you, and yours isn't visible to anyone else).

Daily Word, Weekly Word, and Monthly Word are three separate modes where everyone plays the same word for that day, week, or month. After you finish that period's word, we show you an aggregate: how many people have played it so far this period, what fraction solved it, and how your guess count compares — computed from everyone's results for that period, but no other individual round, rating, or device is ever shown to you, and yours isn't shown to anyone else. If you're the very first person to finish that period's word, we tell you — and only you — nobody else ever learns who was first. Before you even open one of these three, the Play mode menu can show you whether you've already played it this period and how it went ("not played yet", "in progress", "solved in 4", "out of guesses") — this is a read of the exact same round state described above, keyed to your own device id only, and checking it never starts or affects a round by itself. This is the one narrow, device-identifying exception to the "fully private" promise above: it applies only to these three shared modes, never to Free Practice, whose round and rating stay exactly as private as described above. Daily/Weekly/Monthly Word results are pruned on the same retention schedule as play records (see How long it is kept); the shared word itself (for that day, week, or month) is not, since it carries no device id and is one small row per period.

Room mode is a second, narrower exception, scoped to the players actually in the same room. When you create or join a room, your display name (the same one already shown to you in-game — see Typed nicknames above for the games where you can change it) is shown to the other players in THAT room, and stays visible to them for as long as you're in it. While a round is live, the other players in the room see your live per-guess progress (whether you've solved it yet, and — once the round ends — your finish time or how close your best guess got) as part of the shared results screen; nobody outside that room, and no other Guess the Word mode, ever sees any of this. A room closes when the host deliberately leaves, or when nobody's left after a disconnected host's ~20-second grace period expires with no one to hand the room to, and nobody can join it again. On our server, though, a room leaves records behind: the room itself (its code, settings, the secret answer, and the random id of the device that currently hosts it, which changes if the host hands over) and every guess made in it (the guess, how it scored, when, and the random device id that made it) stay in our database, and the display names of any players still in the room when the host closed it stay with it. They are deleted automatically, together, once the room has been idle for 7 days (checked once a day); the 400-day deletion that covers play records does not apply to them. We do not use them for anything else. A room's live connection carries the room code and your device's random id in its web address, so those appear in the ordinary server logs described under The web server's ordinary log.

"Challenge a friend" is completely anonymous — the link carries a word, never a person. When you challenge a friend from a settled Free Practice round, we store the word (and how many letters/guesses it uses) on our server so the link can start anyone who opens it on that same word — but we do not store your device id, your rating, or anything else that could tell us (or anyone) who sent it. Nobody who opens the link, and no device that later checks a rating or a rating history, can ever learn it came from you. A round started from a challenge link is otherwise an ordinary Guess the Word round — the same server-side "the answer never leaves the server until you finish" protection as every other round — except it never moves your vocabulary rating (see A vocabulary rating above), since the word wasn't picked to match your own skill. A challenge link never expires and can be opened any number of times by any number of people.

"Invite a friend" hands over a room's own join code, and nothing else. The "Invite a friend" button in a room lobby builds a link out of the SAME 6-letter code already described above under Room mode — whoever created the room can already be found and joined by anyone holding that code, so the link changes how the code travels, not what it grants. The link itself carries only that code: no device id, no display name, and nothing that identifies who sent it is attached, stored, or ever shown to anyone. Opening it joins that room exactly the way typing the code in by hand already does, subject to the same limits described above (a room that has already started, is full, or has closed can't be joined by either route). We do not keep a record anywhere, client or server, of who minted a given invite link or who opened it.

The room code is stripped out before anything reaches Google Analytics. Because the code sits in the page's own URL, the Google Analytics section's "which pages you viewed" would otherwise mean "and the credential to join your room" for anyone who followed an invite link. It doesn't: the room-code segment (and, the same way, a challenge link's id) is replaced with a fixed placeholder before the page path is ever sent to Google, so what Google sees is "someone opened a room-invite page," never which room.

Chess: a server-held game in progress

Chess stores something on our server the way Guess the Word does, so this page covers it the same way: the position, the moves played so far, and how the game ended (if it has), are held on our server rather than your device — the bot you're playing has to live somewhere that can't be read out of your browser mid-game, the same reason Guess the Word's answer does.

That is one small server-side row per game, linked to the same random device id described below and never to a name, an email, or anything else that could identify you. Nothing about it is ever shown to anyone but you.

Opponent strength. Whatever settings were picked when a game was started (how hard the bot searches, roughly) are kept on that same row, for that game only — a setting, not anything about you, and gone the moment the game itself is pruned.

Resuming. So a page refresh or an accidentally-closed tab doesn't throw away a game 20 minutes in, the game's id (not the position — just the id) is also kept in your browser, the same way your chosen board "Look" already is. Coming back offers you "Continue previous game", which asks our server for the position back; it never trusts anything your browser remembers about how the game looked. That id is cleared the moment the game ends, or the moment you choose "Start a new one" instead — the old game is simply left to expire on its own (see How long it is kept below), the same as any other game row.

Resigning ends the game the same way a checkmate does — a status is recorded, nothing else — and clears the stored id the same way finishing does.

The bot's chat. Where the bot is set to chat while you play, the lines it says during a game are kept on that same row-per-game basis as the game itself, so a refresh brings the conversation back instead of making up new remarks. We choose each line ourselves, on our server, from a fixed set we wrote and checked in advance. It is never something you typed (there is no way to type to the bot), and it is not tied to a name, an email, or anything else that could identify you — only to the same random device id as the game. A line is chosen from what happened on the board (a capture, a check, an opening, how long you took, which side is ahead), and that information stays on our server; nothing is sent to any other service to write it. Chat is on by default and one click turns it off. When it is off, no lines are chosen or stored for that game at all — that includes the greeting and the goodbye. Chat lines are removed when the game they belong to is pruned. Elo Check and games against another person never have chat. Whether you have chat switched on, and which voice you picked for the next game, are remembered in your browser the same way your board look is; the list of voices on offer is fetched from our server when you open Chess and is the same for everyone — it carries nothing about you.

Online games against another person are different. They are not stored at all: see Online Chess: the name your opponent sees above.

Chess games against the bot are pruned on the same 400-day schedule as play records. An abandoned game that was never finished is pruned along with finished ones — a game nobody has touched in over a year isn't a game in progress any more, and a "Continue previous game" prompt for one that has since been pruned simply offers a fresh game instead.

Reviewing a finished game. Once a game ends, our server works out how each move compared to what a chess engine would have played, and stores that as a second small row — one per game, linked the same way the game itself is, never to a name, an email, or anything else that could identify you. This is what "Review this game" shows: a graph of how the game swung, and your three worst moves. It is generated after the game is over, never while it is still in progress — we don't hand you a move-by-move analysis of a live game, since that would be no different from telling you the answer while you're still playing. The two live hints are the advantage bar, which shows who is ahead (and which you can switch off: see Chess: the evaluation bar below), and, if the bot is chatting, an occasional playful remark when the balance of the game swings a lot; neither names a move or gives a number. This second row is pruned on the same schedule as the game itself, and disappears immediately if the game it belongs to is pruned or deleted first.

Elo Check. Elo Check games store a little extra: how each of your moves compared to the engine's own choices, the running rating estimate that comes out of that, how strong the opponent was set to, and how the game ended (a win, a loss, or a draw, from your side). All of it sits in the same one-row-per-game shape as everything else above, linked to the device id and never to a name or an email.

The finished Elo Check games on your device are read together, not one by one, so the estimate sharpens as you play more of them and the range it is shown with gets narrower. Nothing more about you is stored to make that work, but it is worth saying plainly that each game does not stand alone.

Two consequences worth knowing. It is per device, not per person: the same person on a phone and a laptop has two separate histories and two separate estimates, because there is no account and nothing links them. And pressing erase everything (see below) generates a fresh device id, which means the new id has no Elo Check history at all — a wipe resets this for free, by the same mechanism that resets everything else. The old rows are left to expire on the ordinary 400-day schedule, no longer connected to anything you do.

Chess: capture animations

When a piece captures, Chess plays a short animation over the board, different for each kind of piece. It is drawn entirely on your device and sends nothing to our server or anyone else. An Anim switch on the same row as the evaluation bar turns it off and on; it is on until you choose otherwise, and your choice is one short yes-or-no kept in your browser, in one setting for every mode, the way your board look is. "Erase everything" in the account menu removes it. If your device asks for reduced motion, the animations are not played at all, whatever the switch says.

Chess: the evaluation bar

Every Chess mode can show a bar above the board that shows who is ahead, as a White-and-Black split with names on the ends. It shows a percentage and nothing else: no score and no suggested move. It is on by default, an Eval switch on its row turns it off and on, and your choice is kept in your browser the same way your board look is (it is one setting for every mode). The bar is a help, not a secret: it answers for any position it is sent, so someone who asked about each possible next position could work out which move the engine likes best. We do not treat that as private.

What each mode sends for it:

• Against the bot, and Elo Check. Nothing extra. The number comes back with the moves you already send our server for the game.
• Looking back at a finished game (Review). Nothing extra. The bar uses the numbers the review already has.
• Two players on one device, an online game against another person, and the Daily and Puzzle Rush puzzles. There is no game on our server to ask, so while the bar is on, your device sends the position of the board you are looking at (where the pieces are, whose turn it is, and the board's castling and en passant details, which are part of what makes a position the same position) to our server and gets back one number. That is all it sends: not a name, not your device id, not a game or room code, not the moves played so far, and no cookies go with it. Our server works out the number, answers, and does not store the position or keep a record that you asked. To avoid working out the same position twice, it may keep recent answers in memory, tied to no one and forgotten when the server restarts. Like any request, it appears in the ordinary web server log described below as a time and an address and the fact that a request was made; the position itself is not part of that log. A request is made when the position changes while the bar is showing, and not at all for a puzzle tab you are not looking at.
• With the bar switched off, none of these requests is made. Two players and the puzzles then send nothing at all.

The device id

A random identifier is generated the first time the app runs and kept in the browser's local storage. It is not linked to a person, an email, or any other service, and it is not a tracking cookie: it is only ever sent to servers that run this site, never to Google or anyone else.

Because likes and favourites exist, that id sits beside an opinion and not only beside "a round happened". That is a different category of thing even when it is trivial, and it is the first thing a careful reader should notice. It is still not linked to a person, and the opinion is still only ever "somebody liked Minesweeper".

Erase everything. On the home page, open the menu at the top right (the one that shows your name) and choose Erase everything; you are asked to confirm first, and it cannot be undone. It removes everything this site stored on this device — your scores, your name and avatar, your likes and your favourites, games you had saved, and the settings and choices you saved in each game — apart from the display preferences below, and it throws the old device id away and generates a new random one in its place. It also switches Google Analytics off until you reload or reopen the site and expires its visitor cookies (see Google Analytics). It works on this device only. It cannot reach anything already held on our servers (see the honest limit below): the old id is not linked to a person, and nothing can match the rows it left behind to your new one. Piano recordings and drawings you already shared stay shared, and you can no longer delete them from this device afterwards, because the secret code that proved they were yours is among the things it removes. It does not remove what Google itself keeps in your browser: the advertising cookies and storage Google AdSense uses, and any Google Analytics storage other than the visitor-id cookies named above are yours to clear in your browser's settings.

Four display preferences stay on your device after erase everything: the light-or-dark choice, the language you chose, whether you switched on Quiet mode (no jokes) in the tools that have jokes, and whether you muted the site's sound (the speaker button, or the M key where a page has one). None of them is sent anywhere.

One honest limit: a like you already sent us stays in our database. We cannot delete it, because after the id is rotated we no longer have any way to tell which row was yours — it has become an anonymous number in a total. The alternative would be to send a message undoing every like at the moment you press erase, which puts a network call on the one path that must never fail; we would rather the erase always work than the count be exact.

The honest consequence: because it is per-device and resettable, our "players" number counts devices, not people. One person with a phone and a tablet counts twice; two people sharing a tablet count once. We label it as a device count wherever it is shown, and we do not quote it as a headcount.

How long it is kept

Play records are deleted automatically after 400 days — long enough to compare one school year with the last, and no longer.

Likes and favourites are not a history; they are how things stand right now, so they are kept until you change them. Once you have taken both back — unliked and unfavourited — the leftover row says nothing about anybody, and it is deleted on the same 400-day sweep.

The "still on this game" ping itself is not kept at all, on any schedule — it lives only in our server's working memory, for as long as your device keeps sending it, and it is gone the moment that stops. The start/end time of each unbroken streak of these pings (see While a game is on your screen) is kept under the same 400-day window as play records above, not the "not kept at all" rule this paragraph otherwise describes for the ping itself.

Gobbler's daily-leaderboard rows (and its weekly-leaderboard rows, kept between two weeks and three weeks and a day) are an exception to the 400-day window above: the daily rows are kept for a short trailing window of between two and four days, then deleted automatically — see Gobbler's daily leaderboard above for why a "today" row has nothing left to compare once today is over.

Guess the Word room records are an exception in the shorter direction: a room, its guesses and its players' display names (with their random device ids) are deleted from our database 7 days after the room was last active (it being created, a round starting or ending, a guess, or someone joining), checked once a day, so the 400-day window above does not apply to them. See Typed nicknames and Guess the Word's server-held rounds above for exactly what a room leaves behind until then.

Three other kinds of record are not on the 400-day window either. Pixel Art drawings are kept until you or an operator delete them. Go-Kart's recorded racing lines are kept until a faster lap replaces them. Likes on a gallery item are not deleted on any schedule (see When you like a gallery item). The blocked-text log and the staff Bin have a shorter window of their own, 90 days each.

Turning it off

• If the browser sends Global Privacy Control, the app sends none of the measurement. No setting to find, no box to tick; it is honoured automatically. There is no play record, no heart or star count, no Google Analytics, no Google ads script, and Gobbler leaves your device's id out of its connection and out of its automatic death report. The heart and the star still work: your like still shows on your device and your favourites still pin. They simply count for you and not in the public total. The "still on this game" ping stops too — your device is never counted toward the live "N playing" number — but the number itself still shows: reading it discloses nothing about your device, so it is not something GPC needs to switch off. Features that cannot work without a server (Guess the Word, Chess, the multiplayer rooms) and anything you press Send, Save or Submit on, or the heart on a gallery item, still send what they need, because you asked for them; this setting does not switch those off.
• Pressing erase everything (in the account menu on the home page) clears the saved progress, the likes, the favourites, the worm skin Gobbler remembers for you and everything else the site saved on your device, apart from the four display preferences listed under The device id, and replaces the device id with a new random one. (The worm skin never leaves your device in the first place — it is only what your own worm looks like on your own screen — but an erase that left it behind would not be an erase. Afterwards Gobbler picks you a fresh random worm, the same as it does the very first time you play.)
• The Share button works either way, and sharing sends us nothing by itself. The share marker only ever reaches us attached to a finished round — so if nothing is being sent, it is not being sent either.
• Everything that does not need a server works with the network switched off. Nothing is gated on the stats being sent, and if a statistics message fails to send it is simply dropped — you never see an error, a spinner, or a prompt.

Built for the strictest reader in the room

VerySeriousWork is built to a strict privacy standard for every visitor, not a looser one that happens to also work for some — a privacy policy is only worth anything if it holds for the most vulnerable person it covers. So the app gives everyone the same standard: no account to create, no real name asked for, and no score, name or typed text leaving your device except in the few features that need a server, each described above, plus the anonymous play record described at the top. Google Analytics and Google AdSense are the two exceptions to "nothing handed to a third party," described in full above rather than glossed over. There is no age gate here because the audience is general/mixed, not because nothing ever leaves this site anymore — if that ever changes, this section needs re-reading before anything else does.

Why this is worth stating

The cheapest way to build any of this is to bolt on an analytics product that collects everything by default and works out the questions later. We did the opposite: decided the three questions first, and then sent the smallest message that answers them. Every field we do not collect is a field that cannot leak, cannot be subpoenaed, and cannot be sold by a company we have no control over.

For what using the site means beyond data handling — ownership, acceptable use, warranty — see the terms and conditions.

Changes to this policy

The changes below affect what a visitor is told or what is sent. Each is dated from when it took effect.

• 2026-10-26: While you type a team's name in the Scoreboard's team editor, the name (and only the name) is now sent to our server, after a short pause, to ask for the team's usual colours. It is not saved, not written to any log and not linked to you or your device; a name that is not recognised, or being offline, changes nothing. Before this, a team name never left your device. The colours you choose for a name are remembered on your device (one more localStorage key, removed by "Erase everything"). See Scoreboard, "Looking up a team's colours".

• 2026-10-26: The Scoreboard can now remember the colour you choose for a team's numbers, under the team's name, on your device only (one more localStorage key, removed by "Erase everything"). Nothing is sent. See Scoreboard, "Number colours".

• 2026-10-26: Crosstiles can now be played online with up to three other people. The room code, your choice of public or private, the number of players and the turn length, and the tiles you place or swap go through our real-time server, which keeps the game in memory only and never sends the other players your tiles or the order of the bag. Every player gets a random name picked by our server and none of yours is used. A waiting public game appears, with its random name, in a list of at most 50 for anyone who opens the Online screen, and closes by itself after ten minutes if nobody joins. See Online Crosstiles: what the connection carries.

• 2026-10-26: Powder Run keeps your best score on each track on your device (one localStorage key; nothing is sent). See Powder Run above.

• 2026-10-25: The Eight keeps a list of what you have found on your device (one localStorage key; nothing is sent). See The Eight above.

• 2026-10-25: Emoji Mixer keeps a sticker book of the pairs you have mixed on your device (one localStorage key; nothing is sent). See Emoji Mixer above.

• 2026-10-25: Erase everything now also switches Google Analytics off until you reload or reopen the site, so it cannot write its visitor-id cookies again straight after they are expired, and this page says plainly that Google's own other cookies and storage are not removed by it. The confirmation also now tells you if anything could not be erased, and when it succeeds it says that your data was erased and that four display preferences were kept. See The device id and Google Analytics.

• 2026-10-24: The account menu on the home page now has an Erase everything button, which this page had described before it existed. After you confirm, it removes everything this site stored on your device (apart from four display preferences) and gives the device a new random id. It cannot reach what is already on our servers. See The device id.

• 2026-10-24: Chess now plays a short animation when a piece captures, with an Anim switch that turns it off and remembers your choice (one yes-or-no kept in your browser, removed by "Erase everything"). Nothing is sent anywhere for it. See Chess: capture animations.

• 2026-10-24: Chess now shows an evaluation bar (who is ahead, as a percentage) in every mode, with an Eval switch that turns it off and remembers your choice. Two players on one device, online games and the Daily and Puzzle Rush puzzles send the position of the board (and nothing else, no name, no id, no cookies) to our server to work out the bar, only while it is on; nothing is stored. See Chess: the evaluation bar.

• 2026-10-24: In a public Online Chess game your name is no longer shown to anyone: our server gives both players a random name, and the name your device offers is discarded. A private game still shows your profile name to the one person you gave the code to, and we have corrected an earlier line that said you could not type anything about yourself there (a nickname typed in the account menu can be shown in a private game). A waiting public game now closes by itself after ten minutes, the open-games list shows at most 50 games, and public games can be switched off. See Online Chess: the name your opponent sees.

• 2026-10-24: Online Chess now says that, to stop abuse, our real-time server remembers the network address of a device that has a game open, in memory only, until that game's room is closed, and that the server closes a finished or abandoned game's room on its own within a few minutes. See Online Chess: the name your opponent sees.

• 2026-10-23: Google Analytics now also hears when you have played a game for a few seconds and when you finish it: which game it was and, for a finished game, a rough length bucket. It also sees campaign tags on a link you arrived by, and the site that sent you. No score, difficulty, name or room code goes with any of it. See Google Analytics above.

• 2026-10-23: The bot in a Chess game against the computer can chat while you play. The lines it says are chosen on our server from a fixed set, kept with the game and pruned with it, never tied to a name or email, and not created at all when chat is off. We also reworded what we say about live game analysis to mention the occasional remark when the game swings. See Chess: a server-held game in progress.

• 2026-10-23: Chess can now be played online against another person. Your display name, the time limit and the colour you ask for are shown to the other player and, in a public game, to anyone browsing the list of open games; the moves go through our real-time server and nothing about the game is stored. See Online Chess: the name your opponent sees.

• 2026-10-22: Corrected two statements. Our stats server keeps a request log of its own, with no network address in it, that can hold your device's random id for Guess the Word's period check and room connections. And the heart on a gallery item is not switched off by Global Privacy Control. See The web server's ordinary log and Turning it off.

• 2026-10-22: Guess the Word room records (the room, its guesses and its players' display names, with their random device ids) are now deleted automatically 7 days after the room was last active, instead of being kept without a schedule. See Typed nicknames and How long it is kept.

• 2026-10-22: Corrected the earlier statement that names are never sent to our servers: your name, generated or typed, is sent by Guess the Word rooms, Piano's shared room, Stack's online Duel rooms and Gobbler's room, though it is never part of the anonymous play record. Also corrected: there are seven ordinary messages, not five, plus the features that need a server; the play record also carries a round id and how long ago the round ended; Gobbler's connection log line can hold your device's id beside your name; our web server keeps an ordinary log with network addresses in it; Gobbler's daily and weekly top-10 rows are kept between two and four days and between two weeks and three weeks and a day; Pixel Art drawings and gallery likes are not deleted on a schedule; and Global Privacy Control switches off the measurement, not the features that need a server. See Typed nicknames, The web server's ordinary log and How long it is kept.

• 2026-10-21: The Feedback button and form are now on the Privacy, Terms and How it works pages, and the Contact page shows the form itself, so those pages now run two small scripts of our own (one matches the page to your light-or-dark choice, one provides the form). They still record nothing and send nothing until you press Send. See When you submit feedback and What is not recorded above.

• 2026-08-29: Google Analytics and Google AdSense were added to the site. See Google Analytics and Google AdSense above.

• 2026-08-20: Gobbler deaths are captured and sent to our server automatically, not only when you press "Report issue". See Gobbler's death reports above.

• 2026-09-03: Chess Elo Check games record how each game ended and are read together to sharpen your estimate. See Chess above.

• 2026-09-10: This page now says plainly that your typed account-menu nickname is sent to our server when you create or join a Guess the Word room, and that every typed name goes through the same profanity filter.

• 2026-09-12: A piano recording needs a name before it can be saved. See When you save a piano recording above.

• 2026-09-13: The nickname check now makes one request for the current list of staff-added filter words. It sends nothing you typed. See Typed nicknames above.

• 2026-09-20: Piano's shared room shows your nickname and your chosen avatar to the other people in the room. See Piano's shared room above.