Privacy, in plain paper.

Your anonymous game identity

When you open a puzzle, we create a random private browser credential in an essential first-party cookie. It lasts up to one year. The cookie is HttpOnly, Secure, and SameSite=Lax. Our database stores a cryptographic hash of the credential, a generated public alias, and creation and activity timestamps.

The cookie lets us associate your browser with saved folds and records. It is not an account, an email address, or a claim about who you are. We do not currently offer login, cross-device synchronization, or identity recovery.

Saved play and public rankings

We store game modes, difficulty, challenge identifiers and versions, fold moves, hint use, session state, points, stars, and timestamps. These records let us restore your paper, check scores, and prevent duplicate awards.

Public leaderboards display generated aliases, points, solved-puzzle counts, and ordering. They do not display private cookie credentials or your IP address. Practice records remain outside public rankings. Share buttons copy a result only when you choose to use them.

Limited first-party measurement

We collect events such as a game view, start click, fold action, puzzle solved, hint, undo, next puzzle, ranking view, copy-result action, and page leave. Context is limited to game mode, difficulty, content version, broad device class, and broad referral category such as search, social, or direct.

An opaque derived visitor key may connect gameplay events to one anonymous browser. Event payloads do not include raw cookie credentials, full page or referrer URLs, typed answers, names, email addresses, exact location, or a persistent device fingerprint. A page-leave event means the page was left; it does not establish that someone intentionally quit.

For short-lived abuse limits, the server derives a rate-limit key from the request IP. The application does not store the raw IP in gameplay tables, and these rate-limit records expire within minutes. Cloudflare may process network and request information as our hosting provider under its own policies.

Hosting, storage and external resources

The site runs on Cloudflare Workers. D1 stores game data and events. R2 stores original public puzzle graphics, build caches, and aggregate operational reports. Private browser credentials are not placed in public image URLs or puzzle graphics.

The interface may request fonts from Google Fonts. Your browser sends the ordinary network information needed to retrieve those files. We do not currently load advertising networks or third-party analytics tags. If our use of these services changes, we will update this policy.

Retention and controls

Detailed gameplay events are scheduled for deletion after 90 days. Short-lived rate-limit records are cleaned daily. Saved progress, results, and anonymous identity records may remain while needed to provide game history and rankings. Aggregate counts without browser identifiers may be retained longer.

You can remove this site’s cookie through your browser settings to stop that browser from accessing its previous identity. Clearing the cookie does not itself erase historical database records or leaderboard aliases. For an access or deletion request, contact us before clearing the cookie so we can discuss how to verify the relevant browser record.

Contact and updates

Email support@creasegame.net or use the private Contact form for privacy questions or requests. Email is routed through Cloudflare to our support inbox. Form notes are stored privately for up to 90 days and may include the current anonymous browser identity. Avoid including private cookies, passwords, or sensitive personal details. We will update the date on this page when the policy materially changes.