Privacy
Puzzle Lab is a personal playtest of two prototype games run by Bill Burkey (bill.burkey@ememetics.com), who is the data controller for it. No accounts, no ads, no tracking across other sites.
Play stats: only with your consent
After you finish your first level, the game asks whether it may send that level's play and record play stats from then on. Until you tap "Yes", nothing is written to your device or sent anywhere, and no device details are read (apart from the storage listed under "Storage that needs no consent", and the identifier-free daily counts described under "Playing with someone"): the moves from that first level are held only in the page's memory, and are sent if you say yes or thrown away if you say no (or close the page). Tapping "No thanks" leaves the whole game playable; only your level progress and your choice are saved on your device. The card appears on level-completion screens until you answer; you can change your answer any time from the game's home screen ("Play stats").
If you say yes, we rely on your consent to store a random device id in your browser and to process the play statistics described here. You can withdraw it at any time; that doesn't affect processing that already happened lawfully.
What is recorded after you say yes
- A random device id (a UUID stored in your browser) and a random id per visit.
- Gameplay events: level started, each move or placement, undo, restart, hint, completion (moves, time, hints), leaving a level, share taps; each with a timestamp and the game's build number.
- Once per visit: your browser and operating system family (e.g. "Chrome on Android"), language, window size, the site you came from (domain only, e.g. facebook.com), and the recruitment tag in the link you used (e.g. "friends").
- With each event, the approximate location Cloudflare derives from your connection: country, region, city and timezone. This is IP-based, city-level at best, and never uses your phone's GPS. We use it to see where players are and to count "days" in your local time.
- For each tap or swipe: the cell or direction, the board state, and timing, so we can replay a session and see where people get stuck.
Our event records do not include your name, email, IP address or precise location. Our host, Cloudflare, processes your IP address to deliver the site and to rate-limit abuse, as any web host does; we don't store it with your events. A copy of your last 3,000 events is also kept in your browser (deleted when you turn play stats off or clear site data).
Purpose: to see where players get stuck and whether the puzzles are fun, so we can improve the prototypes. Retention: events are deleted from our server automatically after 90 days. Storage: Cloudflare's network (Cloudflare D1), which may hold data outside the EU/UK under Cloudflare's standard contractual safeguards. Data is not shared with or sold to anyone.
Feedback you send
The "Stuck or something off?" form sends the two answers you type, the level you were on, and, only if play stats are on, your device id. We keep feedback for one year so we can act on it. Please don't put personal details in it.
Playing with someone
You can invite people to compare your daily puzzle results. This is a separate choice from play stats, and it's never required for play stats.
If you create or join a circle, here is what we keep for it:
- Your first name.
- A random id for your device, used only inside your circle.
- Whether you finished each day's puzzles (and, in Daily Orbit, whether you revealed the answer).
- Your scores, moves or hints for the day, only if you turn on "share my results".
- Your "share my results" choice.
- A random payment reference, used only if someone in the circle supports the games.
Only the people in the circle can see your results. Anyone with the circle's link can see the members' first names before joining.
Leaving or removing a member deletes their data from the circle right away. We keep circle results for 90 days. A circle is deleted automatically after 180 days with no activity.
If someone in your circle supports the games through our Stripe payment link, Stripe is sent only the random payment reference tied to that circle membership. Stripe never gets a name, a member id or any play stats. Stripe handles your card and email under its own privacy policy.
Opening an invite link, creating or joining a circle, and tapping "support the games" each add to a daily count of how often those actions happen. These counts carry no name or id and can't be traced back to you.
(Technical names: pl.circle.*, pl.ui.large, pl.support.)
Storage that needs no consent
Your level progress and stars are saved in your browser so you can pick up where you left off, which is strictly necessary for the game you asked to play. Your consent choice is saved so we don't ask again. If you play with someone, your circle membership, the "larger text" accessibility toggle, and whether you've supported the games are saved the same way. None of this is sent anywhere except as described above.
Your rights
You can withdraw consent from the game's home screen. That immediately deletes the device id and event copy from your browser. Your previous device id is shown next to the switch so you can still ask us to delete the server-side events: email the address above with that id and we'll delete them (they expire after 90 days regardless). You also have the right to ask what we hold about your id, to have it corrected, restricted or sent to you in a portable form, and (EU/UK residents) to complain to your data protection authority.
No third-party trackers
No third-party fonts, analytics or advertising trackers. Fonts are hosted on this site, so the only network requests go to this site's own address. Cloudflare provides hosting and abuse protection.