Privacy Policy

• You can play every game without an account. Your stats and streaks stay in your own browser.
• Finishing a daily puzzle can post your result to a public leaderboard under a display name. Guests get a random name like “user4821”.
• Accounts are optional and handled by a third-party sign-in provider.
• The site is free because it shows ads from Google. Google’s ad code uses cookies and may personalize the ads you see. Where the law requires it, you’re asked for consent first, and you can turn personalization off (see “Ads” below). Premium members aren’t shown ads at all.
• The site counts visits with its own cookie-free analytics (see “Analytics” below); nothing is sent to an outside analytics company.

The site saves the following in your browser’s local storage. It stays on your device unless a feature below sends it to the server:

• Your stats for each game: games played, wins, streaks, your last result, and share text.
• Progress on a daily puzzle you haven’t finished, so a refresh doesn’t reset it.
• Which archive puzzles you’ve finished in each game (the puzzle number and a short result like “125/150”), so the archive can show what you’ve played and your best score. As a guest this never leaves your browser; if you’re signed in it’s also saved to your account (see “Accounts” below).
• Which weekly events you’ve played and your short result, so an event shows its results instead of a second go.
• A random guest ID and a random guest name (like “user4821”), used to attribute your leaderboard results if you’re not signed in.
• If you sign in, a note of which account this browser last synced with, so one person’s progress isn’t mixed into another’s on a shared computer.

You can clear all of this at any time from your browser’s site-data settings. Doing so resets your local streaks and gives you a new random guest identity.

When you finish a daily puzzle, your result may be sent to the server automatically and shown on the leaderboard (you don’t need to click anything). For each game we keep one row per player: your personal best. Each row contains:

• the game, your score, the human-readable result (like “142/150”), and the puzzle day;
• your display name;
• a random guest ID, or your account ID if you’re signed in (never shown publicly).

To check that a result is genuine, your browser sends the moves you made (for example, which sport you put each country in) along with the result. The server replays them and stores only the resulting score, not the moves. Guests can’t choose a name, and an account name that looks inappropriate is replaced with “Player”.

Publicly visible: your display name, your result, the puzzle day, and whether you played as a guest. Guests appear under their random name. If you’re signed in, your display name is your account username, or your first name if you haven’t set a username. If you don’t want your first name on the leaderboard, set a username on your Account page first. Changing it also renames the results you’ve already posted.

Creating an account is optional. Sign-in is provided by Clerk, which collects the details you give it (such as an email address or the profile information from a social login you choose) and uses cookies to keep you signed in. I never see or store your password.

If you sign in, the site’s database keeps, keyed to your account ID, so it follows you between devices: your per-game stats and streaks, which daily and archive puzzles you’ve finished (puzzle number and short result), and your leaderboard rows (above). It also keeps a copy of your email address from Clerk. That copy exists only so your data can be matched to you if I ever change sign-in providers (a new provider would give your account a new ID). It is never shown publicly and never used for marketing or shared with anyone.

If you buy Premium, the payment is taken by Stripe. Your card details go to Stripe and never reach this site. Stripe is given your account ID and email address so the subscription can be matched to you, and the site’s database keeps Stripe’s customer and subscription IDs and whether your plan is active.

These need an account with a username. Friends: the site stores who asked whom and whether it was accepted, and the challenges you send (who, which game and which day). A friend sees your username and your leaderboard results; nobody sees your email. Groups: the site stores each group’s name, its owner, its invite code and who’s in it. Members see each other’s usernames and results. Anyone with the invite link can see the group’s name and size, and join. Comments: a comment is stored with your account ID and username and shown publicly under that puzzle with your username. You can delete your own comments at any time. If you report one, the site stores that you reported it, so each player counts once; a comment enough players report is hidden and reviewed.

• Hosting. The site is hosted on Vercel, which, like most hosts, automatically logs requests (IP address, browser type, and the page requested) to run and secure the service.
• Database. Leaderboard rows, account data (stats, finished puzzles, email, friends, groups and comments), stat reports and contact messages are stored in a managed Postgres database from Neon.
• Player photos. Player photos load directly from Wikimedia’s image servers (they’re freely licensed files from Wikimedia Commons, see the photo credits). When your browser fetches one, Wikimedia can see your IP address and browser details, just as it would if you visited Wikipedia; see the Wikimedia Foundation’s privacy policy. The site sends Wikimedia nothing about you itself. The site’s fonts are self-hosted and don’t contact Google when you visit.

When you press Share, the text includes a link to a page for that puzzle. The link carries your result in its address (for example the score and the colour grid) but not your name or any account information. Anyone who has the link can see that result.

If you use “Spot a wrong stat?” after a game, the site stores which game and puzzle it was, the item you picked (as the game showed it, e.g. a player’s name and number), and what you typed. It does not store your name, account, email or IP address with it, so please don’t put personal details in the note. Reports are read only by me, to fix the data, and are deleted once the stat has been checked. “Send feedback” under a game’s questions works the same way: only the game and what you typed are stored, and it’s deleted once read. So is a suggestion sent from the Suggest a puzzle page: the kind of idea, the sport if you picked one, and what you typed.

If you write in through the contact page, the site stores the topic, subject and message, the email address you give so I can reply, and, if you’re signed in, your account id, so a billing question or deletion request can be matched to your account. Messages are read only by me and are deleted once handled. If you email hello@boxscore.games instead, your message is kept in my email inbox.

To understand which games people play and whether the site works, it records a small, anonymous event when you load a page, finish a puzzle, press Share, or install the site to your home screen. Each event contains:

• the page (with any numbers, like a puzzle number, removed — for example “an archive puzzle in The Player Stack”), which game, sport and mode (daily, archive or unlimited) it was;
• for a finished puzzle, whether it was solved;
• whether you arrived from a shared link or from the home screen (the “ref” in the address), if you did;
• the time, and an anonymous daily visitor code (next paragraph).

The visitor code is a scrambled fingerprint of your IP address, browser, and today’s date, made with a secret key. It lets the site count how many different visitors there were on a given day, and it changes every day, so nobody can be followed from one day to the next. Your IP address and browser details are used only to make the code and are not stored. The analytics use no cookies and nothing in your browser’s storage, and they are kept on the site’s own database, not sent to any outside analytics company. Events are kept for up to about 13 months.

Do Not Track: the site honours the “Do Not Track” and “Global Privacy Control” browser signals. If either is on, no analytics event is recorded at all. Automated traffic (search-engine crawlers, link previews, monitoring tools) is also not counted.

Ads help pay for the site. They’re served by Google AdSense, which chooses where on a page they appear. The ad code loads on most pages, but not on account, Premium, sign-in-only or form pages.

Premium members see no ads. The ad code isn’t loaded at all once the site has confirmed you’re signed in with an active Premium plan, so Google sets no advertising cookies through this site.

When the ad code loads, your browser fetches it directly from Google. Google and its partners can then see your IP address, browser details and the page you’re on, and use cookies and similar identifiers to show ads, to limit how often you see the same one, to measure how they perform, and to detect fraud. That can include ads based on your earlier visits to this and other websites. The site never sends Google your name, email, account, stats, or anything you type into a game. Google’s own use of this information is governed by the Google Privacy Policy; see also how Google uses information from sites that use its services.

Your ad choices. Where the law requires it (for example in the UK, Switzerland and the European Economic Area), you’ll be asked for consent before personalized ads are shown, and you can change your choice later. In US states whose laws give you the right to opt out of the “sale” or “sharing” of personal information for ads, Google’s opt-out is offered on the site. You can also turn off personalized ads everywhere in Google’s My Ad Center, or opt out of many ad companies at aboutads.info.

To stop scripts from flooding the leaderboard, the site counts how many results each address submits per hour. It does this with a salted hash of your IP address rather than the address itself, and the counters are deleted after a day or so. A hash like this is pseudonymous, not fully anonymous.

The site’s own code sets no advertising or tracking cookies. Two outside services do set cookies:

• Google, on pages that load its ad code, uses advertising cookies as described in “Ads” above (not for Premium members, who are shown no ads).
• Clerk, if you sign in, uses cookies to keep you signed in (see “Accounts” above).

The site’s own analytics, described above, don’t use cookies or any browser storage at all. You can block or delete cookies in your browser’s settings; the games work without them, though you’ll be signed out.

I don’t sell or rent your information for money, and I don’t build advertising profiles myself. Your email address, account, stats and leaderboard data are never given to Google or any other ad company. Apart from Google’s ad code (above), the site doesn’t use third-party analytics or tracking scripts. If that changes, this page will be updated first.

California and other US state residents: letting Google’s ad code collect identifiers (like cookie IDs and IP address) and browsing activity on this site to show personalized ads can count as “selling” or “sharing” personal information for cross-context behavioral advertising under the CCPA and similar state laws. The categories involved are identifiers and internet activity, disclosed to Google and its ad partners, for advertising. You can opt out with Google’s opt-out on the site, or in the ways listed under “Ads” above. I don’t knowingly sell or share the personal information of anyone under 16.

Local data lives only in your browser (see above) and is kept until you clear it or your browser does. Leaderboard rows and synced account data (stats, finished puzzles, and your email address) are kept for as long as your account is active (friends, groups and comments too, until you remove them), plus a reasonable period after in case you come back or dispute something — and in any case only until you ask for them to be removed. Note that deleting your account with Clerk does not automatically remove any of that from the site’s database, so please send a deletion request if you want it deleted too. For a guest entry, tell me the display name and result shown and I’ll remove it. Analytics events are kept for up to about 13 months, as noted above, then deleted automatically. Stat reports are kept until the stat has been checked, and contact messages until they’ve been handled.

Depending on where you live, you may have rights under laws like the California Consumer Privacy Act (CCPA) or the EU/UK GDPR to know what personal information is held about you, access or receive a copy of it, correct it, delete it, and not be discriminated against for exercising these rights, and to opt out of the “sale” or “sharing” of personal information for personalized ads (see “Ads” above for how). Ask using the contact below and I’ll verify your request (typically by confirming it comes from the email or display name on the account) and respond within 30 days.

The site and its service providers (Vercel, Neon, Clerk, Stripe, and Google for ads) process and store data in the United States. If you’re accessing the site from elsewhere, your information will be transferred to and processed in the US, which may not have the same data protection laws as your home country.

Boxscore isn’t directed at children under 13, and I don’t knowingly collect personal information from them. If you believe a child has created an account or a leaderboard entry, contact me and I’ll remove it.

Data is transmitted over HTTPS and stored with reputable providers. No system is perfectly secure, so I can’t guarantee absolute security, but I keep what the site stores to a minimum on purpose. If a breach happens that affects your personal information, I’ll notify affected users and any authority required by law, without undue delay.

If I change this policy I’ll update the date at the top. Continuing to use the site after a change means you accept the updated policy.

Questions, or want something deleted? Use the contact page (for deletion, this one) or email hello@boxscore.games.