Privacy.
The short version: no accounts, no tracking beyond basic analytics, and we delete the sensitive stuff quickly.
What we collect
When you create or edit a card, we store:
- The display name, URL slug, free-square label, and phrase list you entered. These are public on your card’s page.
- A creation timestamp and last-update timestamp.
- A one-time server-generated edit token, which we return to you once in the URL. We do not email it, recover it, or share it.
- Network metadata associated with the creation request: IP address, approximate city/region/country (from your IP), autonomous system (network operator), and your browser’s User-Agent string. We use this only to investigate and respond to abuse.
When you play a card (tap squares), all marks live only in your own device’s localStorage. We never receive or store them.
We use Google Analytics for aggregate traffic stats. Google may set cookies; see Google’s own privacy documentation for detail.
How long we keep it
- Card content: until the card’s owner requests deletion, or we delete for abuse.
- IP address & User-Agent: automatically scrubbed once a card is 30 days old. Coarse country/city/network remains for longer-term abuse correlation.
- Analytics: per Google’s defaults (currently 14 months for event data).
Who sees it
- The card content (display name, slug, phrases, free-square label) is public to anyone with the share URL.
- The edit token is visible only to whoever holds the edit URL.
- Network metadata is visible only to the site administrator, and only through an authenticated admin panel behind Cloudflare Access.
Third parties in the request path
- Cloudflare hosts the site, handles DNS, TLS, and provides the Access authentication layer. Cloudflare sees every request, per its own privacy policy.
- Google Fonts serves the web fonts. Google sees font fetch requests (IP + referer).
- Google Analytics receives page-view beacons as described above.
Your choices
- Delete a card: email the site owner with the share URL and proof of ownership (e.g. the edit URL). We’ll remove it.
- Don’t want analytics: use a content blocker or browser feature that blocks
googletagmanager.com. - Want a copy of what’s stored about your card: email us with the share URL.
Contact
Reach the site owner via the contact address listed on the homepage or at [email protected].
Changes
If this policy changes materially, we’ll update the date below and note the change on the homepage.
Last updated: .