Privacy

Short version: no ads and no tracking unless you say yes. Google Analytics (which sets cookies) only loads if you click Allow on the cookie box. A few small things are stored so the leaderboards, the contact form and the visit counter can work, and this page says exactly which.

Last updated 1 October 2026 (added the visitor map and optional Google Analytics).

What is stored, and where

• On your device only: game progress, settings (theme, sound, language), your best scores and, if you post to a leaderboard, the nickname you used. This lives in your browser's local storage and never leaves it unless you post a score.
• Page views: each visit adds one to an anonymous counter for the page path and the day. To count a person once a day, a one-way hash of the IP address and browser, salted with a secret that changes daily, is kept until the end of that day and then deleted. The IP address itself is not stored. Your browser's Do Not Track and Global Privacy Control signals are respected: if either is on, nothing is counted.
• Visitor map: each counted visit also adds one to a per-country tally. The country comes from Cloudflare's lookup of your IP address, which is not stored. The latest 200 visits are kept as just country, the Cloudflare data centre that answered, the page path and the time, so the map can show new arrivals and the X-ray mode can show real requests. No cities, no IP addresses, no browser details. If Do Not Track or Global Privacy Control is on, nothing is recorded.
• Game events: a count per day of things like "Wordle game won" or "converter used", with no link to you.
• Leaderboards: if you post a score, the nickname you chose, your result (time and mistakes, or speed and accuracy) and the date are stored and shown publicly. The puzzle solution or keystroke timing you send is used to check the result and is not kept. I can remove any entry.
• Contact form: the message, and the name and reply address only if you typed them, are stored in a private database and I am notified. No IP address or browser details are saved with it. I delete messages when they are no longer needed, and sooner if you ask.
• Abuse protection: to stop spam, short-lived counters keyed by a salted hash of your IP address limit how often something can be submitted. They expire within a day.

Other companies

• The site is hosted and its backend runs on Cloudflare, which processes requests as any host does.
• Google Analytics (only with your consent): if you click Allow on the cookie box, Google Analytics 4 (measurement ID G-RL26RHTG50) counts visits and sets cookies named _ga. Google receives your page views, approximate location, device and browser, with your IP address anonymised. If you click No thanks, or your browser sends Do Not Track / Global Privacy Control, nothing is requested from Google and its cookies are removed. You can change your mind here: Cookie settings. Google's own policy applies to what it receives: policies.google.com/privacy.
• Fonts and all other scripts are served from this site. Nothing else is loaded from ad or analytics networks.
• The "last commit" line on the home page is fetched by the server from GitHub's public API. Your browser does not contact GitHub for it.
• If the contact form shows a Cloudflare Turnstile check, that check loads a script from Cloudflare.
• Links to GitHub, LinkedIn and bursiyer.net are ordinary links. Those sites have their own policies.
• The PDF and image converter runs entirely in your browser. Your files are not uploaded.

Your choices

• Turn on Do Not Track or Global Privacy Control, or block the /api/hit request, and visits are not counted.
• Clear the site's local storage in your browser to delete everything kept on your device.
• To remove a leaderboard entry or a contact message, write to me through LinkedIn and tell me the nickname or roughly when you wrote.