What we collect
When you play, we store a random Supabase player identifier, dated game progress, results, streak records, daily-edition choices, timestamps, and your selected time zone. If you protect your player, we also store the email address used for passwordless sign-in.
Our hosting, database, and security providers may process ordinary request and security data such as IP address, browser or device details, timestamps, requested pages, and abuse signals. Cloudflare Turnstile processes security-check data when a check is needed.
Device storage and cookies
Essential cookies keep your Supabase session in this browser. Local storage and IndexedDB keep responsive or offline game copies, settings, daily-reset choices, and short-lived account-recovery state. Wit Orchard does not use advertising cookies. On production pages, Vercel Web Analytics measures page visits and limited actions such as completing a puzzle or clicking Share. It does not use analytics cookies; its temporary visitor identifier resets after 24 hours. We exclude account and authentication pages, strip arbitrary URL queries, and do not send emails, player IDs, answers, or move histories as custom event properties.
Lantern Leeway is a device-only collection. Its unfinished harbor, completed results, personal bests, and settings stay in this browser’s player-scoped IndexedDB, even when you sign in with an email. They do not synchronize across devices. A public offline cache stores game code and puzzles, never your player data.
Why we use it
We use this data to open the right daily puzzle, save and restore progress, calculate history and streaks, synchronize protected players across devices, prevent abuse, diagnose failures, and keep the service secure. We do not sell personal information or use it for targeted advertising.
Who processes it
Supabase provides authentication and the game database; Vercel hosts the web application and provides Web Analytics; Cloudflare Turnstile helps stop automated abuse. Resend handles authentication email delivery, processing the recipient email address, message content, and delivery records. Cloudflare Email Routing forwards messages sent to our privacy contact. Each provider may process data under its own terms and privacy policy.
How long we keep it
Active player identities and their saved progress remain until you delete them. Browser copies remain until this device clears them during deletion or until its site data is cleared. Copies on another device may remain isolated there, but a deleted player can no longer restore or synchronize them. Signing out separates browser copies from the next player but does not itself erase them. Another open tab or a browser restriction can delay deletion of an offline copy. Short-lived server transfer records expire automatically. On this device, a minimal retired-guest marker and transfer receipt prevent an old tab or retry from restoring obsolete game progress. These contain no harbor positions or results and remain until their player’s device data is deleted or site data is cleared. Residual copies may remain temporarily in rotating provider backups or security logs under those providers’ retention and disaster-recovery processes.
Your choices
You may play without adding an email. You can sign out locally or permanently delete the current guest or protected player from the account controls. Deletion removes the live authentication identity and its saved progress; it cannot be undone. Residual encrypted backups and security logs age out under provider schedules.
Children
Wit Orchard is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child supplied an email, contact us so it can be removed.
Security, transfers, and changes
We use access controls, encrypted connections, row-level database security, and short-lived credentials, but no online service can promise absolute security. Providers may process data in countries other than yours. Material policy changes will appear here with a new effective date.
Contact
The fastest privacy request is the self-service account deletion above. For another privacy question, email privacy@witorchard.games.