Privacy Policy

1. Scope

This policy describes the information collected by eatakeyboard ("we", "us") through the website at eatakeyboard.com, the purposes for which that information is used, the parties with whom it is shared, and the means by which you may review or delete it. It applies to all visitors, whether or not they hold an account.

An account is not required to play. Visitors who do not register may use the site without submitting any personal information to us.

2. Information We Collect

2.1 Information stored on your device

For visitors who are not signed in, game progress is recorded in your browser's local storage and remains on your device. This record consists solely of the date of the puzzle completed and the number of moves taken. It is not transmitted to our servers and is not accessible to us.

If you subsequently register an account or sign in, the result recorded for the current day is submitted with that request so that it may be preserved, and thereafter forms part of your account history.

2.2 Account information

If you register an account, we collect and store the display name and email address you supply, an indication of whether that address has been verified, and the dates on which the account was created and last modified. A display name need not be your real name, and is shown only to you and to site administrators. Passwords are stored only in cryptographically hashed form. We do not store, and cannot recover, your password itself.

We also generate limited-duration tokens for the purpose of verifying an email address or resetting a password. These tokens are stored until they are used or until they expire.

2.3 Information obtained through Google Sign-In

If you elect to sign in using Google, we store the account identifier assigned by Google, together with the access and refresh tokens required to maintain your session, and the name and email address returned by Google. We request no information beyond these items and have no access to any other part of your Google account.

2.4 Session information

Each active sign-in creates a session record containing a session token, the times at which the session was created and will expire, and the IP address and browser user agent from which it was established. The latter two items are retained so that unauthorised access to an account may be identified. Sessions are terminated when you sign out, when they expire, or when you change your password.

2.5 Game results

For each daily puzzle completed by a signed-in user, we store the game concerned, the date of the puzzle, the score achieved, and the time of completion. This information is used to display your archive of completed puzzles and any awards earned.

2.6 Security and abuse prevention

We maintain temporary counts of recent sign-in, registration, password-reset, and email-change attempts, associated with the originating IP address, in order to prevent automated password guessing and the misuse of the site to send unsolicited email. These counts are held in memory only, expire within minutes or hours, are erased whenever the server restarts, and are not written to our database.

2.7 Information we do not collect

We do not operate analytics software, advertising services, tracking pixels, or third-party cookies, and we do not construct profiles of visitors for any purpose.

3. Cookies

We set a single cookie, containing your session token, at the time you sign in. This cookie is strictly necessary for the operation of the site, in that it is the means by which you remain signed in between pages. It is removed when you sign out. No other cookies are set.

4. Use of Information

Information described in section 2 is used solely to operate the site: to create and administer your account, to authenticate you, to send transactional email relating to your account, to record and display your results, and to protect the site and its users from abuse. We do not use your information for marketing purposes.

5. Disclosure to Third Parties

We do not sell your information, disclose it for advertising purposes, or otherwise transfer it to third parties, save as follows:

• Resend, which delivers our verification and password-reset messages and therefore processes your email address and the contents of those messages;
• Google, where you have elected to sign in using Google, which will accordingly be aware that you have authenticated with this site;
• our hosting provider, which operates the server and database on our behalf; and
• any party to whom disclosure is required by law.

6. Retention

• Account information and game results are retained until you delete your account.
• Session records are retained until the session expires, you sign out, or you change your password, which terminates all other sessions.
• Verification and password-reset tokens are retained until used, and in any event expire after a short period.
• The abuse-prevention counts described at section 2.6 are retained for minutes or hours and are never persisted.

7. Deletion of Your Information

7.1 Deletion of your account

You may delete your account at any time, without assistance from us, as follows:

1. Sign in and open your account settings.
2. Locate the section headed "Delete account".
3. Enter your current password and click "Delete account".
4. Confirm the request in the dialog that appears.

Deletion takes effect immediately and is irreversible. It removes your account record, your name and email address, your password hash or Google tokens, all active sessions, and all game results recorded against the account. No copy is retained in a deleted or archived state, and we hold no separate backup from which the information could be restored. Any unused verification or password-reset tokens expire shortly thereafter.

Deletion of an account does not affect information held in your browser's local storage, which is addressed at section 7.3.

7.2 Accounts created with Google Sign-In

An account created through Google Sign-In has no password. In place of a password, we confirm such a request by reference to the age of your session. If you are asked to sign in again, sign out, sign in once more, and submit the deletion request immediately afterwards.

7.3 Information stored in your browser

To remove the game progress described at section 2.1, together with the session cookie described at section 3, clear site data for this site in your browser's settings, ordinarily found under a heading such as "Cookies and site data". Visitors who have never registered an account need take no further step.

7.4 Requests made by email

If you are unable to sign in, you may request deletion by writing to support@eatakeyboard.com from the address associated with the account.

8. Access and Correction

Your account settings permit you to change your email address and your password. A change of email address takes effect only when the verification link sent to the new address has been followed. To obtain a copy of the information we hold about you, or to request the correction of any inaccuracy, write to support@eatakeyboard.com.

9. Amendments

We may amend this policy from time to time. Any change to the information collected or to the purposes for which it is used will be reflected on this page, and the effective date shown above will be revised accordingly.

10. Contact

Enquiries concerning this policy or the information we hold may be addressed to support@eatakeyboard.com.