PRIVACY

What Eyedle records, and your rights

No ads. No third-party analytics. No trackers. Nothing is sold, and nothing is shared for advertising.

In short

You can play without an account. Then nothing about you is stored on our server.
An account is optional. It stores your email, a display name and the days you played, so your streak survives a new browser or device.
You are in control. Download everything we hold, or delete your account, from the account screen at any time.

Who is responsible

Eyedle (eyedle.ca) is responsible for the personal information described here. Our privacy contact is the person responsible for protecting it. Questions, requests and complaints go to [email protected].

Playing without an account

Your streak, finished cases, and whether you have seen the how-to are kept in your browser's local storage. They are not sent to our server. Clearing your browser data clears them, and a different browser starts fresh.

If you create an account

We store:

Your email address, from the form, or from Google if you sign in with Google.
A display name, from Google, or the part of your email before the @.
A link to your profile picture, only if you sign in with Google. We store the link, not the picture.
Your password, if you set one, as a one-way scrypt hash. We never see or keep the password itself.
The days you finished the daily case, and whether you solved each case you played.
Each browser you are signed in on: when you signed in, when that sign-in expires, and a short description of the browser (its user agent, cut to 120 characters), so you can recognise it in your data download.
When the account was created and when it was last used.

When you sign in, the streak and results already saved in that browser are added to your account, so streaks played in different browsers merge. That is their only use. They are never used to measure visitors.

Why we use it

To provide the account you asked for: keeping you signed in and your streak saved across browsers. Under the GDPR this is necessary for a service you requested (Art. 6(1)(b)). Under Canadian privacy law, you consent by creating the account, and you withdraw that consent by deleting it.
To keep accounts secure, by limiting repeated sign-in attempts. This uses your IP address, held in server memory for up to 15 minutes and never written to disk. Basis: our legitimate interest in stopping password guessing.
To count visits and games, described below. Basis: legitimate interest.

We do not use your information for advertising, profiling or automated decisions, and we do not send marketing email. The only email we send is a password-reset link, and only when one is requested for your address.

Signing in with Google

If you choose it, Google gives us your name, email address and profile picture link, and Google learns that you signed in to Eyedle. We never receive your Google password or anything else from your Google account. Google's part is covered by the Google Privacy Policy. Google sign-in does not work inside some apps' built-in browsers; email sign-in does.

One account, two ways in. An account can be opened by Google, by email and password, or both: while signed in you can add a password, or connect Google, in the account panel. Because we cannot send confirmation email, we treat Google as the proof that you own an address. So if an email-and-password account exists for an address and you then sign in with Google using that same address, the two are merged into one account under your Google sign-in, and the old password stops working; you can set a new one from inside. Creating an email account for an address that already signs in with Google is refused.

Cookies and browser storage

Name	What it does	How long
`eyedle_player` cookie	Keeps you signed in	180 days, renewed when you visit; removed when you sign out
`eyedle_oauth` cookie	Protects a Google sign-in while it is in progress	10 minutes
`eyedle_admin` cookie	Signs in the site's editors. Players never receive it	30 days
`eyedle:progress` local storage	Your streak and results in this browser	Until you clear browser data
`eyedle:seen-intro` local storage	Remembers you have seen the how-to	Until you clear browser data
`eyedle:last-signin` local storage	Remembers how you signed in, so you use the same method and keep one account	Until you clear browser data
`eyedle:inapp-note` session storage	Hides the "open in your browser" note after you close it	Until the tab closes

Each of these is strictly necessary for something you asked for: playing, or staying signed in. None is used for analytics or advertising, which is why there is no cookie banner.

Counts kept on the server

Two more things are recorded for everyone, signed in or not. Both are counts, and neither is linked to an account.

Arrivals. One row per page open: time, page, the referring host (not the full address), whether the request was a bot, phone or tablet or desktop, and any tag we put on our own links.
Games. Per case, a count of first guesses made and a count of how games ended. Nothing about who played.

Your IP address

Not stored. To count daily visitors it is combined with your user agent, the date, and a secret value held only by this server, then hashed. The hash cannot be reversed, and it changes at midnight Toronto time, so it cannot follow you across days. Your full user agent is not stored for this either. The only other use of your IP address is the sign-in limit above, in memory only.

How long we keep it

Your account: until you delete it. An account not used for 3 years is deleted automatically, with everything in it.
A signed-in browser: expires after 180 days without a visit.
A password-reset link: 60 minutes, and one use.
Deleting your account removes it, with its sign-ins, days and results, from our database immediately.
Arrival rows: about 400 days. Per-case game counts hold no personal information and are kept.

Where it is stored

On a server we rent, reached through Cloudflare's network. That server may be outside your province or country, so your information may be processed under the laws of another jurisdiction, whose courts and authorities may be able to access it. We protect it the same way wherever it is held.

Security

Passwords and sign-in tokens are stored only as one-way hashes, so a copy of our database contains neither. Sign-in attempts are rate-limited. If a breach creates a real risk of significant harm to you, we will tell you and the relevant privacy authorities, as the law requires.

Your rights

Wherever you live, you can:

Get a copy of your data — everything we hold about your account, as a file you can keep or move. Sign in on the game, then
Delete it. "Delete my account and data" on the account screen, at once.
Correct it, or object to how it is used: email us.
Withdraw consent: delete your account, or email us.
Ask what we hold and how we use it: email [email protected].

Arrival counts are not linked to identifiable people, so we may be unable to find records about you there.

If you are not satisfied with our answer, you can complain to a privacy authority:

Canada: Office of the Privacy Commissioner of Canada
Quebec: Commission d'accès à l'information du Québec
EU and EEA: your national data protection authority, listed by the European Data Protection Board
UK: Information Commissioner's Office

We do not sell or share personal information, as those terms are used in California's privacy law.

Children

Accounts are for people aged 16 and over. If you are younger, please play without an account. If we learn that someone younger has made one, we will delete it.

Third parties

Cloudflare serves the site and handles traffic in transit under its own policies. Fonts load from Google Fonts. Google provides sign-in, only if you choose it. Nothing else. No analytics service.

Changes

If what we record changes, this page and the date below change with it.

← Back to today's case

Last updated 14 September 2026