Privacy

If you just play

Each stamp you press (pass, fail or skip) is saved with the passage it was for and a random code made fresh for that game. The code isn’t tied to you, your device or anything else, and a new game gets a new one.

We use these to count how each passage does. Nothing about who pressed them is kept, because we never know.

If you sign a certificate

We store the name you type, the one-line review if you write one, the five stamps from that game, and the date. That’s the whole record.

Your name and review appear on your certificate. Anyone you send the certificate’s link to can see them. Each link ends in a random code, so certificates can’t be found by guessing numbers, and there is no public list of names.

Your certificate isn’t linked to your stamps from playing. We check they exist before you sign, then store only the stamps themselves, not the game’s code.

Use any name you like. It doesn’t have to be your real one.

What we don’t collect

No email address, no phone number, no account, no password, no location.

No IP addresses. To stop one person signing hundreds of certificates, we allow five signatures an hour from the same connection. We do that with a scrambled, one-way fingerprint of your connection and the current hour, which can’t be turned back into your address and is deleted within two hours.

Cookies and your browser

We don’t set cookies.

During a visit, your browser keeps a random visit code in its session storage (not a cookie). It’s deleted when you close the tab.

If you mute the sound or pause the music, your browser remembers that on your device so it stays that way next time. It isn’t sent to us.

Counting visitors

We count visits with Plausible Analytics, which uses no cookies and doesn’t collect personal information. We see totals, such as how many people finished five rounds or which share button was used, not who did it.

We also keep our own anonymous record of how the site is used, so we can make it better. It covers which pages are viewed and for how long (only while the page is on screen), how far down people scroll, what happens in the game (each stamp and how long it took, which sections get opened, whether a certificate is signed or shared), and whether the music is played or muted.

With it we note where the visit came from (the site that linked here and any campaign tag in the link), a rough location (country and region, worked out from your connection as the page loads; your IP address isn’t kept), and your type of device, browser, screen size and language.

All of it is tied only to that random visit code, which your browser forgets when you close the tab. We don’t store your name or your certificate number with it, and it can’t be linked to an earlier visit.

If your browser sends a Global Privacy Control or Do Not Track signal, none of this is collected.

When you share a certificate, the share button opens the other app directly. We never see what you posted or who you sent it to.

Who else is involved

The site runs on Vercel and stores its data with Supabase. Like any web host, Vercel may keep standard request logs, which include IP addresses, for a short time for security and reliability, under its own privacy policy. We don’t use them to identify anyone.

We don’t sell or share your information with anyone, and there are no adverts.

Changes

If this changes, this page changes first, with a new date at the top.