Privacy, in plain language.

Last updated October 25, 2026. This policy describes plaingame.app.

Guest play and saved flights

We create a random guest identifier in an HTTP-only browser cookie. The server stores your flight attempts, answers, scores, settings, group memberships, achievements and reminder subscriptions against that identifier. Browser storage also keeps local settings and earlier game records. Clearing browser data can disconnect a guest passport.

Optional accounts

If email accounts are configured, we store your email, chosen display name and a salted password hash. Verification and reset codes expire. Your date of birth is used to check the game’s minimum age and is discarded. If Google sign-in is configured, we request basic identity and verified email; we do not request access to your mail, files or contacts. Guest progress can be merged into a signed-in account.

Sharing and groups

People holding a challenge link can view the shared nickname and score and play the same puzzle. Group members can see members’ group nicknames and daily or weekly standings. Invitation links let other players join. Do not put private information in a public nickname or group name.

Reminders and messages

When you opt into browser reminders, we store a push subscription endpoint, delivery keys, time zone and chosen time. You can remove the reminder in Settings. Contact form messages and an optional reply email are stored for the site owner to review. Account settings may store your choice about optional game-update email; this does not affect essential account messages.

Services and analytics

Cloudflare hosts the website and application database and may process network information for delivery and abuse protection. The site uses Google Analytics 4, measurement ID G-L9TPZV7HGZ, for page views and basic game events when Usage analytics is enabled. We omit query parameters, answers, account emails and challenge codes from analytics events. Advertising personalization and Google signals are disabled. You can turn off future analytics collection in Settings; browser controls can remove existing cookies. Some pages load fonts from Google Fonts.

Control and deletion

You can export your passport in Profile. Signed-in users can delete their own account in Account settings; this removes personal game records and leaves other members’ group records intact. Use Contact for a privacy request or a guest-data question. We keep gameplay records to provide your passport until they are deleted. Expired sessions, codes and temporary rate-limit records are cleaned up by the service.

Security and changes

Passwords are not stored in readable form. Account cookies are restricted to the site; private API responses are not cached by the offline app. No service can guarantee uninterrupted access or perfect security. This page will be updated when the data practices change.