Privacy

Who we are

Glyphtli is a daily guess-the-rule puzzle at glyphtli.io. Operator and data controller: Glyphtli, an independent game made and run by its owner, an individual (sole proprietor) in the Republic of Kazakhstan. Data questions: hello@glyphtli.io.

What we store

Without an account: a random device id in a cookie (crypt_pid), your probes and daily results, interface settings (sound, vibration, torch, whether you saw the tour and today's intro, your analytics choice) in the browser's localStorage.

With an account: the e-mail address and id Google provides at sign-in, a public handle (a random themed name you can change; never your e-mail), your friend code, friends and leagues, live-match rating, chosen cosmetics, and the play history moved over from your device.

With the Golden Key: the Paddle customer and subscription ids, plan, status and end date. Paddle, our reseller, collects your name, e-mail, country and payment details itself under its own privacy policy; we never see or store card numbers.

Feedback: tomb ratings and suggested rules, tied to your id.

Why

To run the game: scoring, streaks and the day's bell, friends and leagues, matchmaking, Golden Key activation.

To improve it: feedback and usage statistics on our own server (see below; you can switch them off).

To fix bugs: error reports carry the page address, the error text and browser details, never your probes or e-mail.

Analytics

We count, on our own server, which pages are opened and how far players get, to see whether the puzzle is too hard and where players stop. No analytics company receives this and no cookie is set for it.

Each event holds its name (page view, day started, door or day finished, paywall shown, checkout started, result copied or shared, sign-in, purchase, refund), the time, the device id or account, a random id for the browser tab, the page path, the referring site's domain (never the full address), campaign tags (utm_*) and the device type (phone, tablet or desktop). Events never contain probes, rules or your e-mail.

Events are kept for 13 months, then deleted, and are deleted with the account or the device's data. Switch them off any time in the account menu or below; browsers that send Global Privacy Control are not counted at all.

Cookies

crypt_pid — device id (2 years). crypt_dev_uid — local development server only. Supabase session cookies (sb-*) — account sign-in. No third-party cookies; the statistics switch and the tab id live in localStorage and sessionStorage, not cookies.

Who we share with

Only the services the game runs on: Contabo (our server, where the game and its database run), Supabase (Google sign-in), Paddle (our reseller and merchant of record for payments), Cloudflare (live matches), Sentry (errors). Data is never sold or passed to ad networks.

Some of these providers are outside your country; transfers rely on their standard contractual terms.

How long

As long as the account exists or the device keeps playing. Anonymous devices with no plays for two years are deleted. Encrypted database backups are kept off-site for at most 6 months, so deleted data disappears from them within that time. Payment records are kept as long as tax rules require.

Your rights

Download all your data (JSON) and delete the account yourself in the account menu. Deletion cancels the subscription and erases plays, friends, leagues, rating and feedback; in your rivals' live matches your line becomes anonymous.

To correct data, withdraw consent or complain, write to hello@glyphtli.io. You may also contact your country's data protection authority.

Children

The game is not meant for children under 13 (or the age of consent in your country). Accounts created by children are deleted at a parent's request.

Changes

A new version of this policy is published here with a new date. We announce material changes in the game.