What we keep, and what we don't.

Your browser gets a random player id in a cookie so the site can remember today's guesses, your streak and your stats on this device. It is not tied to your name, email or anything else about you. Clearing cookies resets it.

A season pass is an email address and a password. The password is stored hashed by Supabase, our database provider, and we never see it. The email is used to sign you in, to send a password reset when you ask for one, and for nothing else unless you join an events waitlist. Your plays, streak and archive progress are linked to the pass so they follow you between devices.

If you join a city waitlist, submit a clue or report a problem with one, we keep what you typed, including the email you gave, so we can follow up and credit you. Credits appear only with the name you asked for.

We use Vercel Web Analytics to count page views. It sets no cookies and does not identify individuals. We also keep our own count of visits against the random player id: the country and region you visit from, the site that sent you here, the days you visit and whether you tried a clue. Your IP address is never stored. We do not use Google Analytics, advertising pixels or fingerprinting.

Supabase (database and sign-in), Vercel (hosting and analytics) and Resend (sending account emails). Each only handles what it needs for that job. Nothing is sold, rented or shared for advertising.

The app shows this website inside a native window. It collects nothing the website doesn't, and it has no tracking of its own. If push notifications are added later they will be opt-in, and this page will say so.

Choose Delete account in the account menu, on the site or in the app. It removes your pass, your email address, your streak and stats and your archive progress straight away. You can also email hello@crypticrun.com and we will do it for you. Without a pass, clearing your cookies is all it takes.