Privacy

Account details

You can create an account with an email address and password, or sign in with Google. Supabase handles authentication. Email registration requires a confirmation code; password recovery also uses an emailed code.

Google sign-in requests your basic profile and email address to identify your account. It does not request access to your Gmail messages, Google Drive files or contacts. The game uses your verified account identifier and a display name to create your player profile. You can edit your display name and choose a handle.

Your browser receives an account session cookie so you can stay signed in. The game stores a hashed session identifier on the server, rather than the cookie value itself. Temporary cookies also keep sign-in and password recovery tied to the browser that started them.

Match and profile data

The game server processes your room, player seat, moves, board, rack, score and clock to run a match and allow reconnection. Signed-in accounts also have a match index for resuming their games.

Your opponent can see the player name and match information needed to play, including accepted words and clocks. Your unplayed rack and seat credentials are not part of the opponent's public match view. Avoid putting private information in a display name, handle or room invitation you share.

Cookies and storage on your device

Account cookies support sign-in and recovery. The game also uses browser storage, including local storage, for a guest's saved seat, local progress and collectibles, and preferences such as player name, sound and reduced motion.

Clearing this site's cookies signs you out. Clearing site storage can remove guest reconnection details and progress saved only on that device. Signing out does not by itself delete your account or server-side match data.

Services that process data

• Vercel hosts the website and delivers its files.
• Cloudflare runs the game backend and authoritative match state.
• Supabase handles authentication, account profiles, session records and account match indexes. Supabase Storage is configured for private avatar files.
• Resend delivers account confirmation and password recovery emails.
• Google handles Google sign-in when you choose that option.

These services receive information needed for their role, which can include network details such as your IP address and browser request information. Email sign-in is available if you prefer not to use Google.

Questions, corrections and deletion requests

You can update your display name and handle in the account panel and sign out on your device. There is currently no automated account-deletion screen.

For a privacy question, account correction or deletion request, email aj.pathmanathan@gmail.com. Include enough information to identify your account, but do not send a password, verification code or session credential.