Privacy and data

No accounts, no sign-up, no third-party scripts, no advertising, no cookies, no profile of you anywhere. Your progress, your streak and your statistics live in your browser's local storage and never leave it. Clearing your browser data clears them, and there is no copy anywhere else.

Next to them, in the same local storage and just as private, sits a short list of things the page remembers about how you like it. This is all of it:

• The tutorial — whether you finished it, skipped it, or closed the suggestion to take it, so it does not keep opening.
• The theme — System, Light or Dark, whichever you picked in Settings.
• The notification suggestion — how many times you closed it, and how many games you had played the last time, so it does not come back every day.
• Whether notifications are on — a yes or a no, so the page knows to stop suggesting them. The push address itself is not kept here; what is kept on the server is described under notifications.

None of it is sent anywhere, and clearing your browser data clears it too.

There is one thing that does get stored on the server, and only if you ask for it: notifications. It is described in full further down.

What this page does do is count itself. It sends a short list of anonymous events to this same site — no other company involved, no script loaded from anywhere else — to answer one question that nothing else here can answer: is anybody playing? Below is the complete list, written out rather than summarised, because a summary is exactly where this kind of thing hides.

Every event that is sent

• Opened — once, when the puzzle has finished loading in the game. The pages around it — About, The numbers, this one and For teams — never send it. It carries the puzzle number and where you came from, reduced to the name of the site — youtube.com, say — or direct if there was none: a typed address, a bookmark, an app. If you opened it by tapping the morning notification, it says notification instead. We record only the name of the site you came from (e.g. youtube.com), never full addresses. It is worked out in your browser when the page opens and is not saved anywhere.
• Started — when you submit your first guess of the day. The puzzle number, and nothing else.
• Finished — once, when the game ends. It carries the puzzle number, whether it ended in a win or a loss, how many guesses it took, how many hints were shown, and the returning label explained just below.
• Shared — when sharing or copying your result actually succeeds. The puzzle number, and nothing else. What you share does not travel with it.
• Outbound click — when you follow one of the four links that leave this site: my own site, Have I Been Pwned, Cloudflare's privacy policy, or the email address on the For teams page. It carries the puzzle number and one fixed word saying which of the four it was — site, hibp, privacy or teams — never an address. It is the only event the pages around the game send. The named share destinations under a result — X, WhatsApp, Telegram, LinkedIn — are plain links, and following one sends nothing at all, not even this. The single exception is LinkedIn, which only accepts a link: it copies your grid to the clipboard first, and that copy counts as a share exactly like the Copy result button — the puzzle number and nothing else, with no record of which destination it was.

That is all five, and those are all their fields. There is no identifier in any of them — no cookie, no account, no generated ID, no fingerprint — and no IP address, country or browser is stored alongside them: an event is the words and numbers listed above, a timestamp, and nothing more. Nothing in an event points at the event before it, so two events sent by the same browser cannot be recognised as belonging to the same browser, by me or by anyone else reading the stored rows. What accumulates is a count, not a trail.

Nothing about the puzzle travels either: never the password, never the word it is built on, never the family it belongs to, never what you typed, never your grid. If your browser sends Do Not Track or Global Privacy Control, no event is sent at all.

How the returning label works, since it is the one that sounds like tracking

The finish event carries a single word out of four: first, d1, week or long. It is worked out inside your browser, from something your browser already has — the number of the last puzzle you completed, which is part of the streak that has always been stored locally. The gap between that and today's puzzle becomes the word, and only the word is sent: first time, came back the next day, came back within a week, came back after longer.

The number itself never leaves, and the word cannot be walked back into one. Millions of finishes would carry d1, and there is nothing in the row to tell them apart or attach any of them to a device. It measures how many finished games came from someone who had played before — never which someone.

Notifications, if you turn them on

They are off unless you switch them on. The game offers them after you have finished a game, and you can switch them on yourself in Settings — never when the page opens. If you do switch them on, your browser gives this site an address for its push channel, and that address is stored, together with four other things. This is the complete list:

• The push address — a long, random web address issued by your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser). It is what the notification is sent to. It identifies that browser on that device, not you, and it is the reason this section exists.
• Your time zone — a name like Europe/Rome, so the notification arrives in your morning and not at midnight in London.
• The hour to send at — 8 in the morning, the same for everyone.
• The last puzzle you were notified about, and the day it was sent — so you never get two for the same puzzle, or two in one day.

Nothing else: no IP address, no browser details, no date of when you signed up, and no link to the anonymous events above — the two are kept in separate places and nothing joins them. The notification itself carries nothing at all: no text, no puzzle number. Your browser writes the message it shows, so nothing about the puzzle passes through the push service either. What that service does see is that a notification was delivered to that browser, which is how push works for every site.

The address is kept in Cloudflare's database for this site until you turn notifications off. Switching off New password reminder in Settings deletes it from the server straight away. If you instead block notifications in your browser settings or uninstall the app, the push service reports the address as gone the next morning and it is deleted then.

Where the events are kept, and for how long

The events are written to the analytics store of Cloudflare, which hosts this site. They are deleted automatically after three months; there is no export, no backup and no copy anywhere else. They are read as totals — games finished per day, guesses needed, how the four returning words divide up — and they exist to answer whether this is worth continuing. No other use, and nothing to sell, because there is nothing here anyone would buy.

Alongside that, and unchanged, there is the hosting provider's request log: the same count of page views any web server keeps, written by Cloudflare rather than by this page. It is theirs to write and theirs to delete under their own retention policy — days, not years — and nothing here downloads it, exports it or keeps a copy. What reaches me is the aggregate figure in their dashboard: how many requests, from roughly where. No raw log, no addresses, nothing that follows one visitor across days.

The person answerable for all of it is Alex Cortinovis, who made this page and runs it as an individual — the same name and the same address as under Made by: dailycrack@alexcortinovis.tech. There is no company behind this and nobody else with access.

If any of that still counts as your data, the push address above included, the rights that come with it are yours: to ask what is held, to have it corrected or deleted, to object to it being kept at all, and to complain to your data protection authority. Write to dailycrack@alexcortinovis.tech and it gets answered. Be warned that the honest answer is usually that there is nothing to hand over — which is the point of building it this way.