Privacy Policy

Last updated September 18, 2026

If you play without an account

Most people play this way. Your browser creates a random player ID, which is stored on your device. It isn't linked to your name or email. With it we store:

• Your game results: which puzzle and mode, whether you solved it, your time, mistakes and words solved. This powers your streaks and stats, and the "faster than X% of players" comparisons.
• A few feature counts: when you use the share button or open a past puzzle, we record that it happened and which result it was for. We never see where you shared it or what you wrote.

Preferences like sound, timer visibility and theme are kept only in your browser.

If you create an account

An account is optional. It lets your streaks follow you to other devices.

• Email address: used to identify your account and to send sign-in codes and links. Creating an account doesn't subscribe you to any emails.
• Sign in with Google: if you use it, Google tells us your email address and a Google account ID. We store only those two things. We don't receive your password, contacts, or anything else in your Google account.
• Password: if you set one, we store only a salted scrypt hash. Your actual password is never stored, and nobody at Crossonym can see it.
• Devices: the player IDs of the devices you sign in on, so their history can be combined into one account.
• Sign-in sessions: a random token that keeps each device signed in. We store it only in hashed form, and it expires after a year.

If you sign up for the daily email

We store your email address, when you subscribed, and whether you confirmed. Nothing is sent until you click the confirmation link. Every email has a one-click unsubscribe link.

What we don't do

• No advertising, and no ad or tracking networks.
• No tracking cookies and no cross-site tracking. The only visitor analytics is Cloudflare Web Analytics, which counts page visits without cookies and doesn't identify you.
• We don't sell, rent, or trade your information.
• We don't store your IP address. It is used briefly, in memory only, to prevent abuse (like someone requesting hundreds of sign-in emails), and then discarded.

Services that help run Crossonym

These companies process data for us only to provide their service:

• Cloudflare: hosts the website and provides the cookie-free visit counts mentioned above.
• Railway: runs the game server.
• Supabase: the database where the information above is stored.
• Resend: delivers sign-in and daily emails.
• Google: only if you choose Sign in with Google. Google's sign-in script loads only when you open the account screen, never while you play.

Like most hosting providers, Cloudflare and Railway may keep short-lived technical logs of requests for security and reliability.

How long we keep it

Game results and account information are kept while Crossonym is running, so your history and streaks don't disappear, or until you ask us to delete them. Unused sign-in codes and links expire after 15 minutes.

Your choices

• Play without an account. Everything works without one.
• Sign out on any device from Settings → Account.
• Unsubscribe from the daily email with the link in any email.
• Ask for a copy of your data, or have it deleted: email [email protected] from the address on your account or daily-email subscription. We'll handle it within 30 days. Results from playing without an account aren't tied to your identity, and clearing your browser data disconnects them from your device.

Children

Crossonym is a general-audience word game and isn't directed at children under 13. We don't knowingly collect email addresses from children under 13. If you believe a child has created an account, contact us and we'll delete it.

Changes

If this policy changes, the new version will be posted here with a new date.

Contact

Questions: [email protected]