Privacy

The short version: I don’t sell anything about you, I don’t run ads, and I keep as little as the site needs to work and stay safe.

When you send a postcard, I get your name, your email address and whatever you put on the postcard: your note, a greeting, a rating, your timing for a project. It also tells me how long each game took and how it was played: with a keyboard, a mouse or touch, by ear, or turn by turn.

An agent can also send me a postcard through the agent door. Then I get the name and email address of the person it’s writing for, their message, and the agent’s own name if it gave one. The postcard also says how many attempts each game took and how long, counted by the site.

I use it to read your postcard and write back. I won’t add you to a mailing list, and I won’t sell it. It passes through the services below on its way to me. Beyond that, I share it only if I have to: to deal with abuse, or because the law requires it.

When you finish a game, your browser sends the site a record of that run: the course, the moments you pressed a key, and whether you used a keyboard, a mouse or touch. The site replays it to check the win, then sends back your coin. The record carries nothing about who you are, and it isn’t kept. In the turn-by-turn games, the site plays each move itself. Until a run is won, it keeps only a count of how many times each game was started on the play pass, and when the first one began.

I count visits with Cloudflare Web Analytics: which pages get read, where people came from, and rough country, device and browser. It uses no cookies and doesn’t identify you.

Like every website, the servers that host this one see your IP address when you connect. When you try to send a postcard, the site may log your IP address, the email address on it and which kind it is. Postcards sent from the home page also log rough country and network information. When a game’s win doesn’t check out, or comes in sooner than the game can be played, it logs your IP address. These are used to limit how often one address can write, and to block abuse. The logs are kept for about a week.

Separately, the site keeps a small record with no IP address in it: which runs have earned a coin, for about a day, and how many postcards each coin has sent. It keeps the reference codes it gives out for wins that came in too fast. For each postcard sent through the agent door, it keeps which play pass sent it and when, so each pass sends one postcard and so it can limit how many go out, but not what the postcard said. For each game played on a play pass, it keeps how many times the game was started and when it first began, so the postcard can say how many attempts each win took and how long. Reference codes older than 30 days and agent door records older than two days are cleared as new ones come in. If things are quiet, those records can stay longer. The attempts and times that go into a postcard stay with it.

The site itself sets no cookies. It keeps a few small things in your browser’s local storage: your AR coins and the site’s signature on each, whether you’ve learned each game, your sound and play-by-sound settings, your best score on the bridge and anything you’ve unlocked there, when you sent your last postcards, and your postcard as you write it: your name and email address, a draft of each kind of postcard, and a short note of the last one you sent. Sending clears that postcard’s draft. The rest stays on your device until you clear this site’s data in your browser.

I use a few services to run the site and deliver your postcard. Cloudflare hosts the site, checks your game wins and protects it from attacks. Coins won on the page and all postcards need a Cloudflare Turnstile check, which helps stop automated abuse. It doesn’t prove a person is playing. The turn-by-turn games need one only for their postcard. Cloudflare explains its side in the Turnstile privacy addendum. Resend delivers postcards to my inbox, and my email provider stores them. Each handles your information to do that job, under its own privacy terms.

To see, correct or delete what you sent, write to privacy@report.adamroth.com, or reply to my email if I’ve written back. You don’t need to play anything first. I may ask you to show it’s yours, and I may keep what I need to deal with abuse. Otherwise I’ll do it. I keep notes only as long as the conversation is useful.

If you’re under 13, ask a parent or guardian before you play or write.

If any of this changes, I’ll update this page and the date at the top.