Privacy Policy

Overview

Matchy Matchy is a browser-based game. This policy describes exactly what data the game stores, where, and why.

Short version: You can play everything except the ranked leaderboards without an account, and then all of your data stays in your own browser. If you create an account, our server stores your username, a hash of your password, your game statistics, achievements and leaderboard scores. Nothing is ever sent to an analytics service, advertising network or other third party.

Data Stored in Your Browser

The game uses your browser's localStorage to save progress and settings between sessions. Everything below stays on your device unless a section further down says otherwise.

• matchy-matchy-highscore, matchy-matchy-bestchain — your best solo score and longest chain
• matchy-matchy-achievements — achievement progress and lifetime counters (lines, blocks, chains, games, daily streak)
• matchy-matchy-records, matchy-matchy-daily-YYYY-MM-DD — your best Daily Challenge results, per day and per challenge type
• matchy-matchy-daily-challenge-YYYY-MM-DD — a cache of the day's challenge definition fetched from our server
• matchy-matchy-theme, -colorblind, -muted, -screenshake, -glassstyle, -matchpreview, matchy-layout, matchy-server-url — settings
• matchy-matchy-tutorial-seen, -rules-seen, -ach-last-viewed — which introductions and notices you have already seen
• matchy-matchy-auth-token, matchy-matchy-account-username — your login session, only if you have an account (see below)
• matchy-matchy-stats-outbox, -pending-achievements, -pending-scores, -stats-history-imported — results waiting to be sent to your account when you are online

You can clear all of this at any time by clearing your browser's site data for this domain. Logging out removes the session and the account's statistics from the device.

Accounts (Optional)

An account is only needed to appear on the leaderboards and to keep statistics and achievements across devices. Registering asks for a username and a password and nothing else — no email address, no real name, no social login.

For an account, our server (hosted on Fly.io, database on Turso) stores:

• Your username and a bcrypt hash of your password. The password itself is never stored.
• Your leaderboard entries: score, time, date, and which challenge they were played on.
• Your achievement unlocks and when they happened.
• Your lifetime game statistics: the counters listed above, plus the dates on which you completed a Daily Challenge (used to compute streaks). After each finished game the client sends what that game added; the server keeps the totals.
• The time the account was created.

Logging in stores a signed session token in your browser for 30 days. The server writes operational logs (request method, path, status and timing, and match start/end events that include player usernames) to its hosting provider's log stream, which is retained briefly. IP addresses are used only for short-lived in-memory rate-limiting counters on the login and score-submission endpoints and are not written to the logs.

What is public: your username together with your scores appears on the leaderboards, and your username is shown to your opponent and to spectators in online matches. Your statistics and achievements are not public.

To delete an account and everything stored with it, email the address below from any address, quoting the username; we will confirm before deleting.

Online Multiplayer

When you play Online Battle, your live game state (board layout, piece positions, score) is relayed in real time to your opponent, and to anyone spectating the room, through our WebSocket server. This data is used only to synchronise the live match and is not stored after the match ends. Playing online does not require an account; without one you appear as an unnamed guest.

Daily Challenge

The Daily Challenge mode fetches the day's challenge from our server so that every player gets the same board and goal. This request contains no user identifiers. If the server cannot be reached, the game derives an equivalent challenge locally so you can still play offline; results from an offline run are not submitted to the leaderboard. Submitting a result requires an account and is checked by the server against the day's real challenge.

Third-Party Services

This game does not use:

• Analytics or tracking (no Google Analytics, Mixpanel, etc.)
• Advertising networks
• Social login (Google, Apple, Facebook, …)
• Cookies — the session token lives in localStorage and is sent only to our own server

Infrastructure providers that process data on our behalf: Cloudflare Pages (serves the game), Fly.io (runs the server), Turso (hosts the database).

Children's Privacy

The game does not ask for any personal information beyond a self-chosen username, and an account is never required to play. There is no chat or messaging feature. If you believe a child has registered an account and you would like it removed, contact us below.

Changes to This Policy

If this policy changes, the date at the top of this page will reflect that. Any new data collection will be described here before it goes live.

Contact