Privacy policy

When you create an account we store your email address, your handle and, if you add them, a display name and bio. If you sign in with Google or GitHub, we also keep the profile picture from that account.

As you play we store your scores, solutions and streaks, and the sprees and teams you take part in.

When analytics is on (see Cookies & consent), Google Analytics collects standard usage data: pages viewed and gameplay events. When it is off, Google Analytics receives only cookieless signals with no identifiers (Google Consent Mode), which it uses to estimate visits in aggregate.

When analytics is on, Microsoft Clarity also records how pages are used (clicks, taps, scrolling and page changes) to build heatmaps and session replays that show us where people get stuck. Clarity masks everything you type, email addresses and numbers in your browser, before anything is sent. It is not loaded at all while analytics is off, for admin accounts, or on pages whose address carries a sign-in or invite token.

For signed-in players we also keep the country you last used the site from (worked out from your connection, never your exact location) and your browser and device type. For each device you are signed in on, we keep the same details plus a partly hidden IP address and a one-way fingerprint of it (the full address is not stored). We use these to support you, to protect accounts and to spot abuse such as one person running several accounts.

Our servers keep standard access logs (IP address, browser user agent, the address requested and the time) for security and debugging. Operator: UrsaCode.

• Your handle, display name, bio and profile picture, and the public teams you belong to.
• Hunts you publish, and your comments and discussion posts, under your handle.
• Your stats and activity, unless you hide them in Settings.
• Your solutions stay private unless you choose to share them in Settings.

Account emails (confirming your address, resetting your password) go out when you need them.

Results email: after each daily you solve, we email you your own result: your length against par, the shortest length, your rank and the share of solvers you beat. It never shows a pattern or another player's handle. It is on by default, and you can turn it off in Settings or from any results email. In the EU/EEA, the UK and Switzerland it carries only your result, and we send it on the basis of our legitimate interest in telling you how you did; you can say no when you sign up.

You can switch it to weekly or off at any time in Settings, or with the unsubscribe link in every email (one click, no sign-in needed). That is your right to object, and we stop at once.

Reply notifications and announcements have their own switches in Settings. Announcements stay off unless you turn them on.

We use sign-in cookies to keep you logged in, and a small browser storage value to remember your cookie choice. "Analytics" on the cookie banner means two services: Google Analytics, which counts visits and gameplay events, and Microsoft Clarity, which records clicks and scrolling (never what you type), both described under What we collect. In the EU/EEA, the UK and Switzerland, analytics cookies are only used after you accept them on the cookie banner. Elsewhere, analytics is on by default. Wherever you are, if you decline, no analytics cookies are set; Google Analytics then only receives the cookieless signals described above.

Wherever you are, you can turn analytics off or change your choice at any time in Cookie preferences.

We use Google Analytics and Microsoft Clarity to understand usage (in the EU/EEA, the UK and Switzerland only after consent; elsewhere on by default, and you can switch them off). If you sign in with a third-party provider (Google or GitHub OAuth), that provider processes your authentication. We use Sentry for error monitoring and crash diagnostics; it receives technical error reports only, with no advertising use, and runs regardless of your cookie choice. We do not sell your data.

Account and gameplay data are kept while your account is active.

You can delete your account at any time in Settings. You are signed out straight away, and the account is deleted 30 days later; sign back in before then to cancel. When it is deleted we remove your email address, password, handle, display name, profile picture, bio, sign-in links and team memberships. Hunts, comments and scores you posted stay, shown under a neutral name such as deleted-3f9a.

Server access logs are kept for 14 days. Error reports in Sentry are deleted automatically after Sentry’s retention period, at most 90 days. Analytics data is kept according to Google Analytics defaults. Clarity recordings are deleted after 30 days.

You may request access to, correction of, or deletion of your personal data:

• Access: email salam@ursacode.com for a copy of the data we hold about you.
• Correction: edit your profile, or email us.
• Deletion: delete your account in Settings, or email us.

This policy is governed by the laws of Pakistan. Effective date: 2026-10-22.