Privacy policy

Last updated: July 2026.

8flowy is built local-first: without an account, your play data lives in your own browser and nowhere else. This policy explains what is stored where, what changes when you sign in, and how to exercise your rights.

Playing without an account

No registration is required. In that mode we keep everything in your browser's localStorage: settings (theme, sound, haptics), your current board save, Journey and tutorial progress, daily-puzzle state, local statistics and achievements, and your display name and avatar choice. None of it leaves your device except the anonymous requests needed to fetch puzzles. The Cookies & local storage page lists every key.

If you sign in

Signing in (Google OAuth or an email code) creates an account with our authentication provider, Supabase. To make sync and the leaderboard work we then store server-side: your email address, a user ID, display name, avatar index, puzzle statistics (solve counts, best times), Journey progress, achievements, login-streak dates, and your daily-puzzle solve times. Daily times, with your display name and avatar, appear on that day's public leaderboard — that's the feature's purpose.

Payments

The optional Premium unlock is processed by Stripe. We never see or store your card details; we store only the checkout session reference needed to activate your unlock.

Analytics & ads

If analytics is enabled on this deployment, we use Google Analytics with anonymized events (page views, puzzle starts/solves) to understand what's fun. If ads are enabled for free accounts, Google AdSense may set its own cookies; see the cookies page and Manage privacy for controls.

What we never do

• No selling or renting personal data, to anyone, ever.
• No tracking across other sites.
• No requiring an account to play.

Retention & deletion

Local data persists until you clear it (see Manage privacy for steps). Server data persists while your account exists. To delete your account data, email [email protected] from the address on the account; we'll remove your records promptly.

Your rights

Under GDPR, CCPA and similar laws you may access, correct, export, or delete your personal data. For local-only play you can do all of this yourself in the browser; for accounts, one email does it. Questions about this policy: [email protected].