LEGAL

Privacy Policy

Last updated: 20 October 2026

TwoShadowsGames operates this website and its games. This policy explains what personal data we process, why we process it, and the choices available to you.

Information we process

Providing and protecting the site

Our web server and hosting provider may process technical request data such as your IP address, browser type, requested URL, date and time, and security or error information. We use this data to deliver the site, prevent abuse, investigate faults, and keep the service secure. Daily game requests also use short-lived IP-based counters to limit abuse.

Playing Where are you?

When you start a Daily attempt, we create a random guest player identifier and store it in an encrypted first-party cookie. We record the challenge, attempt start and completion times, answers, score, and related game results. The identifier is not linked to a registered account.

Unlimited puzzles run in your browser. The game stores display and audio preferences locally, and uses session storage for an unfinished Unlimited puzzle, its random seed and puzzle timers. If you choose to download or share a game image, it is created in your browser and saved to your device or passed to the sharing destination you choose.

Bug reports

If you submit a bug report, the description you enter is sent through Brevo to our studio inbox so we can investigate it. Please avoid including passwords or other sensitive information. Failed delivery may also produce an application error log.

Icons and external links

We load icons from Font Awesome. Your browser sends technical request information, such as your IP address and browser details, to that provider when it requests these assets. If you follow a social media or Support Us link, the destination site handles your visit under its own privacy policy.

Optional analytics

If you accept Analytics, we use Google Analytics 4 with measurement ID G-RGQK0ZB8L7. It may process pages viewed, interactions, session information, approximate location, and browser and device information. We do not load Google Analytics or send it data before you consent.

Advertising storage, advertising user data, and advertising personalisation remain denied. Google Signals and advertising personalisation signals are disabled, and we do not use Google Ads.

Why we process information

• To provide requested pages and game features.
• To secure the service, limit abuse, and diagnose technical problems.
• To understand site usage only where you have consented to Analytics.

Who receives information

Technical data may be processed by the providers that host and operate this website. Brevo processes submitted bug reports, and Font Awesome receives requests for icon assets. Google receives analytics data only after Analytics consent. We do not sell personal data and do not share it for targeted advertising.

Retention

Your Analytics choice is valid for 180 days. An expired preference is removed when the site next checks it. Analytics cookies are configured to expire after 180 days without extending that expiry on each visit. These cookie lifetimes do not determine how long Google retains data already received.

The site session expires after 120 minutes of inactivity. New or refreshed guest player cookies request a lifetime of 90 days, subject to browser limits. Older cookies may keep their previous expiry until refreshed or cleared. Game display and audio preferences have no automatic expiry. Session storage normally lasts for the browser tab session, although browser session restore may preserve it.

Expiring a cookie or clearing browser storage does not delete server-side game records.

Completed Daily attempts become eligible for deletion 90 days after completion. Unfinished Daily attempts become eligible 7 days after they start. Eligible attempts are removed on the next successful scheduled daily cleanup.

Cleanup also removes guest player records with no remaining attempts. Shared Daily puzzle definitions are retained. New official attempts are only available on the current UTC day, so deleting an old result does not reopen that challenge.

Retention periods for bug-report emails, application and hosting logs, backups, and data held in Google Analytics still need to be confirmed before this policy is finalised. Deletion from the live game database does not remove copies already held in backups.

Your choices and rights

You can reject Analytics when first asked and can change or withdraw your choice at any time through Cookie settings. Withdrawing consent removes Analytics cookies accessible to this site and reloads the page without Google Analytics.

Depending on where you live, you may have rights to access, correct, erase, restrict, or object to the use of your personal data, and to complain to a data-protection authority. For privacy questions or requests, email [email protected].

Cookies and local storage

Our Cookie Policy lists the first-party cookies and browser storage used by this site, their purposes, and their lifetimes.

Changes to this policy

We may update this policy when the site or its data practices change. We will update the date at the top when we do.