Privacy

What stays on your device

Six things, in your browser's local storage. None of them are sent to any server, and none of them are readable by anyone but you.

• Your progress: which characters you have met and how you have done on each, per skill.
• Your settings: speed, pitch, key bindings, motion and whether the usage counter is on.
• Your statistics: sessions, streak, XP, achievements and best scores.
• Your daily challenge results: the last few weeks of them.
• Your theme: dark, light or following your system.
• Your answer about Google Analytics: allowed or not, and when you chose. It is left out of backups, and erasing your data keeps it, so neither one brings the question back or carries a yes somewhere you did not give it.

Clearing your browser data erases all of it, and there is no copy anywhere else to restore from. If it matters to you, export it from settings — it is a plain JSON file you keep.

What is counted

Three things. The first two are counts rather than records of a person, and run without asking. The third runs only if you accept it.

Our own usage counter

When you start a practice session or finish a game, the browser sends a request to /e/ on this site, naming that event: practice_start, and sometimes a short label like listening. That is the whole message. There is no identifier, no session token, nothing you typed, and no way to connect two events to the same person.

The server answers with an empty response and stores nothing; the request line in its own access log is the only record, and a scheduled script turns those lines into daily totals. You can turn this counter off in settings, and it is never sent at all if your browser asks not to be tracked. That switch and that signal cover this counter only, not the Cloudflare beacon below; Google Analytics has its own switch.

Cloudflare Web Analytics

A small script from Cloudflare counts page views. It reports the address of the page you are on, the page you came from, your browser's user agent and how quickly the page loaded. It is cookieless by design and does not fingerprint you or follow you between sites. Cloudflare processes this on our behalf. It does not depend on your answer about Google Analytics, because it sets nothing on your device.

Google Analytics, only if you accept

Until you choose, a bar at the bottom of the page asks. Nothing from Google is loaded and no Google cookie is set while it waits, and none if you reject. If your browser sends Global Privacy Control or Do Not Track, that counts as a no and you are not asked at all.

If you accept, Google Analytics 4 records the pages you view (their address without anything after a #), the page you came from, your browser, device type, screen size and language, your approximate location (country and city, worked out from your IP address, which Google Analytics does not store), and how you move through the site: how long a visit lasts, scrolling, and links you follow out of it. It sets two first-party cookies, _ga and _ga_8YYFW16VXX, holding a random identifier so that visits from the same browser count as one visitor. They expire 13 months after your last visit.

None of it is used for advertising. The advertising consent signals are always sent as denied, and Google signals and ad personalisation are switched off in the code, so no advertising profile is built from your visit. Google keeps the event-level data for 2 months and then deletes it; only aggregated totals outlive that. Google processes it on our behalf, and it may be processed in the United States.

To withdraw, open settings and set Google Analytics to Not allowed. That stops it on the page you are on, deletes its cookies from this browser, and it does not load again. Your answer is kept in this browser only, so another browser, or one whose data you have cleared, asks again.

Neither Google Analytics nor the Cloudflare beacon is loaded on the secret message page, and neither is the bar, because the message lives in that page's address and must not be sent anywhere.

Your IP address

Like every web server, ours records the address each request came from. That is unavoidable — it is how a reply finds its way back — and the log is what makes it possible to see that a site is being attacked. If you allow Google Analytics, Google's servers see it too, for the same reason, and use it only to estimate where you are.

The script that produces our own visitor counts does not keep addresses. It hashes each one with a secret that is regenerated every day and never stored, counts the hash, and discards it. Two visits on the same day collapse into one count; the same person tomorrow does not, so nobody can be followed across days — not even by us. The raw logs rotate daily and only the most recent few days exist on the server.

What there is none of

• No cookies unless you accept Google Analytics, and then only its two. Not even a "necessary" one otherwise.
• No accounts, no email addresses, no names.
• No advertising, no advertising networks, no data sold or shared for advertising.
• No fonts and no images from anyone else's server — they are all served from this domain. Two scripts are not, both described above: Cloudflare's analytics beacon, and Google's analytics script once you have accepted it.
• No profiling for advertising and no automated decisions about you.

You can check all of this rather than take our word for it: open your browser's developer tools on any page here and look at the cookie jar and the network tab. The whole source is public, including the script that processes the logs and the one that asks about Google Analytics.

Your rights

Under the GDPR you can ask what data is held about you, ask for it to be corrected or deleted, object to how it is processed, and withdraw consent at any time, as easily as you gave it. In practice there is very little to ask about: we hold no account, no contact details and nothing that identifies you. Google Analytics data is tied to a random cookie, not to your name, and its event-level data is deleted after 2 months. Your progress is already in your hands — deleting it is a button in settings and needs nobody's permission.

For anything else, or to ask a question about this page, contact Can Türk.