The short version
If you play as a guest, nothing is collected. Nothing at all.
If you make an account, the game stores your email address, a display name, and your save files, so your progress follows you between devices. That is the whole list.
There are no ads, no trackers, no analytics services, and no third parties buying or receiving your data. You can download everything or delete all of it from inside the game, in about two clicks.
The rest of this page is the same statement with the details filled in.
Playing without an account
Every part of Bit Cryptic is playable without signing in, and that is a permanent design decision, not a trial. As a guest, your progress is written to your own browser's local storage on your own device. It never travels anywhere. No account exists, no server is contacted about you, and there is nothing for anyone to hand over, lose, or sell.
The tradeoff is the honest one: clear your browser data or switch devices, and that progress is gone. An account exists to solve that problem, and only that problem.
What an account stores
When you sign in, these are the things written to the database. This list is exhaustive.
| What | Detail |
|---|---|
| Email address | The address you typed, or the one attached to the Google account you used. It is how you sign back in. |
| Display name | Three to twenty characters. Generated from your email's first part until you change it. This is the only thing other players can ever see. |
| Save data | One save per game. Your island progress, solved clues, settings, house, fish, achievements; your Tower run stats, unlocked characters, victories. Game state, not a record of you. |
| Leaderboard entries | Only if you submit a score: the score, the floor you reached, which character you played, clues solved, and the time it was submitted. |
| Housekeeping | A device label you can recognise (for example "Chrome on Windows"), timestamps on saves, and a short-lived count of recent requests used to stop one script from flooding the database. |
There is no password, because Bit Cryptic does not use passwords. Sign-in is a one-time link or a six-digit code sent to your email, or Google. Nothing to leak, nothing to reuse somewhere worse.
No real name, no address, no phone number, no date of birth, no payment details, no location, no contacts, no device fingerprint, no advertising identifier.
Why each piece exists
Nothing here is collected because it might be useful later. Each item earns its place:
- Email — the only way to prove you are you when there is no password. It is used to send sign-in links and codes. It is not used for a mailing list, because there isn't one.
- Display name — so the leaderboards can say something friendlier than a row of hexadecimal.
- Save data — the entire point of an account. Solve on the laptop, keep going on the phone.
- Leaderboard entries — so the board can exist. Submitting is your choice; playing does not require it.
Where it lives
The game is a static website. There is no Bit Cryptic server. Accounts and saves are handled by a few service providers, each acting only on instructions from the game:
- Supabase hosts the database and the sign-in system. Your email, display name, saves, and leaderboard entries live in a Postgres database there, in the region chosen when the project was created. Supabase processes this data to run the service and for nothing else.
- Resend delivers the sign-in emails. To send you a link, it necessarily handles your email address and the message containing the code.
- Vercel serves the website files. Like any web host, it processes the requests your browser makes, including your IP address, as part of delivering the page.
- Google is involved only if you choose "Continue with Google", in which case Google confirms your email address to the sign-in system. The game asks for your email and basic profile and nothing further.
Every row in the database is locked to its owner at the database level. One player's account cannot read another player's saves, email, or anything else. The only thing any other player can see about you is the display name you chose, next to a score you chose to submit.
What never happens
- Your data is never sold, rented, or traded. There is no business model here that would want it.
- There are no advertisements anywhere in Bit Cryptic, and no ad networks are loaded.
- There are no third-party analytics or tracking scripts — no Google Analytics, no pixels, no tag managers, no session recorders.
- Nothing about your account is shared with anyone outside the providers listed above, except where the law leaves no choice.
- Your email address is never shown to other players, and never used for marketing.
- Nothing you type into a clue is transmitted anywhere. Solving happens entirely in your browser.
Cookies and local storage
Bit Cryptic sets no tracking cookies. There is no cookie banner because there is nothing to consent to.
The game does use your browser's localStorage, which stays on your device and is never transmitted on its own:
- Your saves, so guest play works and signed-in play works offline.
- Your sign-in session, if you have an account, so you are not asked to sign in on every visit.
- Small preferences, like whether you chose the light or dark theme and whether you have already seen a particular prompt.
- Anonymous gameplay counters used to tune puzzle difficulty — which screens were visited, how long a session ran. These are deliberately excluded from cloud sync, are tied to no identity, and never leave your device.
Clearing your browser storage clears all of it. If you have an account, signing back in restores your saves from the cloud.
Getting it back, or gone
These are buttons in the game, not a form you send off and wait on. Open the account panel from the World's settings or the Tower's main menu when signed in.
- Download my data — gives you a JSON file with your profile, both games' saves, and any leaderboard entries. Everything the account holds, in one file, immediately.
- Change your display name — any time, as often as you like.
- Delete my account — type DELETE to confirm, and your profile, both saves, and your leaderboard entries are erased permanently. There is no undo and no soft delete. Progress already on your device stays where it is and keeps working, signed out.
Deleting also removes your leaderboard entries. Keeping an "anonymised" score would mean keeping a record of someone who asked to be forgotten, which is the opposite of what was asked.
If deletion ever cannot finish cleanly — a sign-in record left stranded by the provider, say — the game tells you so honestly rather than claiming success, and you can write to the address below to have it swept manually.
Depending on where you live, you may also have rights to access, correct, or restrict the use of your data, and to complain to a data protection authority. The export and delete buttons cover the first two directly; for anything else, write and it gets handled.
Age
Accounts are for players 13 and up. Younger puzzlers are welcome to play as guests — nothing is collected.
Bit Cryptic does not ask for a date of birth. Guest mode is the full game, so a younger player misses nothing but the cross-device saves.
If you believe a child under 13 has created an account, write to the address below and it will be deleted.
How long things are kept
Account data is kept while the account exists, because a save you cannot come back to is not a save. Delete the account and the rows are gone at once.
The short-lived request counts used for rate limiting age out on their own. Sign-in links and codes expire within the hour and work once.
Security
Every table is protected at the database level so an account can only ever reach its own rows; saves can only be written through a single checked path; there are no passwords to steal; and the site loads no third-party scripts, so there is no outside code running next to your session.
No website is unbreakable. Bit Cryptic holds an email address and some puzzle progress, which is about as unattractive as a breach target gets, but no system is perfect. If something ever went wrong with your data, you would be told, plainly, on this domain.
The leaderboard is a social scoreboard, not a competitive ladder — scores are reported by the game running in your browser, so they are tamper-evident rather than tamper-proof. That is stated here for the same reason as everything else on this page.
Changes to this page
If what the game collects changes, this page changes first, and the date at the top changes with it. If a change is significant — a new category of data, a new provider — it will be announced in the game rather than quietly edited in.
Contact
Bit Cryptic is made and run by one person, not a company. Questions about privacy, requests, or anything that looks wrong go to:
team@bitcryptic.org
Also see the terms of use.