Privacy

Short version: you don’t need an account, and there are no ads and no tracking cookies. If you choose to sign in, we keep a little more, listed below, and you can delete it whenever you like. Here’s everything the game keeps.

On your device

Your browser remembers a few things so you don’t have to type them again:

  • The name and avatar you picked (up to 14 characters, whatever you typed).
  • A random ticket for each room you join, so a page reload puts you back in your seat.
  • Your boards for the Mini, the Daily and the Big one, and your results for each day, for your streak and your stats page.
  • Which achievements you’ve unlocked and which tiles, background and avatar you picked.
  • How many Solo boards and games with friends you’ve finished, and how many challenge links you’ve sent.
  • How many days you’ve visited, so we only suggest adding the game to your home screen once you’ve come back, and whether you said no.
  • Your preferred language, word pack and sound setting.

All of it sits in your browser’s local storage. Clear the site data and it’s gone. None of it is sent anywhere except to run the game.

Challenge links

When you challenge a friend, the link you send has your score and the name you typed in it, so they can see who dared them. That’s the only thing that leaves your device, and only because you sent it. We tidy up names in links and swap anything rude for “A friend”.

On the server

While a room is open, the server holds the room code, the players’ names and avatars, the puzzle and the moves, because that’s the game. Rooms close 30 minutes after the last person leaves and then all of that is deleted. Solo and the three dailies run entirely in your browser and don’t talk to the server at all, unless you’re signed in (see below).

Like any web server, ours sees your IP address while you’re connected. We use it only to stop abuse (one address opening hundreds of rooms, say) and don’t keep it for more than a few minutes.

If you sign in

Signing in is optional and only for people 13 or older. It lets your progress follow you between devices and adds friends and weekly leagues. When you sign in, our server keeps:

  • Your email address (or, if you use Google or Apple, the ID they give us for you and the email they share).
  • The name and avatar you pick. Friends and people in your league can see them.
  • A copy of the progress described above (results, streak, achievements, collection, counters), so it can sync.
  • Who your Crosspeek friends are: people you finished a room game with while you were both signed in, or who used your invite link.
  • Your weekly league points and which league you’re in. To check a daily result, your device also sends the moves behind it (which tiles you peeked and what you guessed). We play them back to check the score, then throw them away.
  • A random sign-in cookie, so you stay signed in for up to 90 days. We only store a scrambled copy of it. It can’t be read by the page’s scripts and isn’t used for anything else.
  • If you turn them on: your reminder time and time zone, and the address your browser gives us for sending notifications. Also whether you want the weekly email.
  • If you report a name: that you reported it, so nobody can report the same name twice.

We don’t keep passwords (there aren’t any), your location, your contacts, or what you do outside the game. We don’t sell or share any of it, and we never show ads.

On your account page you can download everything we hold about you as a file, and delete your account. Deleting removes all of it from our server straight away. What’s on your device stays until you clear it.

Emails and notifications

We only email you a sign-in link when you ask for one, a link to confirm a new address when you add one to your account, and a short weekly round-up if you turn it on. Every weekly email has a one-click unsubscribe link. Daily reminders are off unless you switch them on, come at most once a day, and skip days you’ve already played.

A robot check on the sign-in form

Some copies of Crosspeek add a robot check to the “email me a sign-in link” form, so bots can’t use it to flood people’s inboxes. It’s either Cloudflare Turnstile or Google reCAPTCHA, and it only loads on that form, nowhere else in the game. It looks at your browser and how the page is being used to guess whether you’re a person, and tells our server yes or no. Turnstile doesn’t set tracking cookies; reCAPTCHA is covered by Google’s own privacy policy. If it’s off, nothing like this loads at all.

A visitor counter

If whoever’s running this copy of Crosspeek turns one on, it’s a cookie-free counter — Plausible or GoatCounter. It counts visits and a few plain events, like “a puzzle was finished” or “a challenge link was sent”. It never knows who you are, never follows you around the web, and doesn’t use cookies to do any of it. If it’s off, nothing like this runs at all.

Third parties

The two fonts come from Google Fonts, so your browser fetches them from Google when the page loads. If you use “Continue with Google” or “Continue with Apple”, their sign-in button loads from them and they know you signed in to Crosspeek. Sign-in emails go through our email provider, and notifications go through your browser maker’s push service (Google, Apple or Mozilla), because that’s how notifications work. That’s all, apart from the robot check and the visitor counter above, if they’re switched on.

Kids

The game never needs personal details, and every word pack has been checked for anything rude or scary. Accounts are for people 13 and over; younger players can use everything else without one. Anyone you share a room code with can see the name you picked, so use a nickname you’re happy with. Names on leaderboards are screened for rude words, and anyone can report one.

Questions

If anything here isn’t clear, ask.

Back to the game