Privacy Policy

01 Who we are

Greatest Games is published by Analog Insights LLC, a small company in San Francisco, California, and Analog Insights LLC is the “data controller” for everything this policy describes. When this page says “we,” that’s who it means. You can reach us any time via the contact page.

02 What we collect

We keep our records lean and plain. Here is the whole of it.

Game progress (on your device)

Your streak, completed games, and stats are stored locally in your browser so your progress stays yours even without an account.

Settings

Your preferences (reduced motion, contrast, a game's difficulty toggle) live in local storage on your device and never leave it.

Your account

If you sign up, we store your email address, a display name, and the date you joined. Sign in with Google, an emailed magic link, or a password if you set one — passwords are held only as salted hashes by Supabase, our authentication provider; we never see them.

Game stats (when signed in)

Once you have an account, the games you played, whether you solved them, your score, and your per-game streaks are saved to our database so your record carries across devices.

Analytics & event data

Privacy-conscious usage data — which game was played and how it went, plus a hashed (never raw) IP, coarse location (country/region/city), browser/device type, and the site version. For signed-in Google users who consent within Google, Google signals also gives us aggregated, de-identified demographic reporting (broad age, gender, and interest groups) — never tied to an individual. See the next section for who processes it.

03 Analytics & third parties

To understand whether a puzzle landed and to fix what breaks, we record product-analytics events — to our own first-party log and to PostHog, a third-party analytics provider that processes the data on our behalf (servers in the United States). This includes session replay, which reconstructs how a page was used; all text inputs are masked, so anything you type is never recorded. Each event carries an anonymous device and session identifier rather than your name; if you’re signed in, those events are tied to your account so your stats stay accurate. We don’t store raw IP addresses, and we don’t put your email or anything you typed into these events.

We also use Google Analytics 4, loaded through Google Tag Manager, for aggregate traffic measurement — page views, where visitors come from, which games get played. Google Analytics sets first-party _ga cookies to recognise a returning browser, and Google processes this data on our behalf. Where consent rules apply, none of these analytics run until you say yes — see Cookies, storage & consent — and everyone can switch them off from the Cookie Notice page.

We have turned on Google signals in Google Analytics. For visitors who are signed in to a Google account and have consented to it within Google, this lets Google associate their visit here with the information Google already holds — which allows us to see aggregated, de-identified demographic reports: broad age ranges, gender, and general interest categories across our audience. We only ever see these as grouped statistics, never tied to an individual, and Google withholds them entirely for any group too small to be anonymous. We also allow Google Analytics to collect granular (city-level) location and device details, and to use this data for ads personalization in connection with the advertising described below. Signed-in Google users can review and delete this activity at myactivity.google.com and control the association from Google Ads Settings. As with all of our analytics, none of this runs where consent rules apply until you say yes, and you can switch it off from the Cookie Notice page.

04 Advertising

We don’t show ads today. To keep the games free, we’re preparing to introduce a modest amount of advertising served by Google AdSense. When that begins, Google and its certified advertising partners — third-party vendors including DoubleClick — will use advertising cookies to serve ads, and may use them to show ads based on your prior visits to this and other sites. Where consent rules apply, you’ll be asked before any advertising cookie is set.

You can opt out of personalised advertising at Google Ads Settings and, for other vendors, at aboutads.info/choices. When ads launch we’ll update this section to say exactly what runs — and, as with everything on this page, we’ll date the change at the top.

05 Marketing email

If you opt in — by ticking the box at sign-up, on the welcome screen, or from your profile — we’ll send you a short run of onboarding emails over your first couple of weeks (a welcome, then a few notes introducing streaks, other games, and your stats), plus the occasional bit of game news. If your account goes quiet, we may send a single check-in email after about a week away — capped at one such nudge a month. That’s the whole programme. We send all of it only with your consent, and outside consent regions the box is never pre-ticked in the EEA, the UK, or Canada.

These emails are lightly personalised from your own gameplay — your first name, your most-played game, and stats such as points, solves, and your best streak — so the note is about your record rather than a generic blast. We never put anything you typed into a puzzle, or your analytics profile, into an email.

We don’t track whether you open a marketing email. We do measure clicks: the links inside are routed through our email provider’s redirect so we can see which links landed, and they carry utm_ tags so that a visit you make from an email is attributed in the analytics described above. Separately, the account emails that keep the service running — your sign-in magic link, and other transactional messages — aren’t marketing and aren’t governed by the opt-in here; they go to the address on your account because you asked us to sign you in.

Withdrawing consent is as easy as giving it: flip the toggle on your profile, or use the one-click unsubscribe link (and the postal address) at the bottom of every email. Unsubscribing takes effect immediately and stops the entire programme. We record when and where you said yes — the exact wording you agreed to, the surface, and the date — as our record of consent, and yours, and we keep a simple log of which emails we’ve already sent so we never repeat one. The emails are delivered by Resend, our email processor, which holds your address (and a synced copy of your opt-in state, so an unsubscribe there is honoured too) only to deliver on our behalf. Signing up for an account never requires opting in, and saying no changes nothing about how the games work.

06 What we don’t

• We don’t sell, rent, or trade your personal information to anyone, for any price.
• We don’t give advertisers your name, your email, or anything you typed — ever.
• We don’t build our own behavioural profile of you to follow you around the rest of the web.

07 Cookies, storage & consent

We use a small amount of local storage to remember your progress and preferences, a first-party cookie to keep you signed in once you create an account, and analytics cookies — set by PostHog and by Google Analytics — to count visits and stitch a session together. If you visit from the EEA, the United Kingdom, or Switzerland, a consent bar asks before any analytics run, and nothing but the strictly-necessary pieces runs until you answer. Wherever you are, you can switch analytics off (or back on) any time from the Cookie Notice page, which also walks through every item we set.

08 Your rights

Much of what we keep lives on your device, so you’re largely in control already: clear your local data and your streak resets. Deleting your account is self-serve — the Danger zone at the bottom of your profile removes your account, stats, and streaks immediately; gameplay analytics are de-identified rather than kept under your name. For anything else we hold, you can ask us — via the contact page — to tell you what we have on file, correct it, hand you a copy, or restrict or object to how it’s used. We’ll answer in plain language and within a month.

If you’re in the EEA or the UK, those are your GDPR rights, and you also have the right to complain to your local data-protection authority. Our legal bases are simple: we process account data to provide the service you signed up for (contract), and analytics only with your consent or, outside consent regions, under our legitimate interest in understanding our own site. If you’re a California resident, the CCPA gives you the rights to know, to delete, and to not be discriminated against for exercising either — and because we don’t sell or share personal information as the CCPA defines it, there’s nothing to opt out of there today.

09 Contacting Greatest Games

Questions about any of the above go to us directly. We read everything, and we’d genuinely rather hear from you than have you wonder. If we ever change this policy in a way that matters, we’ll date it at the top and say plainly what changed.