Privacy policy

This Privacy Policy explains what information Borecade collects, why we collect it, who processes it on our behalf, how long we keep it and the choices you have. Borecade is operated by Corwex (corwex.net), referred to below as "we" or "us". You can reach us at the address on the Contact page.

Playing without an account

Every game can be played without an account. Your best scores, daily results and streak are stored in your browser on your device, not on our servers, and clearing your browser data removes them.

When you play, your browser asks our server for a "run" so that your score can be checked. A run, its score and its duration are kept for a short time, without your name (see "How long we keep information"). To prevent abuse, we count requests per network address; the address is stored only as a salted hash that cannot be turned back into the address, and the counts are deleted shortly after.

Your account

An account is optional. It puts your scores on the leaderboards and keeps your progress across devices. To create one you choose a username and a password and confirm that you meet the minimum age.

• Username: private. It is used only to sign in, is never shown to other players and cannot be changed.
• Password: stored only as a one-way hash. We cannot see it or recover it, so a forgotten password cannot be reset.
• Display name and tag: public. Your display name and a permanent tag of six letters and digits appear wherever other players see you, such as on leaderboards.
• Progress: your scores, best scores, daily results and streak are stored with your account, and the progress kept in your browser is added to it when you sign in.

We do not ask for your email address, phone number or real name.

Friends and online play

If you add friends, we store the friendship until either of you removes it. Your friends can see your display name, your tag and whether you are online, worked out from when you were last active; you can choose to appear offline at any time. When you play a friend online, the match and its moves are stored so that it can be played and checked. A player without an account who joins a match is given a temporary guest identity.

Protection against bots

Creating an account, signing in and starting online play are protected by Cloudflare Turnstile, which checks that a person is using the site. It processes technical information such as your network address and browser characteristics for that purpose only.

Advertising

Borecade is free because it shows ads from Google. Google may use cookies or device identifiers to show ads and measure them. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent first, and ads are not personalised without it. You can change your choice at any time through the consent settings link at the bottom of every page, and learn more about Google's ads at https://adssettings.google.com.

Analytics and error reports

We use Google Analytics to understand how Borecade is used, for example which games are played and how quickly pages load. It uses a pseudonymous identifier and, in the regions above, stores nothing on your device without your consent. When something breaks, an error report (what failed, your browser and the page's address without its query) may be sent to our error tracker, Sentry, without your network address.

Who processes information for us

• Cloudflare hosts the website, protects it from bots (Turnstile) and receives every request, including your network address and browser.
• Supabase runs accounts, scores, leaderboards, friends and online matches.
• Google shows and measures ads, shows the consent message and runs Google Analytics, subject to your consent where required.
• Sentry receives error reports.

Each acts under data processing terms with us. Some process information outside your country, including in the United States, under the safeguards those terms provide.

How long we keep information

• Your account and everything tied to it: until you delete it.
• An account that is never used (no finished game, no streak, no friend and no sign-in): 30 days.
• A guest identity used for online play: 7 days after its last match.
• Online matches: up to 24 hours if never started or left idle, 7 days once finished.
• Runs not claimed by an account: 24 hours. Runs that are not a best score: 7 days. Scores rejected by our checks: 30 days, for review.
• Request counts per hashed network address: up to one day.
• Error reports: 30 days.

Your choices and rights

You can change your display name or password, or delete your account, at any time from your profile. Deleting your account removes it and every score, best score, daily result, streak and friendship tied to it, immediately and permanently.

Because accounts have no email address, write to us from the Contact page with your display name and tag if you cannot sign in and want your account deleted, or if you want a copy of your information. We answer within 30 days. Depending on where you live, you may also have the right to correct your information, to object to or restrict its use, and to complain to your data protection authority.

Children

Accounts are for players who meet the minimum age in the Terms of use: 13, or older where the law of your country sets a higher age for consenting to online services. Anyone can play without an account.

Changes to this policy

If we change this policy, we publish the new version here and update the date at the top.