Privacy Policy

What we collect

• Account details: your email address, the display name you choose, your age bracket (13–17 or 18+, never your birthday), whether Incognito mode is on, your appearance settings (theme, accent colour, whether Tile the mascot shows), and an account ID and friend code we generate.
• Signing in with Google or GitHub: they send us your email, name and profile photo. We keep only the email and an ID that links your Hardset account to theirs. We don't store your name, your photo or any access to your Google or GitHub account.
• Guest play: playing as a guest creates an account with no email. If you sign up later, your progress moves to your new account.
• Puzzle activity: the problems you open and the answers you submit, with times, scores and hints used; your ratings and their history; skill game sessions; your “how hard was it?” answers; friends and friend requests; players you've starred as favorites; duels, weekly boss entries and league places; your Study answers and timed tests; whether you're in FBLA mode; problem reports; and messages you send us.
• Party mode: hosts need an account. Players join with a code and a nickname, without an account: we store the nickname, their answers and scores for that party, and a random token that keeps them in the game. Nothing links a party player to a Hardset account.
• Security records: each sign-in session records your IP address and browser type (user agent). If you turn on two-factor authentication, we store its secret and backup codes. We also keep short-lived counters, by IP address or account, to limit how often things like sign-in can be tried.

We don't collect real names, birthdays, phone numbers, contacts, precise location or payment details.

Cookies and storage on your device

• Sign-in cookies keep you signed in, and briefly secure a Google or GitHub sign-in while it happens. They're essential, and Hardset sets no other cookies.
• Your browser's local storage remembers which “What's new” update you've seen and any notes you type in a puzzle's notepad, which stay on your device and are never sent to us. When you join a party, it also keeps your player token so a refresh doesn't drop you from the game.
• Analytics: Vercel Web Analytics counts page views without cookies. It doesn't identify you or follow you to other sites.

How we use it

• To run Hardset: sign you in, serve puzzles, score answers, and keep your ratings, streaks, leaderboards, friends, duels and leagues.
• To keep play fair and accounts safe. Answers faster than a person could plausibly give score zero and go to a person for review, who can restore the score. Session records help us spot cheating and one person running several accounts.
• To set puzzle difficulty, using everyone's results and “how hard” answers together.
• To answer messages you send us.
• We don't send you email. If we ever add reminder emails, you'll have to choose to receive them.

We don't use your data for advertising, and we don't share it with advertising networks, even when we advertise Hardset on other sites.

Who can see what

• Everyone, on public leaderboards (daily, all-time, category ratings and weekly boss): your display name with your scores, times, hints or rating. Turn on Incognito mode in Settings to leave them.
• Your league group (up to 30 players): your display name, weekly points and problems solved. Incognito players aren't placed in leagues.
• Friends you've accepted: your display name, daily scores and streak, even with Incognito on, and your result in a duel once they've played it too. You can remove a friend at any time.
• People who star you as a favorite see only what the public leaderboards already show, on a board of just their favorites. They aren't able to star you while you're in Incognito mode or under 18, and if you turn Incognito on you drop off their board. Starring is private: nobody is told who starred them.
• FBLA mode is invite-only: an admin adds members by account ID. Members see each other's display names and FBLA test scores on the FBLA leaderboard, which only members can see. You can leave FBLA mode at any time from the FBLA page.
• In a party, the host and the other players see your nickname, your score and your place. The host can remove a player.
• Under 18s: 13–17 accounts are left off public leaderboards and leagues by default, and appear as “Anonymous” if they join them. Friends still see their display name.
• Things you share: challenge links and result images show the puzzle, your time and points, never your name or email. Who sees them is up to you.
• Hardset admins: a small number of people who run Hardset can see account activity, to review cheating and help with problems. Admin access needs two-factor authentication. Admin tools never show IP addresses, and show an email address only when an admin asks for it, which is logged. If an admin changes your display name or age bracket, or resets a problem for you, you'll see a notice in the app.
• Our service providers (below), only to run Hardset for us.
• Authorities, only if the law requires it or to protect someone's safety.

We never sell personal information.

Service providers

These companies process data on our behalf, only to provide their service to us:

• Vercel hosts the site and provides the cookie-free page-view counts.
• Neon hosts our database.
• Upstash stores the short-lived rate-limit counters.
• Google and GitHub, for signing in.

Data is stored and processed in the United States. If you use Hardset from another country, your data is transferred to the United States so we can provide the service, and the rights described below apply to you wherever you live.

How long we keep it

• Account details and activity: until you delete your account.
• Guest accounts: deleted after 30 days without use.
• Parties, with every nickname, answer and score in them: deleted 24 hours after the party is created.
• Sign-in sessions: they expire 7 days after you last use Hardset.
• Messages to us: until we've dealt with them, then deleted within 90 days. That includes any email address you left for a reply.

Deleting your account removes it, and everything above, from our live database straight away. Copies can remain in our database provider's backups for up to 30 days before they're overwritten. A few things are kept after deletion because they don't identify you:

• Our security log, which records actions like sign-ins and admin changes against an account ID. It never holds your email address or display name.
• Problem reports you filed about a puzzle, with the link to your account removed.
• Puzzle difficulty figures, which are calculated from all players' results together.

Your choices and rights

• In Settings you can change your display name, turn Incognito mode and two-factor authentication on or off, download all your data as a JSON file, and permanently delete your account.
• For anything else, such as correcting your age bracket or questions about your data, contact us. We reply within 30 days.

Depending on where you live, for example in the EU, the UK or California, the law gives you rights to access, correct, delete and take a copy of your data, and to object to or limit how we use it. We honor these requests from everyone, wherever you live. You can also complain to your local data protection authority. Since we don't sell or share personal information for advertising, there's nothing to opt out of there.

Children and teens

Hardset isn't for children under 13. If someone tells us at sign-up that they're under 13, we delete the account immediately. If you believe a child under 13 has an account, contact us and we'll delete it. Accounts for 13–17 year olds get the extra protections described under “Who can see what”.

Security

Sign-in goes through Google or GitHub, so we never store a password, and two-factor authentication is available to everyone. Connections are encrypted, puzzle answers are checked on our servers, and admin actions are logged. No system is perfectly secure, but we work to protect your data and keep only what we need.

Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll tell you in the app before they take effect.

Contact

Questions or requests about your privacy: use our contact form. You don't need to be signed in.