Words Are Snake

Words Are Snake is a browser game. This page explains what data the game collects, why, and how long it is kept.

What we collect

Game sessions and moves

Every game — both the daily challenge and Duel mode — is assigned a random ID with no connection to your identity. The words you submit during gameplay and your scores are recorded under that ID to help us understand how the game is played and improve it over time. This data is kept indefinitely.

Leaderboard initials

Both the daily challenge and Duel leaderboards accept up to three uppercase letters (A-Z, plus Æ, Ø, Å) that appear publicly alongside your score. This limit is enforced server-side. These initials are stored permanently. Do not use your real name or any identifying information. Initials matching a list of offensive terms are not accepted; the same rule applies to the display name you choose for a Duel with a Friend game.

Account (Google sign-in)

If you sign in with Google, we store only an opaque identifier tied to your Google sign-in — never your email address or any other Google profile data — plus the private stats shown in the Account section of Settings once you're signed in (currently your Daily Challenge streak, best streak, and all-time best score). Signed-in Daily Challenge leaderboard submissions are also internally linked to your account, purely so we can keep only your best score of the day on the leaderboard across multiple devices — this link is never shown publicly alongside your score. You can delete your account at any time from Settings; this immediately and permanently removes the account and all of its stats, on every device you've signed in on, and cannot be undone. Leaderboard entries you submitted while signed in stay on the leaderboard — deleting your account only severs that private link, not the entries themselves.

Push notification subscriptions

If you enable daily reminders, your browser generates a push subscription containing a delivery endpoint URL and a pair of encryption keys used to send you notifications securely. We also store your preferred notification hour. All of this is deleted from our server as soon as you turn off notifications in Settings.

IP addresses (rate limiting)

To prevent abuse, your IP address is temporarily stored when you submit words or scores. These records are periodically purged once they are more than 24 hours old.

Legal basis (GDPR)

For players in the EU, the legal basis for each type of processing is:

Game session analytics: legitimate interest in improving the game
Leaderboard submissions: your consent via voluntary submission
Push notification endpoint: your explicit consent via the opt-in prompt
IP addresses for rate limiting: legitimate interest in security and abuse prevention
Client-side error reports: legitimate interest in maintaining and improving the game
Sign-in session cookie: strictly necessary for a service you explicitly requested (signing in) — no consent required
Account identifier and stats: necessary to provide the sign-in feature you requested, or our legitimate interest in offering it

Your rights

Under GDPR you have the right to request access to, correction of, or deletion of your personal data. Because game sessions carry no identity, for most players the only personal data we can act on a deletion request for is a push notification subscription (which you can remove yourself via Settings) or a leaderboard entry you can identify to us. If you've signed in with Google, your account is real personal data too: you can delete it at any time from Settings, which immediately and permanently removes the account and all of its stats — this cannot be undone (Daily Challenge leaderboard entries submitted while signed in remain on the leaderboard, with only the private account link removed). The Account section in Settings already shows you everything the account holds, satisfying your right to access it without a separate export.

To exercise your rights, contact: privacy@sorevage.no

Browser storage

The game stores a small amount of data in your browser's localStorage: your settings (theme, accessibility preferences, animation speed, word preview toggle), your notification preference, your daily results and streak counters, your all-time best score per language, how many times you've replayed today's challenge, and whether you have already submitted a score for today's challenge. It also stores a randomly generated token scoped to today's date, which lets the leaderboard recognize repeat attempts from the same browser as one player so it can keep only your best score for the day — this token is never sent anywhere except alongside a leaderboard submission, and rotates every day, so it can never be used to link your play across different days. Your initials are held in sessionStorage for the duration of your browser session so you do not have to retype them. A version flag is also held in sessionStorage to avoid repeated page reloads when the game updates. None of this data is sent to our servers except when you explicitly submit a leaderboard score.

Cookies

This site sets two kinds of cookies, both strictly necessary for a feature you explicitly requested rather than for tracking or advertising: a short-lived credential (up to one hour) that authenticates your connection to a specific PvP duel you are actively playing, and, if you sign in with Google, a long-lived cookie that keeps you recognized as signed in across visits. Neither cookie is used for analytics, advertising, or tracking you across other sites.

Third-party services

Cloudflare Web Analytics

This site uses Cloudflare Web Analytics to measure page views and performance. It is cookieless and does not track individual users across sessions or sites. Cloudflare collects aggregate data including which pages were visited, the referring URL, device type, browser, and the approximate country derived from your IP address at their network edge. Your IP address is not stored by Cloudflare for this purpose. No advertising or user-profiling takes place. Cloudflare's own privacy policy applies to this data.

Sentry (error monitoring)

This site uses Sentry to capture client-side errors so we can find and fix bugs. When something goes wrong in your browser, we send an error report containing the error message and stack trace, the page you were on (as a general route, e.g. "/pvp/[gameId]", never the specific game or player), your browser and device type, the game's version number, your selected language, and which game mode you were playing. Failed requests to our own servers may also be reported the same way, along with which endpoint failed and its status code — never the contents of what was sent or received. Words you type during gameplay, your leaderboard initials, and any Duel display name are never included. Reports are kept for 30 days. Sentry's own privacy policy applies to this data.

Railway (hosting)

The game is hosted on Railway. Your connection passes through their infrastructure. Railway's privacy policy applies to network-level data.