Privacy

Last updated: 13 August 2026

This game is made by one person. What is collected is what the game needs to work, and nothing else.

What is kept

When you open an account: your e-mail address, a name if you choose to give one, and a one-way digest of your password. The password itself is never stored anywhere: it is put through PBKDF2 at 210,000 rounds and only the digest is kept.

While you play: your progress — which file you are in, what you have found, what you have proven, your scores, and the attempts you have finished. This is kept both in your browser and in your account; it is the only way the same file can be picked up on another device.

Technically: one cookie that keeps you signed in, the time and IP address of sign-in attempts (against password guessing), and any error the game hits in your browser.

If you allow it: your address, so we can write when a new file opens. When you gave that permission, from which screen and from which address is recorded too — proving consent is a legal requirement, not a preference.

Play statistics

So that it is possible to see where the game is hard, named events are kept for what you do: which file you opened, which marker you turned over, which deduction you proved, how many attempts the timeline took, which screen you were on when you stopped. These are names, numbers and in-game ids only — no text you typed, no address, no IP.

The purpose is one thing: to see which file nobody gets past and which deduction stays invisible, and to write the next one accordingly. It is not used for advertising, shared with anybody, or sold.

You can turn Anonymous play statistics off in Settings, and then nothing leaves your browser. Records are deleted after 180 days.

What is not kept

No advertising cookies. No third-party trackers. No analytics. We do not ask for your date of birth, your telephone number, your address or any identity document. We never see payment details: when payment arrives, card details stay with the provider and all we receive is the fact that it was paid.

Where it lives

In a PostgreSQL database hosted by Neon, in the Frankfurt (Germany) region. The game itself is served by Vercel. A mail provider is used for sending letters, and receives only your address and the text to send.

For how long

As long as your account exists. When you delete it, your address, your save and your access are removed from the database. Sign-in attempt records are deleted after 30 days and error records after 60. Expired sign-in links are cleared within a day.

Your rights

From Settings → Account, without asking anybody:

• Download your data. Everything held about you, as one file.
• Delete your account. Permanent, and it asks first.
• Turn off e-mail. Every letter also carries a one-click unsubscribe link.

For anything else under the GDPR or Turkey's KVKK, write to the address below.

Cookies

There is one cookie: a signed, HttpOnly cookie that keeps you signed in. Because we use no advertising or measurement cookies, there is no consent banner — without this one you cannot sign in, which makes it strictly necessary.

Contact

info@caseleftopen.com