Privacy Policy

Last updated 8 September 2026

Eureka has no accounts. You never give us a name, email address, or password, and there are no analytics or tracking scripts on the site. This page describes the small amount of data the game does handle.

What stays in your browser

Three things are kept in your browser’s local storage and are never sent anywhere:

• A random player ID — a randomly generated identifier (a UUID) created the first time you play. It is how your statistics page knows which past results are yours. It is not derived from anything about you and is not linked to your identity.
• Today’s game — the names you have guessed so far and whether you have finished, so a refresh doesn’t lose your progress. It is replaced each day.
• A “seen the how-to-play screen” flag, so it only opens automatically once.

Clearing your browser’s site data for Eureka erases all of this, including the player ID.

What is stored when you finish a game

When a game ends, one row is saved to our database containing:

• the puzzle’s date and number, whether you won, how many guesses you used, whether you revealed the answer, a match-accuracy figure, and how long the game took;
• your random player ID (above), so your statistics page can retrieve this result later;
• a salted SHA-256 hash of your IP address — not the IP address itself. This is a one-way fingerprint that cannot be turned back into an address or tied to you personally. It exists only so we can detect and slow down abuse, such as a flood of automated results, and it is deleted about 30 days after the game.

The raw IP address is never written to the database. Your player ID is what identifies your results; the IP hash is never used to look up or display anyone’s statistics.

Your statistics page only ever loads rows that match the player ID your browser sends. You cannot see anyone else’s results, and no one can look up yours without that ID.

Advertising

Eureka does not currently show any ads, and sets no advertising cookies. If that changes, this page will be updated first to name the ad provider and describe exactly what it stores.

Other services involved

• Supabase hosts the database described above, as our data processor.
• Vercel hosts and serves the site, and keeps standard, short-lived request logs (IP address, timestamp, page requested) as is normal for any web host.
• Wikimedia (Wikipedia) — after a game ends, your browser fetches the person’s photo directly from Wikipedia’s servers, so Wikimedia receives your IP address and the article requested. The “Read the full story on Wikipedia” link also goes to their site.
• Google Fonts — the site’s typefaces load from Google’s font servers, which receive your IP address when the page loads.

Removing your data

Clearing your browser’s site data removes your player ID, which makes any results already stored permanently anonymous — even to you. If you would like the stored result rows themselves deleted, email the address on the contact page with the player ID you want removed and we will delete every row for it.