The puzzle itself runs in your browser. The shared scoreboard needs a server, so some data does leave your device — this page says exactly what.
Your progress on today's puzzle, your move count, your solve history, your streak, your session token, your nickname, and the color-label setting are kept in this browser's localStorage.
When you solve a puzzle, this is sent so your result can appear on the shared scoreboard: the puzzle date, the sequence of moves you made, and your session token. The move sequence is replayed on the server to confirm the score is real, then discarded — only the final move count is kept.
Your IP address is briefly held in memory for rate limiting and is written to the web server's standard access log.
An account is a nickname and a password — no email, no phone number, nothing else about you. The nickname is public and appears beside your score. The password is never stored: the server keeps only a scrypt hash with a per-account random salt, which cannot be reversed back into your password.
Signing in issues a random session token, held in this browser's localStorage and valid for 180 days. Signing out deletes it on the server.
Use https://puzzle.landready.site. That address is served over HTTPS with a Let’s Encrypt certificate, so your password and session are encrypted in transit all the way to this server.
The older address on port 8080 is plain HTTP and does not encrypt anything. If you signed in there, sign in again on the HTTPS address.
No email address, no real name, no cookies, no analytics, no ad networks, no third-party services of any kind. Your password is never stored in a readable form.
Clearing site data for this page removes everything held locally, including your streak and your session. Your account and its scores stay on the server — sign in again to get them back. To have an account and its scores deleted, get in touch with whoever runs this server.