Privacy Policy

Overview

This Privacy Policy explains how Spot the Difference ("we," "us," or "our") handles information when you visit the website, play a puzzle, sign in, or contact support. The short version is: you can play the public game without an account; unfinished-round progress and daily-streak data stay in your browser; account data is used to operate account features; and aggregate privacy-first analytics help us understand page visits and performance.

We want this policy to be readable rather than a generic template. If anything is unclear, please send a support request through our Contact page.

Information We Collect

Information you provide. If you create an account, we process your email address, password credentials handled by our authentication system, display name or profile image where the chosen sign-in method provides them, and account preferences. Google or GitHub may share the account information needed for OAuth sign-in. If you submit a support ticket, we process your message, account identifier, conversation history, and any files or screenshot URLs you attach.

Gameplay information stored locally. The public game can be played without registration. Progress for an unfinished browser session, completion state, locally calculated streak information, and similar interface preferences are stored in your browser's local storage. This information remains on your device unless a feature explicitly says otherwise. Clearing your browser storage or using a private window generally removes it.

Technical information. Our hosting and infrastructure providers process request information needed to deliver pages, maintain security, and troubleshoot failures. This can include IP address, request time, user agent, referring URL, status codes, and performance or security events. Application logs may include error details and abuse or fraud signals.

Analytics. Cloudflare Web Analytics is enabled for aggregate page-visit and performance measurement; Cloudflare states that this service does not collect or use visitors' personal data. If Google Analytics or Plausible is additionally configured, the site may send limited interaction events, such as game start, difference found, game completion, hint use, restart, sign-in start, or sign-up completion. These events may include the puzzle title, puzzle difference count, duration, mistakes, hints used, and technical properties supplied by the analytics provider. Our event helper does not queue events when no optional provider is initialized.

Payment information. If a paid feature is enabled, payment details are processed by the selected payment provider. We do not store complete card numbers on our systems. We may receive a limited transaction record, such as an order identifier, amount, currency, status, billing country, and the last digits of a payment method, in order to provide support and reconcile your order.

How We Use Your Information

We use information only for purposes directly connected to operating and improving this site:

• Deliver puzzle pages, images, account features, and support tickets.
• Authenticate users, preserve session state, and protect accounts from misuse.
• Remember local game progress, completion state, and daily-challenge information in your browser.
• Reply to gameplay, privacy, accessibility, security, and content reports.
• Understand aggregate game behavior, diagnose errors, and improve puzzle quality.
• Detect abuse, fraud, automated exploitation, and attacks on the service.
• Meet legal, accounting, security, and record-retention obligations.

Data Sharing

We do not sell your personal information. We do not share personal information for third-party advertising based on online behavioral profiles. We may share information only in these limited cases:

• Service providers: hosting, database, image storage, authentication, email, analytics, payment, security, and support providers process data on our instructions to operate the site. For example, site delivery, storage, and Web Analytics may involve Cloudflare services, OAuth sign-in may involve Google or GitHub, and optional analytics may involve Google or Plausible.
• Legal and safety needs: we may disclose information to comply with law, respond to lawful requests, enforce terms, investigate abuse or security incidents, or protect the rights, property, or safety of users and the site.
• Business transitions: if the site or a relevant business asset is transferred, we may transfer account and operational records under suitable safeguards.
• Anonymized or aggregate data: we may publish aggregate statistics that do not identify an individual user.

Cookies, Local Storage, and Choices

We use browser storage in two main ways. Essential cookies or equivalent session storage maintain sign-in state and protect the service. Local storage preserves gameplay state and site preferences. Optional analytics may use cookies or similar identifiers only when that provider is enabled.

You can refuse or delete many cookies through browser settings and can clear local storage to reset locally saved progress. Blocking essential session cookies may prevent sign-in and support tickets from working, while public gameplay generally remains available.

Data Security

We use HTTPS for site delivery, restrict administrative access, separate public configuration from secrets, and rely on managed security features from our infrastructure providers. We limit administrative processing to purposes such as support, moderation, and abuse prevention.

No internet service can promise perfect security. Please use a strong, unique password or OAuth provider, avoid sharing account access, and report suspected unauthorized activity promptly.

Retention

We keep personal information only as long as necessary for the purposes in this policy. Account records remain while your account is active and for a backup, legal, security, or dispute period after closure. Support tickets remain while a support relationship or legal claim may require them. Transaction records remain as required for accounting and tax purposes. Technical logs are normally kept for a shorter operational period unless needed for security, abuse, or legal investigation. Local gameplay data stays in your browser until you or your browser remove it.

Your Rights

Depending on your location, you may have rights to access, correct, export, restrict, or delete personal information; object to certain processing; and withdraw consent where consent is our legal basis. You may also object to processing for direct messaging where applicable. To exercise these rights, use the Contact page or, if you are signed in, submit a privacy request through the ticket system.

We may need to verify that a request relates to your account. We can decline a request in limited cases, such as when fulfilling it would affect another person's privacy, compromise security, or conflict with a legal obligation, and we will explain the reason where permitted.

Children

The site is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will delete it where we are legally permitted to do so.

International Processing

The site is operated for an international audience. Our providers may process information in the United States and other countries. When required, we use provider safeguards and limit transfers to what is necessary to provide the service.

Changes to This Policy

We may update this Privacy Policy to reflect changes in the site, providers, or law. We will change the date at the top of this page and provide additional notice for material changes where appropriate. Continued use after an update means you accept the revised policy.

Contact Us

For privacy questions or requests, visit the Contact page and submit a privacy request through the support channel described there.