Your discoveries are yours.

Last updated: September 26, 2026.

Accounts and recovery

Accounts use a username and password. Neon PostgreSQL stores the username, salted password hash and a hash of your recovery code, never a plain-text password or recovery code. An essential HTTP-only session cookie lasts up to 30 days. Signing out revokes that session; password recovery invalidates previous sessions. Keep your recovery code private. We do not provide email-based password recovery.

Game progress

Anonymous play stays in this browser. Signed-in saves use a separate local account namespace. Plus members also store validated puzzle attempts and save timestamps in Neon for cross-device access. No local history is silently merged into another account. Country practice is a separate exercise and does not change daily statistics.

Billing

Creem processes subscription checkout and sends receipts to the email you provide there. We store subscription and customer identifiers, membership state, paid-through dates and checkout references. We do not store card details. Signed webhook notifications update access when payments, renewals, cancellations, refunds or disputes occur.

Service providers and retention

Vercel hosts the app, Neon stores application data, and Creem handles billing. Operational logs may be processed by these providers. Account and cloud-save records remain until account deletion is requested; billing records may need to be retained for applicable accounting obligations. Authentication rate limits use hashed usernames and counters, not raw passwords.

No advertising tracking

No third-party analytics or advertising cookies are enabled. Local game analytics can be removed by clearing site data. City search is performed in your browser.

Contact and deletion

Request account or cloud-progress deletion and ask privacy questions at xreatetop@gmail.com.