TYPHOWORKS

The important small print

Your play.
Your privacy.

What stays in your browser, what reaches the server, and how to ask about your data.

Last updated: .

Who looks after your data?

TyphoWorks is operated by Typho, an independent developer based in Indiana, United States. In this policy, "I" means the site operator.

For privacy questions or requests, email [email protected].

What the site uses, and why

Browser player and gameplay
A random identifier saved in your browser connects server-recorded play to a player, even without Google sign-in. The server stores a hash of this browser-player identifier. Depending on the game, records include attempts, actions, scores, timing, puzzle dates, and progress used to validate results and build leaderboards. A random identifier is not the same as fully anonymous data.
Optional Google sign-in
Signing in shares your Google account identifier and verified email with the site. These link your account to saved records and let you return on another browser. TyphoWorks does not receive your Google password. Linking a browser player can import guest gameplay into the account.
Public player information
Display names, avatars, scores, rankings, and gameplay statistics can appear on public profiles and leaderboards. Email addresses and sign-in tokens are not displayed there. Choose a public name that does not reveal private information.
Account features
The server keeps account progress such as T-Coins, unlocks, selected avatars, and mission or achievement-related records so those features work across sessions.
Likes, plays, and polls
Browser-local visitor identifiers support game engagement counts and one-vote-per-browser polls. Game engagement records include a visitor identifier; poll votes store a hashed voter identifier and the chosen option. These identifiers can be reset and do not prove a unique person.
Feedback and email
The feedback form stores your category, message, submission time, and review status. It does not ask for an email address. Emailing the contact address instead shares your sender address and message with the site operator and email service.
Connection and security data
Hosting and API providers receive connection information such as IP addresses and request details when serving the site. The API uses the connecting IP for rate limiting to help prevent abuse.

Browser storage and cookies

Local storage keeps things like tool settings and entered lists, local game saves, browser-player and visitor IDs, and the account session token. Some account information is cached in tab-scoped session storage. Saved tool inputs and local-only game state are not automatically uploaded just because you sign in.

Account sessions currently expire after seven days. Signing out clears the account session, but does not erase server gameplay or reset a linked browser-player identity.

You can clear this site's data in your browser settings. This can remove local saves and access to an unlinked guest player. Clearing browser storage does not delete server records. Ask for server-side deletion separately.

The site's own sign-in implementation uses browser storage rather than an application session cookie. Third-party services may have their own storage or cookie behavior.

This section covers the site's browser-storage practices; there is no separate Cookie Policy. Browser controls can restrict storage or scripts, but doing so may prevent sign-in, saved progress, or other features from working. Local storage can also be subject to consent rules; its use does not by itself establish an exemption.

Analytics and service providers

TyphoWorks uses Cloudflare Web Analytics to understand site traffic and page performance. Its browser beacon reports visit and performance measurements to Cloudflare and can be added through hosting settings rather than the site's source files. Cloudflare says this service does not track individual visitors across its customers' sites. The game's own play counts, likes, poll totals, and leaderboards are separate usage measurements.

The site does not use advertising or marketing trackers. I do not sell player information or share it for targeted advertising.

The site uses GitHub Pages for static hosting and Cloudflare Workers and D1 for its API and database. Optional Google sign-in uses Google Identity Services; some pages also load Google Fonts. The Ko-fi support link takes you to an external service. Visiting those services can share connection details with them and is subject to their own policies.

These providers process information to deliver their services and may process it in the United States or other countries. This policy does not promise that data stays in a particular country. Provider policies describe their own handling of connection data and service records.

Information may also be disclosed when legally required or reasonably necessary to investigate abuse, protect the service, or protect people's rights and safety.

Retention and your choices

Player accounts and server-side gameplay history are kept until a verified deletion request or the relevant feature or site closes. There is no automatic inactivity-deletion schedule. Local saves remain subject to your browser's storage settings.

Feedback, support correspondence, and poll records do not currently have a fixed automatic deletion schedule. Hosting/security logs and provider backups follow the relevant provider's retention practices; no specific log or backup deletion period is promised here.

There is no self-service account-deletion control at present. To request access, correction, or deletion, email [email protected] with the type of request and, if available, your public profile link. Do not send passwords, browser-player tokens, or session tokens.

Deleting a browser save and deleting a server-side player record are different actions. A server-side request may require a way to verify that the player is yours; a lost, unlinked guest identity may be difficult to verify.

Requests are handled manually by email, not through an automatic deletion button. Depending on the laws that apply, you may have rights to access, correct, or delete information, or to object to or restrict certain uses. Contact me to exercise a right or raise a concern. Any applicable legal deadlines and rights still apply; this policy does not limit them.

Children's privacy

TyphoWorks is a general-audience site and is not specifically directed at children under 13. Server-recorded gameplay can use a browser-player identifier even without Google sign-in; not signing in does not make all play local or anonymous.

If you are a parent or guardian concerned about information associated with a child, contact me at the email address above so the concern can be reviewed and any action required by applicable law can be taken.

Policy updates

Changes to this policy will be posted on this page with an updated date. Any additional notice or consent required by applicable law will still be needed; this page is not a request for blanket consent to future data uses.

Need clarification? Contact the site operator.