Security and privacy
What we collect, what we do not, and the choices we made about where data lives.
The browser never talks to the database
Every read and write goes through a server route that checks who is asking. That is an architectural decision rather than a configuration one: there is no key in the page for anybody to find, and no table a browser can reach directly even if it tried.
Scoring happens on the server
Answers are checked and timed server-side, and scores are submitted once, at the moment a game finishes. A browser cannot post a score, which is why the leaderboard means anything.
Analytics are off until you say otherwise
Nothing is captured before you choose. After you do, capture is deliberately narrow — links, buttons and form submissions — with typed input, session replay and performance capture all off. We also learned this one the hard way: automatic capture once recorded the label of whatever was clicked, and on an answer button that label is the answer. It was changed the day we noticed.
- Direct identifiers are never written to logs — not email, not display name, not an answer.
- Deleting your account deletes what it held, including an uploaded photo rather than only the record of it.
- A photo is served through a short-lived signed link, and only to people who share a team with you.
Reporting something
If you find a problem with any of this, tell us through the contact page and we will answer. We would rather hear it from you than read about it later.