Privacy

Who runs hashword

hashword is run by Jonathon Cauchois, trading as artdecaux. That is the “controller” of your data. You can reach us at [email protected].

hashword is run from the United Kingdom, so UK data protection law (UK GDPR) applies.

The short version

• You can play without an account. We remember your solves against a random id for this browser.
• If you sign in, we keep your email address, a username you choose, and your solves.
• We store how you solved a puzzle (time, hints, checks), not the letters you typed.
• We use Vercel Web Analytics to see which pages are visited. It does not use cookies, and we do not use advertising cookies.
• We don't sell your data, show ads or send marketing emails.
• You can delete your account on your Profile page.

If you sign in

You don't have to sign in to play. If you do, we need your email address to create your account and sign you in. What we keep depends on how you sign in:

• With Google: your name, email address, profile picture link and Google account id. We may also hold the sign-in tokens Google gives us (access, refresh and id tokens).
• With an email link: your email address, and a one-time sign-in token that expires after 30 minutes.

For every account we also keep:

• the username you choose;
• whether you are a player or an admin, and whether the account is active or blocked;
• a session token and its expiry, so you stay signed in for up to 30 days.

Google sign-in

If you sign in with Google, we only ask Google for your basic profile: your name, email address, profile picture and Google account id. We use this, and the sign-in tokens Google gives us, only to sign you in and run your hashword account. We don't use them to reach anything else in your Google account.

We don't sell your Google data, use it for advertising, or share it with anyone other than the services listed under “Who else handles it” below.

Your solves

When you finish a puzzle we record:

• the puzzle date, when you started and finished, and how long it took;
• how many hints you used and how many words you checked;
• whether the solve, and each clue, was perfect, and whether it was a #yolo solve;
• the puzzle layout, and the same counts for each clue.

When you finish a puzzle, your browser sends the completed grid, with a code we gave it when you opened the puzzle, so we can check the solve is real. We check them and do not store the grid. The letters you typed along the way are not uploaded. A solve made without signing in is tied to a random id stored in the hashword_device cookie. A solve made while signed in is tied to your account and to that same browser id.

We do not keep your unfinished puzzles on our servers. They stay in your browser (see below). When you share a result, the text is made in your browser and handed to your share sheet or clipboard, so we don't see where you share it.

Stored on your device only

These are kept in your browser's local storage. Your solves are also recorded with us as described above; your unfinished grid, your streak and your colour scheme are not sent to us.

Cookies

We only use cookies the site needs to work:

We do not write your browser details or your IP address itself into our database. To stop automated abuse, we keep a scrambled (hashed) form of your IP address with a count of the solves sent from it, for up to a day.

Why we use it

Under UK GDPR, the legal bases we rely on are:

• Contract: running your account, signing you in, and saving and syncing your solves once you have an account, because that is the service you asked for.
• Legitimate interests:saving solves made without an account, keeping the site secure, finding and fixing errors, keeping solves for puzzle statistics, and understanding how the site is used. You can object to these (see “Your rights”).

We don't make automated decisions about you or build profiles of you for advertising.

Who else handles it

We use these services to run hashword:

• Vercel hosts the site (hashword.artdecaux.com, also reachable at hashword-three.vercel.app).
• Neon hosts our database, in London.
• Google handles sign-in, if you choose to sign in with Google.
• Resend sends sign-in links when you ask for one (we send no newsletters or marketing) and keeps a record of sent emails under its own retention policy.
• Vercel Web Analytics counts page views and a few game events (such as starting or solving a puzzle). Visitors are identified by a hash of the request that resets daily, not by a cookie. It never receives clue text, answers, letters, email addresses or account ids.
• Sentrytells us when the site crashes. An error report holds what went wrong, the page it happened on, and your browser and device type. Before a report is sent we remove cookies, email addresses, anything after the “?” in a page address, and the contents of what your browser sent us, and we ask Sentry not to keep your IP address. We do not record your screen or your typing.

Our host keeps ordinary request logs, which can include your IP address and browser, for a limited time under its own retention policy.

We do not use embedded video. If we add it, we will update this page first.

Data outside the UK

Our database is hosted in London. Some of the services we use store or process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge) or by the UK’s standard data transfer terms in the provider’s data processing agreement.

How long we keep it

Keeping it safe

The site only works over encrypted connections (HTTPS). Email sign-in links work once and expire after 30 minutes, and we store only a scrambled (hashed) copy of their code. Only admins can reach the admin area.

Deleting your account

You can delete your account from your Profile page. When you do:

• your account, Google sign-in and sessions are deleted, and you are signed out;
• your solves are kept for puzzle statistics but are no longer linked to you or your browser. They are not deleted;
• unfinished puzzles, your colour scheme and the hashword_device cookie stay in your browser until you clear them.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of your data;
• correct it;
• delete it;
• limit how we use it;
• give you your solves in a format you can reuse elsewhere.

Your right to object:where we rely on legitimate interests (see “Why we use it”), you can object at any time, for example to us keeping your solves for puzzle statistics. We will stop unless we have a compelling reason to continue.

Email [email protected] to use any of these rights. There is no download button. We will reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Children

You must be 13 or older to create an account. hashword is not aimed at children under 13. If you think a child under 13 has signed up, email [email protected] and we will delete the account.

Changes

If we change what we collect, we will update this page and the date at the top.