Privacy
Last updated October 8, 2026
Spellway is a daily word puzzle. We collect as little as we can: anonymous play counts (below) if you play without an account, and what's needed to save your games if you sign in.
Playing without an account
Your games, stats and settings are saved in your browser's local storage, on your device. They are never sent to us. Clearing your browser data deletes them, and some browsers clear them after a while without a visit. If you sign in later, the games saved in this browser are added to your account. Like any website, our hosting provider handles your IP address and browser details to deliver the pages, and may keep them briefly in its logs for security.
Signing in
Accounts are optional. If you sign in, we use Supabase to run accounts and store your data. We keep:
- your email address;
- if you use Google: your name, profile picture link and Google account ID, as Google shares them with us;
- each day you've played: your moves, your result and when you last changed it, so your stats and streak follow you to any device;
- whether you've seen the tutorial, so it isn't shown again on another device.
To keep you signed in, a session token is stored in your browser's local storage. We don't use passwords. We only send email when you ask for a sign-in link; it goes out through Resend, which handles your email address to deliver it.
Counting visits and plays
We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't follow you across sites. It tells us things like how many people visited, which pages, and from what kind of device and country.
The game also counts a few moments of play, so we can tell whether puzzles are too hard and whether people come back: starting a day, submitting it (with your score against par, the tiles you placed and the bonus points you took), revealing the answer, sharing, and skipping or finishing the tutorial. Each count carries the day, what happened, whether you were signed in, and a random ID your browser makes for itself, so we can see that the same device played on two days. That ID isn't linked to your account, name, email or IP address, and clearing your browser data replaces it with a new one.
To show the definition of a rare word you played, the result screen sends the words of your path to our database to look one up. They aren't stored or linked to you.
Error reports
If the game hits an error, it sends a report to Sentry so we can fix it: the error itself, where in the game's code it happened, your browser and device type, and which page you were on. It doesn't include your name, account, email, saved games or IP address.
What we don't do
No ads, no tracking cookies, no tracking across other sites, and we never sell or share your data.
Deleting your data
Open the account menu in the game and choose Delete account. That immediately deletes your account and every game saved in it. Signing out removes your games from that device. We keep a nightly encrypted backup of accounts, saved games and play counts, so we can recover them if something goes wrong; each backup is deleted after 30 days, so a deleted account is gone from them within 30 days. Supabase may also keep its own encrypted backups for a short time before they expire.
Children
Spellway accounts are not meant for children under 13, and we don't knowingly collect their data.
Changes and contact
If this policy changes, we'll update the date at the top. Questions or requests about your data: [email protected].