Privacy Policy
Effective 8 September 2026
Beat the Bots is a free daily puzzle made by one person. This page says what we keep about you, why, and how to get rid of it.
The short version: play without an account and we store nothing about you. Sign in and we keep your email address, your guesses and your scores. No ad trackers run on the site, page views are counted without cookies, and your data is never sold or shared beyond the services that run the game.
What we collect
Playing without an account
Nothing is stored about you. Your guesses are checked and forgotten. Only the ordinary server logs described below are written.
Your account
Signing in with a magic link gives us your email address. If you sign in with Google, Google also sends the name and profile picture on your Google account. They are kept with your account and not shown anywhere. We never see your Google password.
Your play
Each guess you make on each day's puzzle, whether it was right, and the order you made them in. From those we keep your games played, wins, streaks and best results. We also keep the nickname you choose for the leaderboard and your votes on the Vote page.
Server logs
The services that host the game record each request: the requesting IP address, the browser type, the time, and the page or picture asked for. We use these to keep the game running and to spot abuse. They age out on their own within about a month.
If you write to us, we keep the conversation so we can answer you.
What we do not do
- No advertising or tracking scripts. Vercel Web Analytics counts page views and where visitors arrived from; it sets no cookies and does not identify you.
- No cookies of ours. Your sign-in lives in your browser's local storage, described below.
- No selling, renting or trading of your data, ever.
- No payment details. Coffees bought through Ko-fi happen on Ko-fi's site under Ko-fi's own policy.
Who handles your data
A few services run the game. Each sees only what it needs for its job.
- Supabase stores accounts, signs you in and holds your game data.
- Resend delivers the sign-in emails, from login@beatthebots.ai.
- Google Cloud runs the game's server and keeps its logs.
- Vercel serves the pages, caches the puzzle pictures and counts page views.
- Google handles the sign-in if you choose to continue with Google.
- OpenAI creates each day's theme, words and picture, and plays the round as the Bot. It never receives anything about players.
- Google Fonts, Font Awesome and jsDelivr deliver the fonts, the icons and a script library. Your browser fetches those directly, so those services see the request, as with any web page.
What is public
The leaderboard shows your nickname and your results. Until you pick a nickname in Settings it shows a placeholder made from part of your account id. Your email address is never shown to other players.
On your device
Your browser's local storage holds your sign-in token, your account id and email address, a note that you have seen the welcome message, and a short notice for the page after a sign-in problem. Clearing the site's data in your browser removes all of it and signs you out on that device.
How long we keep it
For as long as you have an account. Deleting your account in Settings removes your account and email address, your nickname and leaderboard position, your stats, streaks and puzzle history, and your style votes, immediately and for good. Server logs age out on their own.
Your choices
- Play without an account.
- Change your nickname or delete your account at any time in Settings.
- Email us to ask what we hold about you, to correct it, or to have it removed. If you live somewhere with data protection law, such as the EU, the UK or California, these are the rights it gives you, and this is how you use them.
Children
Beat the Bots is not directed at children under 13, and we do not knowingly keep their data. If you believe a child has made an account, email us and we will remove it.
Changes
If this policy changes, the new version goes up here with a new date at the top.