Privacy Policy

The Chains (“we,” “us”) is a daily NFL connection puzzle available at chains-game.com. This policy explains what information we collect, why, and the choices you have. Questions or requests: admin@chains-game.com.

What we collect

If you play without an account: your game progress, settings, and daily-completion status are stored only in your browser's local storage on your device. We don't receive your name or contact information. We do receive anonymous usage analytics (only if you accept non-essential cookies, see our Cookie Policy) and anonymous gameplay telemetry (described below).

If you create an account: new accounts sign up with Google only, for stronger security: we collect the email address on your Google account, along with basic Google profile info. Accounts created before Google-only sign-up went live may still have a password on file, handled and stored (hashed) by our authentication provider, Supabase; we never see or store it in plain text. Those accounts are asked to link a Google account the next time they sign in, after which the password stops working entirely.

Username: every account holder chooses a username to appear on leaderboards and to friends. Your username is public: it's visible to anyone who views the global leaderboard, including people who aren't signed in. Don't use your real name or other identifying information as your username if you'd rather it stay private. We screen usernames for profanity and impersonation on a best-effort basis (see our Terms of Service); it isn't a guarantee every offensive name gets caught, which is why we also offer a Report option on the leaderboard.

Two-factor authentication: if you enable an authenticator app (TOTP), the shared secret is generated and stored by Supabase. If you instead choose an emailed one-time code, that code and your email address are sent through our email-delivery provider, Resend, solely to deliver the code to you.

Gameplay history: puzzles played, links used, scores, streaks, badges, and whether a hint was used on a given puzzle, linked to your account so it syncs across devices. Whether you used a hint is stored for our own records (e.g. to keep hinted runs out of certain leaderboard views) and is never shown to other players.

Friends & social stats: if you send or accept a friend request, we store that connection. Accepted friends can see each other's streak, best score, and games-played counts for each mode. You can remove a friend or block another player at any time, which also stops them from sending you new requests.

Leaderboard: if you're signed in with a username and solve a puzzle without using a hint, your username, score, and rank appear on the relevant leaderboard(s): the global board is visible to anyone, signed in or not; the friends board is visible only to your accepted friends. There's currently no way to opt a solve out of the leaderboard short of not signing in.

Gameplay telemetry: when a puzzle is completed, we log which players were used in the chain and which guesses were made. We use this in aggregate to improve puzzle difficulty and the rarity system. Telemetry is not used to identify you.

Feedback and reports: if you submit the feedback form, including reporting a username from the leaderboard, we receive what you wrote (for a report, that includes the reported player's username and internal ID) and, only if you choose to provide it, your email address.

Analytics: we use Vercel Web Analytics, a privacy-focused service that reports anonymous, aggregated page views and visit counts and does not track you across other websites. It only loads after you accept non-essential cookies in the banner. See our Cookie Policy.

Advertising: the game is funded by ads served through Google AdSense. AdSense may set cookies to serve and measure ads and, depending on your Google account settings and location, to show ads based on your activity across sites that use Google's advertising services. Like analytics, ads only load after you accept non-essential cookies in the banner; if you reject or never respond, you'll see the site's plain ad placeholders instead. You can review or change how Google personalizes ads to you at adssettings.google.com, and see how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

What we don't do

We do not sell your personal information. We do not share it with third parties for their marketing. We do not knowingly collect information from children under 13; the site is not directed to them. If you believe a child has provided us personal information, contact us and we will delete it.

Services we rely on

The site is hosted on Vercel, which also provides our optional analytics. Supabase provides accounts, our database (gameplay, friends, and leaderboard data), and multi-factor authentication. Google provides sign-in (required for new accounts, optional in that having an account at all is optional), the fonts we use, and, via AdSense, the ads that fund the game; like any web request, Google receives your IP address when your browser loads a font or an ad. Resend delivers the emailed two-factor code, for those who choose that method, and sees only the recipient address and the code itself. Each provider has its own privacy policy governing its own processing.

Data retention & your choices

Account data is kept while your account is active. You can request a copy of your data or deletion of your account and associated data (including your username, gameplay history, and friend connections) at any time by emailing admin@chains-game.com from the address on the account; we will act on verified requests within 30 days. You can clear device-local data anytime via your browser settings. Depending on where you live, you may have additional rights (such as access, correction, deletion, or portability) under laws like the GDPR or the California Consumer Privacy Act; we honor verified requests consistent with those laws.

Changes

If we make material changes to this policy, we'll update the date above and note it in the site's patch notes. Continued use after changes means you accept the updated policy.