Privacy

What stays on your device

Stored in your browser’s local storage, not in cookies, and never sent anywhere except where noted below. Clearing your browser data for this site removes all of it.

byeye.identity.v1

Your player id, the name shown on the boards, and a random secret generated in your browser. The secret is what proves a score is yours. We store only a hash of it, never the value.

byeye.queue.v1

Finished runs waiting to be sent, if a submission failed.

angled · halved · dropped · balanced · counted · timed .daily.v1

Your own results for each game, so the site knows which puzzles you have played. Kept for 60 days, then swept automatically.

halved.settings.v1 · dropped.settings.v1 · freehand.audio.v1

Your sound and reduced-motion preferences.

halved.tutorial.v1 · dropped.tutorial.v1

Whether you have already been shown the coached round.

What reaches the server

When you finish a daily and it is submitted to a leaderboard, plus three smaller things: a tap on a share button, an arrival from a tagged link, and how long a tab was open.

Your player row

An id, the name on the boards, a SHA-256 hash of your device secret, and the date it was created. The name is assigned automatically (an adjective and an animal) unless you change it.

Your score rows

Which game, which puzzle date, the score, and the raw inputs you made during the round: the dial angles, cut positions, called landings and so on. The inputs are kept because every score is recalculated on the server from them rather than trusted from your browser, and so any score can be audited later.

A tap on a share button

Which game it was on and whether the share sheet opened, the text was copied, or neither. That is the whole row: no player id, no address, nothing that could say who tapped. It exists so the site can tell whether sharing is used at all.

An arrival from a tagged link

If the link you followed carried a source tag (a utm_source, the way a post on Reddit or a tweet would), the tag is counted, and remembered in your browser so that your first finished game can be counted against it. The tag is the whole row: no player id, no address. It answers “did that post bring anyone who played?” and nothing about you.

How long a tab was open

The number of seconds this tab was actually on screen, sent when it is hidden or closed, under a random id the tab made up for itself and forgets when it closes. The id is attached to nothing else, not your player row, not a score, not your address, so the row says “someone spent four minutes” and cannot say who.

A hash of your IP address

Salted and hashed, never the address itself, used only to rate-limit name claims. Rows older than an hour are deleted on every request.

What is never collected

No email address, password, real name, phone number, location, contacts or device fingerprint. No advertising or tracking scripts. No cookies. The fonts are served from this domain, not from Google. The one measurement script is Vercel’s, described below.

Who else is involved

The site is hosted on Vercel and its data is stored in a Neon Postgres database. Both keep standard server logs, which include IP addresses, under their own privacy policies. Nobody else receives anything.

Freehand uses Vercel Web Analytics to count page views. It records which pages are visited, the referrer, and a coarse browser, device and country, and it does this without cookies and without an identifier that follows you between visits. It never sees your board name, your scores or anything you type. Its policy is vercel.com/docs/analytics/privacy-policy.

Your control over it

Clearing this site’s data in your browser erases your identity, your history and your preferences. Be aware that it also erases the secret proving the board name is yours: there is no recovery, and the name cannot be reclaimed. That is the trade for not running an account system.

To have a player row and its scores deleted from the server, email hello@freehand.fun with the name shown on your board.

Changes

If Freehand ever adds advertising or any further third-party script, this page will say so before it happens, because several statements above stop being true the moment it does.

Questions or deletion requests: hello@freehand.fun or see contact.