Privacy

What What we store

• Your email address, encrypted (AES-GCM) before it is saved. We look it up with a keyed hash, so the address itself is never stored in readable form.
• The name you pick and your friend code.
• Your game progress: coins, best scores, play counts, daily scores and streak.
• Your friends list and pending requests.
• Anonymous usage counts (for example "a game of Tally finished in 2 minutes"), tied to a random device id. No IP addresses are stored.

Sign-in codes and session tokens are stored only as hashes and expire (codes after 10 minutes, sessions after 30 days).

Why Why we need it

• Sign-in: we email you a 6-digit code. There are no passwords.
• Friends: friends can find you by your friend code or your email. They only ever see your name, friend code and best scores, never your email.
• Notifications: friend requests and challenges are emailed to you. You can switch these off in your profile at any time.

Where Where it lives

Your data is kept in a Cloudflare D1 database (encrypted at rest by Cloudflare too). Emails are sent through Amazon Web Services (SES). We do not sell or share your data, and there are no ads or trackers on this site.

Without an account, your progress stays in this browser only.

Delete Deleting your account

Open your profile and tap Delete account. This erases your account, email, name, friends, synced progress and the usage counts tied to your account, straight away. (Technically: DELETE /api/me.) Progress saved in your browser stays until you clear it.