Privacy

Last updated: 18 October 2026. This page describes what actually happens today; it will be updated before advertising is switched on.

No account needed

You can play everything without signing up. An account is optional; it keeps your results on every device and puts you on the leaderboard.

If you sign in

You can sign in with Google or with a one-time code sent to your email address.

• What we keep: your email address, the name and picture Google shares if you use Google, a random nickname shown on leaderboards (you can change it), your round scores, daily totals, points and streaks, and sign-in sessions. They are stored in a Cloudflare D1 database.
• Sign-in codes are sent through Resend, which receives your email address and the message. The code is stored only as a hash and expires after 10 minutes.
• Bot protection: the sign-in form uses Cloudflare Turnstile, which checks your browser for signs of automation.
• Leaderboards show only your nickname and scores, never your email or Google name.

To delete your account and everything linked to it, write to hello@drawborders.com from the address you signed in with.

Contact form

Messages sent through the contact page (with the email address you give) are stored in our database and forwarded to our inbox so we can reply.

What is stored in your browser

Your daily results, streak, stars, experience points, language setting and a random device identifier are stored in your browser’s local storage under the key drawborders.progress. The identifier is a random string; it is not derived from you or your device and is used only to keep one result per device for a daily puzzle. Clearing site data removes all of it. Nothing in local storage is sent to us unless you sign in; then your earlier daily results are copied to your account once.

What reaches our servers

The site is served by Cloudflare. Like any web server, it receives your IP address, browser type and the pages you request, and keeps short-lived technical logs for security and reliability. Terrain tiles are currently loaded from Mapterhorn, which likewise sees the tile requests your browser makes.

Your drawings are scored inside your browser and are not uploaded; when you are signed in, only the scores are.

Games embedded in Cozcade

The dedicated /embed/ pages do not load optional analytics, advertising, account sign-in or our usage-count beacon. They send Cozcade a ready message containing the interface language and build revision, without a player identifier or score. Terrain tiles still come from Mapterhorn, and Cloudflare serves the game and map data. Local progress and audio preferences are optional; if storage is blocked, play continues in memory until the page closes. Embedded progress may be partitioned by your browser and is not promised to sync with the main site.

Our own usage counts

To see how many people play and where they stop, the site counts a few steps itself: a page visit, starting a game, finishing the first round, finishing a daily or rush, sharing, and starting or completing sign-in. No cookie or other identifier is stored on your device for this. Our server combines your IP address and browser name with a random key that changes every day (UTC) and keeps only the resulting code, so a visitor counts once per day and cannot be recognised on another day. The daily key is deleted after two days, the individual counts after 90 days; only daily totals by language, country (from your IP address, not stored on its own), device type and the site that referred you are kept.

Analytics

We use Google Analytics 4 and Microsoft Clarity to understand which pages and rounds are played and where the game is hard to use. Clarity records anonymised interaction data (clicks, scrolls, mouse movement) and may replay sessions; it does not see what you type. Google Analytics uses cookies and Google processes the data; see Google’s privacy policy and Microsoft’s privacy statement.

If you are in the European Economic Area, the United Kingdom or Switzerland, analytics cookies are off by default and Clarity does not load until you give consent. You can block both at any time with your browser’s tracking protection or an ad blocker; the game works the same.

Planned, not yet active

• Anonymous daily statistics (your total for the day and the device identifier) so we can show where your score ranks.
• Advertising (Google AdSense) outside the map area, with a consent request where the law requires it.

Children

The game is suitable for all ages and can be played fully without an account. Accounts are not intended for children under 13 (16 in the European Economic Area).

Your rights and contact

If you have no account, we hold no personal data about you beyond short-lived server logs. If you have one, you can ask for a copy of your data or for its deletion. For either, or any other question, write to hello@drawborders.com.