Privacy Policy

Square One records three kinds of anonymous usage data so the operator can see how much the site is used and which features matter, and so a constructor can see how their published puzzles are being solved. None of it is linked to you.

Visits

When you arrive from a link on another website, one row is written recording: a two-letter country code (derived by our host, Vercel, from the network request — the IP address itself is never read or stored by us), a coarse browser-and-operating-system bucket such as Chrome/macOS, whether the device is a phone, tablet, or desktop, the address of the page that linked to us, and the time. Immediately afterwards your browser reports three more numbers — the width and height of the browser window and its device pixel ratio — which are used to decide which screen sizes the layout has to support.

Navigating between pages within Square One is not logged as a visit; only inbound links from elsewhere are.

Actions

A second row is written when something meaningful happens: signing in, signing up, or signing out; creating, saving, publishing, unpublishing, or deleting a puzzle; exporting a puzzle (recording only the format — pdf, puz, and so on); generating clues or a theme with AI; uploading a word list; updating your profile; and deleting an account. Each row contains only the name of the event, that short qualifier, and a timestamp.

High-frequency actions — autofill runs, word searches, and dictionary lookups — are deliberately not logged at all. Solving is not logged here either; it is covered separately below.

Solves of a published puzzle

When you solve a puzzle on a /play/… link, one row is written recording: which puzzle it was, whether the grid was finished, how long a finished solve took, whether Check or Reveal was used, and — for the squares where you pressed Check or Reveal on a single square or a single word — how many times. This is what lets the constructor of that puzzle see a solve count, a completion rate, a range of solving times, and a heat map of the squares people got stuck on. They see totals across everyone who solved it; they never see an individual solve, and there is nothing on the row that could identify one.

One solve reports a few times — when it starts, when you switch away from the tab, and when you finish — so that a solve you abandon still counts once rather than not at all. To join those reports into a single row your browser makes up a random tag for that one puzzle and that one solve. It is kept in your browser's session storage, which means it disappears the moment you close the tab; it is never written to a cookie or to long-term storage, never sent anywhere but this one address, and never attached to your account. Solving a different puzzle, or the same puzzle in a new tab, makes up a brand-new tag, so a tag cannot connect two solves to each other or to you. The letters you type are never sent — only how many times a square was checked or revealed.

Previewing your own puzzle from the editor, puzzles embedded in other websites, and puzzles scheduled for a later date are not recorded. Solving without an account and solving while signed in produce exactly the same row: the address that receives these reports does not read your sign-in token at all, so it cannot tell the two apart.

What is never in these logs

No IP address, no user id, no email address, no persistent session or device identifier, and nothing about the contents of your puzzles — not titles, clues, answers, or word lists. The functions that write these logs accept no user identity as an argument, and the solve table has no column to put one in, so there is no way to attach one. The same records are also written to our hosting provider's runtime logs.

Who can read them, and for how long

The visit and action logs: only the site operator, through a private dashboard restricted to a single configured email address; the database rejects every other reader.

The solve rows: in addition to the operator, the constructor of that particular puzzle, and only in aggregate. The server checks that the person asking is signed in and owns the puzzle before it answers, and it computes the totals itself — the individual rows never leave it.

There is currently no automatic deletion, so these rows are kept indefinitely. Because they carry no identifier, they cannot be traced back to you — which also means they cannot be selectively deleted on request.

Square One sets two kinds of cookie, and no advertising or cross-site cookies at all.

Authentication (sb-…-auth-token)

Set by our authentication provider, Supabase, only when you are signed in. It holds your session so you stay signed in between page loads. Signing out clears it.

Visit hand-off (sq1_visit_id)

Set for sixty seconds when you arrive from an external link. It carries the row number of the anonymous visit record above so your browser can attach its window dimensions to it once. Your browser deletes it immediately after that single use. It is not an identifier for you, and it is never associated with an account.

A great deal of what Square One remembers about you never leaves your device. It is stored in your browser's local and session storage and is not transmitted to us:

• Your unsaved draft. If you build a puzzle without signing in, the whole thing — grid, clues, answers, and metadata — is held locally so you do not lose it. It is cleared once you save it to an account or start a new puzzle.
• Solving progress. The letters you have entered, your elapsed time, and whether you used a hint, kept per puzzle so you can come back to it.
• The solve tag. The random per-solve tag described in section 1, held in session storage — which your browser empties when you close the tab. It is not an identifier for you, and it is never associated with an account.
• Preferences. Your theme, default grid size and symmetry, editor and solver toggles, and which one-time tips you have dismissed.
• Your own AI key. If you use the AI clue features you supply your own provider API key. It is saved only in your browser. It is sent to our server only as a field in the body of the specific request you triggered, used once to call the provider you chose, and is never written to our database or to any log.

Clearing your browser's data for this site removes all of it — including any unsaved draft and the stored API key.

Some features work by asking another service a question. Each one below is reached only when you use the feature that needs it, and only the word or text that feature is about is sent.

Datamuse (api.datamuse.com)

Word associations, related phrases, and the word-list autocomplete. Receives the word or partial word you are looking up.

Free Dictionary and Merriam-Webster

Definitions and synonyms in the Dictionary panel. Requested by our server, so these services see the word you looked up but not your browser.

MyMemory translation

The Dictionary panel's Translate tab. Receives the word and the language pair.

Your chosen AI provider

Only when you use an AI feature. Our server passes the prompt — built from the answers, clues, and title in your puzzle — plus your own API key, to the provider you selected. What that provider then does with it is governed by its own privacy policy, not ours.

Supabase

Our database and authentication provider. Stores your account and your puzzles.

Google

Only if you choose to sign in with Google, in which case the standard OAuth exchange applies.

Vercel

Hosts the site and provides the performance analytics described above.

If you import a puzzle by pasting a URL, our server fetches that address on your behalf; the site you pointed us at will see a request from us, not from you.

If you create an account we store your email address, the name you gave at sign-up, and a securely hashed password — or, if you signed in with Google, the profile information Google returns instead of a password. Alongside that we keep an optional display name and default author byline, your roaming preferences, the puzzles you save, and any word lists you upload.

Puzzles are private to your account until you publish one. Publishing creates a public link; anyone with that link can solve the puzzle and will see its title, byline, and any notes you attached. If you also mark it public it is listed in the browse directory and included in this site's sitemap for search engines. Unpublishing takes it back down.

If you answer a published meta puzzle correctly, we record your display name and the time you answered so the puzzle's leaderboard can credit you. Wrong guesses are never stored. The constructor of each meta puzzle chooses whether that leaderboard is public or visible only to them; either way you can always see your own entry, and your email address is never shown. If you set a meta answer as a constructor, we store only a hashed form of it — never the answer itself, which is also why we cannot show it back to you.

Account settings has a Delete account control. It permanently removes, in order: every puzzle you have saved, every meta-puzzle answer you have on anyone's leaderboard, every word list you have uploaded along with its entries, your profile row, and finally your sign-in record itself. This cannot be undone and there is no recovery window.

Three things deliberately survive it:

• The anonymous usage rows described in section 1. They contain nothing that identifies you, so there is nothing in them to delete.
• Any feedback you sent us, which lives in a private issue tracker outside the app — see the next section.
• Data held in your own browser. Clear this site's data to remove your drafts, solving progress, preferences, and any stored API key.