Privacy Policy

Last updated: August 6, 2026

This policy explains how Gipros Web Solutions SARL handles information when you use Wrecksaurus.

Information we process

• Gameplay data: puzzle number, guesses, hints, timing, win or loss, and server-generated session identifiers.
• Device cookie: Wrecksaurus places one random, HttpOnly cookie so a refresh or private tab reconnects to the same daily attempt. The raw cookie is not stored in the database; a one-way HMAC hash is stored.
• Abuse-prevention signature: the server creates a one-way HMAC from limited request information such as IP address, browser user agent, language, and browser platform headers. This is used to prevent repeated clean attempts and protect the leaderboard. It is not used for advertising.
• Browser storage: streak, recent result, and an optional preferred leaderboard nickname are stored in local storage.
• Leaderboard: if you opt in after winning, your nickname and score are displayed publicly.
• Contact messages: name, email, subject, and message.
• Community submissions: proposed phrase, wreck, optional public credit name, optional email, source note, and notes.
• Hosting logs: our hosting and security providers may process standard request logs.

How we use information

We use this information to operate the daily game, restore unfinished attempts, calculate server-verified results, display voluntary leaderboard entries, review community submissions, answer messages, detect abuse, and improve puzzle balance.

Sharing

We do not sell personal information. Public leaderboard nicknames and scores are visible to visitors. Information is processed by Infomaniak as needed to host the service and by Cloudflare when enabled for delivery and security. Social networks receive information only when you choose to use a sharing feature or visit their service.

Retention

Game sessions normally expire after 48 hours. Completed gameplay statistics and public leaderboard entries may be retained for historical statistics until they are no longer useful or removal is requested. Contact messages and community submissions are generally retained for up to 24 months, or longer when reasonably needed to handle a request, document permission, or protect the service.

Your choices

• You can play without an account and without posting a public nickname.
• You can remove the Wrecksaurus cookie and local storage through your browser settings. Doing so may reset local streak display, but the anti-abuse signature may reconnect the same browser and network to an existing daily attempt.
• You may request removal of a leaderboard nickname, contact message, or submission through the contact form.

Children

Wrecksaurus is intended for a general audience aged 13 and older. We do not knowingly collect form submissions or public leaderboard information from children under 13.

Analytics and advertising

At launch, Wrecksaurus does not use third-party advertising or third-party analytics scripts. This policy will be updated before either is enabled.

Security

We use server-side validation, prepared database statements, restricted administrative access, rate limits, HttpOnly cookies, and one-way HMAC hashes. No internet service can guarantee absolute security.

Contact

Questions or privacy requests can be sent through the contact form.