←

Privacy Policy

Last updated: 6 July 2026

This policy explains what ForgeFun collects, why, and the choices you have. ForgeFun is operated by Daniel Bywater (“we”, “us”). It is a family-oriented daily puzzle app. We try to keep data collection to the minimum needed to run the games and, where you opt in, the social features.

No third-party analytics or ad tracking. ForgeFun does not embed any analytics, advertising, or behavioural-tracking SDKs. There are no advertising or cross-site tracking cookies.

Who you can be

You can play in one of three ways, and what we store depends on which:

  • Guest / device-local: you pick a name and play without creating a server account. Your progress and stats live on your device.
  • Username & password account: we store your username and a password that is hashed (scrypt) — we never store your password in readable form.
  • Google sign-in (only if enabled on this server): we receive and store your email address and name from Google.

What we collect

Account & profile (signed-in users, stored in our database)

  • Email address (Google sign-in only) and/or username.
  • Display name, timezone, and a shareable friend code.
  • Notification preferences and cosmetic / skin choices.
  • Game results and statistics: puzzle attempts, streaks, Elo rating, group memberships, and friendships.

Notifications

If you enable push notifications, we store the push subscription for that browser/device — the push endpoint, its encryption keys, and the device’s User-Agent string (used to help debug multi-device delivery).

Photo-to-avatar (optional)

If you choose the “photo to avatar” option when customising your avatar, the photo you provide is sent to our AI provider, Anthropic (the Claude API), which analyses it and returns only a short set of cartoon-avatar attributes (such as skin tone, hairstyle, and whether you wear glasses) that we use to build a free avatar. The photo is processed in memory for that single request and is not stored on our servers or kept after the avatar is generated. This feature is only offered to signed-in users and is rate-limited.

Feedback & error reports

When you send feedback or report a bug, and when the app catches an unexpected error, we record the message, any error stack trace, the page URL, your User-Agent, and your identity (your user id and name, including for guests). Automatic error capture is always on so we can find and fix crashes; it is technical diagnostic data, not tracking.

Network / security

Your IP address is used transiently to rate-limit abusive requests. We do not keep it as part of your long-term profile.

How we use your data

  • To run the puzzles and save your progress, streaks and stats.
  • To power opt-in social features: friends, groups and leaderboards.
  • To send the notifications you asked for.
  • To diagnose crashes and fix bugs (feedback & error reports).
  • To protect the service from abuse (rate limiting).

We do not sell your data, and we do not use it for advertising or cross-site tracking.

Cookies & local storage

ForgeFun uses only functional / essential cookies — there are no advertising or tracking cookies. These include:

  • HMAC-signed game-state cookies (fw_state, fw_endless, fw_daily) that hold your current puzzle progress.
  • A signed identity cookie (fw_profile) and a guest session id (fw_sid) so we know who you are between visits.
  • An admin cookie (fw_admin) for site administrators only.
  • Google / sign-in session cookies, when Google sign-in is enabled.

We also use your browser’s localStorage on your own device to remember game progress, stats and interface preferences.

Who else processes your data

We keep third parties to a minimum. Depending on how this server is configured, the following may process data on our behalf:

  • Our hosting & database provider — stores the application data described above.
  • Google — if Google sign-in is enabled, to authenticate you (subject to Google’s own privacy policy).
  • Anthropic — if you use the “photo to avatar” feature, the photo is sent to Anthropic’s Claude API to derive cartoon-avatar attributes (subject to Anthropic’s own privacy terms). The photo is not retained.
  • A web push service — your browser’s push provider (e.g. Apple, Google or Mozilla) delivers notifications you opt into.
  • A Slack / Discord webhook — if configured, feedback and error reports (including the message, page URL and your name) are forwarded to the operator’s private chat channel so we see them promptly. This is a transfer to a third-party service.

Sharing with other players

If you use the social features, other players can see your display name and your game stats: friends and members of the same group see each other (a group member can add their own friends, so groups may include people you haven't met), and a leaderboard may show display names publicly. Your email and password are never shown to other players.

Data retention

We keep account and game data for as long as your account exists. Delete your account (see below) and we remove your stored rows. Guest / local data lives on your device until you clear it. Feedback and error reports are kept while they’re useful for fixing issues; rate-limit data is transient.

Children’s privacy

ForgeFun is family-oriented, but it is not directed at children under 13 (or the minimum age in your country, e.g. 16 in parts of the EU) without a parent or guardian. Accounts should not be created for younger children without a parent’s involvement and supervision. We do not knowingly collect personal information from children below that age without parental consent.

On first use we ask for a birth year (stored only on your device, never on our servers). Players under 13 are kept in a private, local-only mode: they can play every puzzle with their stats saved on the device, but sign-in and online accounts — which is where personal data would be collected — are not offered. This is a good-faith, self-declared check, not identity verification. If you believe a child has provided us data without a parent’s involvement, contact us at daniel.bywater@gmail.com and we will remove it.

Your rights & choices

  • Access / export: signed-in users can download their stored data from Settings (“Download my data”).
  • Deletion: signed-in users can permanently delete their account and associated data from Settings (“Delete my account & data”).
  • Local data: “Clear local progress” in Settings clears this device’s local stats.
  • Notifications: turn push notifications off in Settings or your browser at any time.

Depending on where you live, you may have additional rights (to access, correct, or restrict processing of your data). Contact us to exercise them.

Contact

Questions about this policy or your data? Email daniel.bywater@gmail.com.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new “Last updated” date. Continuing to use ForgeFun after a change means you accept the updated policy.