Privacy

We use the email address, webhook URL, and location point to provide you with this website's services.

We don't sell your data, and we don't share it with advertisers (of which there are currently none). The only outside companies that touch it are the service providers we need to run the site, listed near the bottom of this page.

We don't send webhook posts except for the Weeklygame service itself. Those posts include a link to an info page that includes the point you picked for the location.

That location point is rounded to the nearest 0.1 degree of longitude and latitude. That's around 6 miles in the continental US, give or take. So even if you click exactly on your house, all this website stores is that nearest 0.1-degree grid point.

Your webhook URL, latitude, and longitude are stored encrypted, so even if this site's database leaks, as long as nobody also gets the site's master key (stored separately), they can't connect your email with your Discord or your location.

Your password, of course, is encrypted (with bcrypt).

The only cookie we set is a login cookie that keeps you signed in for about 380 days. We don't use tracking or advertising cookies, and our traffic analytics don't store your full IP address.

We do process IP addresses to keep you signed in and to protect the site from abuse, namely, rate-limiting requests and, for persistent bad actors, blocking the address long-term.

Who else touches your data

To run the site I rely on a few outside services. Each one only handles what it needs to do its job, and none of them get your data to use for their own purposes:

• Neon — hosts the database (in the US) where your account lives.
• Cloudflare — DNS, the CDN in front of the site, and file storage; it carries and can see traffic to the site.
• Brevo — sends the site's emails, so it receives your email address.
• Google reCAPTCHA — guards the sign-up, sign-in, and password-reset forms against bots; Google receives some request data when those forms load.
• Sentry — collects error reports when something breaks.
• BetterStack — collects the server logs.

If you're concerned about privacy, here's what I'd suggest:

• Use a throwaway email address.
• Let your password manager pick a random password instead of reusing one.
• Click somewhere nearby but not on any location you care about — anywhere within 10–20 miles is functionally the same anyway.
• Enter a webhook URL for a channel that you don't mind an attacker spamming, in the unlikely event this site gets breached (I'll work hard to prevent this!)