Privacy policy
Last updated September 24, 2026
The short version: we keep only what it takes to run the game — your account, your games and your scores. There are no ads and no ad trackers, we don't use cookies, and we never sell or share your information for marketing. Questions, or want your data deleted? Write to hello@crazy10s.com.
What we store
If you make an account
- Your username and display name.
- Your password, stored only in scrambled (hashed) form — nobody at Crazy10s can read it.
- Your email address, if you add one. It's optional, and it's used only to send you a password-reset link when you ask for one.
- When you joined and when you last played.
- Where you came from: the website or link that first brought you to Crazy10s — just the site's name (such as google.com), any campaign tag on the link, or the invite link a friend sent. We use it to learn which places bring new players.
- The country you last played from. We work it out from your internet address when you connect, and keep only the country, never the address.
- If you use the Crazy10s app and allow notifications: a notification token for your device, linked to your account, so we can tell you when it's your turn, when someone invites you or wants a rematch, and when you get a chat message. It's deleted when you sign out on that device.
If you play as a guest
The same, minus the email and password: a guest has a display name and a hidden username, and is kept signed in by a token saved in your browser. If you clear your browser, the guest account can't be recovered — that's why we suggest making an account.
Your games
- Moves, scores and results of every game you play, including against the Computer.
- Chat messages you send in a game. Your opponent can read them, and they're saved so they're still there when your opponent comes back.
- Your Daily Puzzle tries and scores — linked to your account, or, if you're not signed in, to a random ID saved in your browser — along with where you came from, as above.
In your browser
We save a few things in your browser's local storage: the token that keeps you signed in, your Daily Puzzle ID, where you first came from (see above), and small preferences such as the Computer difficulty you last picked and whether you've already seen the rules. We don't use cookies, and nothing here follows you to other websites.
Briefly, and not saved
Our server looks at your internet address while you're connected, to work out your country and to limit abuse (for example, how many guest accounts one network can create in an hour). It's held in memory only and never written to our database. Our hosting and network providers keep their own short-term logs of addresses for security and to keep the site running.
What other players see
Your display name, your moves and scores in games you play with them, and chat messages you send them. People can invite you to a game by your username. The Daily Puzzle shows only scores and standings, never who played.
How we use it
- To run the game: sign you in, save your games, deliver moves and chat, and score the Daily Puzzle.
- To send a password-reset email when you ask for one. We don't send marketing email.
- To send app notifications about your games, if you allow them. They're only about your games — never marketing.
- To improve the game using totals — for example how many games are played to the end, or how many players come from each country.
- To keep the site safe and working.
Services we rely on
- Render hosts the game and its database. Our servers may be outside your country, including in the United States.
- Cloudflare sits in front of the site and handles the network traffic to it.
- Cloudflare Web Analytics counts visits to the site — which pages are viewed, which site sent you, and your type of device, browser and country. It uses no cookies, stores nothing in your browser, and doesn't identify you or follow you across other sites.
- Resend sends password-reset emails; it receives your email address and the message.
- Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iPhone) deliver app notifications to your phone; they receive your device's notification token and the notification's text (for example, "Maya passed. Your turn!").
- Your country is looked up on our own server with MaxMind's GeoLite2 database — nothing is sent to MaxMind.
We don't sell your information, and we don't share it with anyone else unless the law requires it.
How long we keep it
For as long as your account exists. Password-reset links stop working after an hour and are deleted within a day.
Your choices
- Change your display name any time in your Profile.
- Turn app notifications off any time in your phone's settings, or sign out of the app.
- Delete your account any time in Profile → Delete account — see Deleting your Crazy10s account.
- To get a copy of what we hold about you, email hello@crazy10s.com. We'll send it within 30 days.
Deleting your Crazy10s account
You can delete your Crazy10s account, and everything linked to it, at any time — in the app or on crazy10s.com.
- Sign in, open Profile (the person icon at the top of the home screen) and tap Delete account.
- Type your username to confirm (guests just confirm). The account is deleted straight away and you're signed out on every device.
Can't sign in? Email hello@crazy10s.com with the subject “Delete my Crazy10s account”, from the email address on your account or with your username, and we'll delete it within 30 days and confirm by email.
What we delete: your account (username, display name, email and password), your sign-in sessions and app notification tokens, your games against the Computer and in Practice, your Daily Puzzle results, and the chat messages you sent. Any game in progress against another player ends as a give-up.
What stays, without your name: games you played against other people stay in their game lists, since they're theirs too — your side shows as “Deleted player” and can't be linked back to you. Your username becomes free for anyone to register, and nothing of yours carries over to them.
What we keep: nothing that identifies you. Copies in our hosting provider's routine database backups are overwritten on their normal schedule, within 30 days after deletion.
To delete only some of your data (for example your email address or your chat messages) without deleting the account, email us the same way and say what you'd like removed.
Keeping it safe
The site only runs over an encrypted connection (HTTPS), passwords are stored hashed, and reset links work once, for an hour.
Children
Crazy10s isn't directed at children under 13, and we don't knowingly collect personal information from them. If you think a child under 13 has made an account, email us and we'll delete it.
Changes
If this policy changes, we'll update this page and the date at the top.
Crazy10s · hello@crazy10s.com
← Back to Crazy10s