privacy policy

this policy explains what information node_shift ("we", "us") collects when you use nodeshift.click, why, and the choices you have. node_shift is run by John McGuinness, an individual developer in Colorado, USA. you can reach us at support@nodeshift.click.

playing without an account

you can play without signing up. to keep track of your scores, your browser stores a random device id (a generated identifier that does not contain any personal details) in local storage. your browser sends that id with every puzzle result you submit and every time it loads scores. we only use it while you are signed out: it is how your best scores are saved and shown back to you without an account. once you are signed in, your results and scores are tied to your account instead, and the id sent alongside them is not stored with them. the same id is also used for analytics (see "analytics" below). your settings, such as hard_mode, are also kept in local storage on your device and are not sent to us. clearing your browser's site data removes both.

accounts

if you create an account we store:

• your email address;
• your password, stored only as a one-way hash (we never store the password itself);
• if you sign in with Google or Apple: the account id, name, and profile picture that provider shares with us, plus the sign-in tokens it issues;
• whether your email address has been verified.

we use your email address only to sign you in and to send account emails (verifying your address, resetting your password). we don't send marketing email. account emails are sent through our email provider.

scores

when you finish a puzzle we store your result: the puzzle, the sequence of clicks you made, the color you finished in, and the number of clicks, linked to your account (if signed in) or your device id (if not). for each puzzle and color, the fewest clicks anyone has posted is shown to every player, and the clicks of that best solution are shown to signed-in players. your email address, account, and device id are never shown to other players.

cookies and similar technologies

• sign-in cookie: when you sign in, we set a session cookie that keeps you signed in for up to 30 days. it is necessary for accounts to work.
• local storage: the device id and settings described above.
• we don't use advertising or analytics cookies, and we don't track you across other websites.

security and abuse prevention

with each sign-in session we store the IP address and browser (user-agent) it came from, to help you and us spot sign-ins that aren't yours. to limit abuse, we briefly count requests per IP address, email address, account, or device id for sign-in, sign-up, password-reset and verification emails, and score submissions. our hosting provider keeps standard request logs for a short time.

analytics

node_shift runs its own simple analytics. there is no third-party analytics service, no analytics cookies, and no tracking across other websites. we record a small set of events: opening a puzzle (puzzle_view), the first click on a puzzle (first_click), solving it (solve), clicking share (share_click), signing up (signup), and signing in (signin). each event is keyed by the random device id described above, not by your name or email address. each event also records when it arrived, your local calendar date, the platform (web, iOS or Android), and for puzzle events the puzzle number, plus for a solve the color, the number of clicks, and whether it matched the optimal.

if your browser sends a Global Privacy Control or Do Not Track signal, we don't record analytics events for you at all. we use this information only in aggregate, to understand how the game is played and to improve it.

advertising

node_shift doesn't show ads today. if we add ads, we will update this policy before they appear, describe the ad provider and the cookies it uses, and ask for your consent where the law requires it.

how long we keep data

• account and scores: until you delete your account (see below).
• scores posted without an account: kept with the device id that posted them.
• sign-in sessions: end when you sign out or after 30 days without use.
• abuse-prevention counters: deleted within a few days.
• analytics events: deleted after 400 days.
• backups: our database provider keeps backups for a limited time, after which deleted data is gone from them too.

service providers

we rely on these providers to run node_shift, and they process data on our behalf:

• Netlify (website hosting)
• Turso (database)
• Resend (account emails)
• Google (sign in with Google, if you use it)
• Apple (sign in with Apple, if you use it)

we do not sell or share your personal information for advertising.

your choices and rights

• you can play without an account.
• you can clear the device id and settings by clearing site data in your browser.
• you can opt out of analytics by turning on Global Privacy Control or Do Not Track in your browser.
• to get a copy of, correct, or delete your account and scores, email support@nodeshift.click from the address on your account. we'll respond within 30 days. scores posted without an account can be deleted too: include your device id, which you can find in your browser's local storage for nodeshift.click.
• depending on where you live (for example in the EEA, the UK, or California), you may have the right to access, correct, delete, or export your data, and to object to or restrict how we use it. we honor these requests for everyone, wherever you live. if you are in the EEA or the UK, you can also complain to your local data protection authority.

legal bases (EEA and UK)

we use your account data to provide the service you signed up for (performance of a contract). we use device ids, analytics events, and security data for our legitimate interests in running, securing, and improving the game, with the analytics opt-out described above.

children

node_shift is not directed to children. you must be at least 13 years old (16 in the EEA and the UK) to create an account. if you believe a child has created an account, contact us and we will delete it.

where data is processed

our database is hosted in the European Union (Ireland) by Turso. the website is served by Netlify, and account emails are sent by Resend, both based in the United States, so your data may be processed in the United States and other countries where these providers operate. we rely on their standard data protection terms, including the EU Standard Contractual Clauses where they apply.

changes

if this policy changes we will update the date at the top of this page. for significant changes we will also post a notice on the site and, if you have an account, email you before the change takes effect.

contact

questions or requests: support@nodeshift.click.