Privacy
Last updated October 8, 2026
Pebble Box Games makes short daily puzzle games. This page says plainly what we store about you, where we keep it, for how long, and how to download or delete it. It covers every Pebble Box game and this site.
The short version
- You can play every game without an account. Then your progress stays in your browser, and we store nothing about you unless you send feedback (see Feedback).
- If you create an account, we store your email address and your game progress so it follows you to other devices and games.
- We don't sell your data, show ads, or use tracking or analytics scripts.
- You can download everything we hold about you, or delete your account, at any time on your account page.
Playing without an account
Your stats, streaks, settings and any puzzle in progress are saved in your browser's storage on your device. They never leave it. Clearing your browser's site data removes them.
What we store when you have an account
| What | Why | How long |
|---|---|---|
| Your email address, and a random account ID. If you sign in with Google, also the ID Google gives your account, so we can link it to your email. If you add a passkey, its public key and the details your device reports with it (a credential ID, the kind of device, and when it was added); the private key never leaves your device. | To sign you in and to email you sign-in and confirmation codes | Until you delete your account |
| Your game data: each day's result (solved or not, score, attempts, time taken, when and in which time zone you finished, and up to 1 KB of game-specific detail about the result), your stats and streaks, your settings, any puzzle in progress, and streak freezes | So your progress follows you across devices and games | Until you delete your account |
| Backups of the game data | To recover from mistakes or failures | Up to 35 days after your account is deleted |
| After deletion, only your random account ID, with nothing else attached | To make sure deleted data can never come back from a backup | 35 days after deletion, then deleted automatically, which can take a few more days |
| Keyed hashes (one-way scrambled values) of email addresses, IP addresses and account IDs. Never the addresses themselves. | Only to limit how many sign-up, sign-in and confirmation emails we send, how many sign-up challenges one device can ask for, and how much feedback one device can send, so nobody can use us to flood someone's inbox or our services | One hour for the email and sign-up limits, two days for the feedback limit. Expired hashes are deleted automatically, which can take a few more days. |
You sign in with a one-time code we email you, with a passkey on your device, or with Google.
If you sign in with Google, we receive your email address and Google's ID for your account, and nothing else from your Google account. If you later sign in with an email code for the same address, it's the same account. Apple players who choose "Hide My Email" get a private relay address from Apple; that account stays separate from any account under your real address.
Feedback
Each game has a feedback button. When you send feedback, we store your message, its category, the puzzle date, the screen you were on, your language setting and time zone, your browser and operating system family (for example "Safari 19 / iOS 26"), the size of your browser window, whether the game is installed as an app, which version of the site it came from (preview or live), when it was sent and received, and game details such as the puzzle number. Feedback is kept for 90 days, then deleted automatically, which can take a few more days. It is not linked to your account, even when you're signed in. So we can respond quickly, most messages are also copied into an alert to our team's email inbox and to our own phone notification service; during a burst of feedback, later messages send only a count. We delete those copies within 90 days too. Please don't put personal details in your message.
Where your data is kept
Your account, your game data and your feedback are stored with Amazon Web Services in the United States (the us-east-1 region, in Virginia). Sign-in emails are sent through Amazon Simple Email Service. The only copies kept anywhere else are the feedback alerts described above. The sign-in page at auth.pebblebox.games is run by Amazon Cognito and sets the cookies sign-in needs: one keeps you signed in to it for one hour, so you can move between our games without signing in again, and others protect the sign-in form against forgery and remember your language. We use no other cookies, and no third-party scripts run on our pages.
Downloading your data
Sign in on your account page and choose Download my data. We email you a confirmation code first, so only you can download it. You get one file with every record we hold about you, across every game.
Deleting your account and data
- Go to your account page at
pebblebox.games/accountand sign in. - Choose Delete my account.
- Enter the confirmation code we email you. If you signed in more than a few minutes ago, we ask you to sign in again first.
Deletion starts at once, with no grace period. From that moment your account and its data can't be reached from any device, and every device you're signed in on stops syncing. We then remove your game data and your sign-in account, retrying any step that fails until it's done. The data can remain in backups for up to 35 days, and we keep only your random account ID for those 35 days, plus the few days automatic deletion can take, so the deleted data can never be restored. Progress saved in a browser without an account stays on that device until you clear the browser's site data.
These are also the data deletion instructions for players who sign in with Facebook, once Facebook sign-in is available.
Children
Our games are for a general audience and are not directed at children under 13. We don't knowingly create accounts for children under 13. If you believe a child has created an account, delete it from the account page or contact us below.
Changes
If we change what we collect or how we use it, we'll update this page and the date at the top before the change takes effect.
Contact
Questions about privacy: privacy@pebblebox.games.