← Whiskerloop

Privacy

Last updated 19 September 2026

Whiskerloop is a daily puzzle. It needs very little about you, so it asks for very little. This page lists everything it actually stores — not a category summary, the fields themselves.

If you never make an account

You can play without one. The game gives your device a random identifier (something like p_4f21c7ab) and stores it in your browser. It is not derived from anything about you or your device, and it is the only way the game recognises you on a return visit.

Against that identifier it keeps:

• Which rooms you have opened and solved, when, how long you took, how many hints you used, and the resulting score.
• Your streak and any streak freezes you hold.
• A display name, if you set one, and the avatar you chose. Both are public — they are what appears on the leaderboard.
• The levels and achievements you have reached, and the theme you wear.
• The first and last time the game saw you.

Clearing your browser data, or deleting the app, ends that association. The records become orphaned and are not recoverable — there is nothing else tying them to you.

If you make an account

An account exists so your streak survives a new phone. It adds:

• Your email address. Used to sign you in and to send a password reset. It is never shown to other players and never sold.
• A password hash, if you set a password — scrypt, never the password itself. Nobody at Whiskerloop can read it, including us.
• Which provider you used (password or Google) and when the account was created.

If you sign in with Google, Google tells us your email address and a stable identifier for your account there. We do not receive your Google password, your contacts, or anything else in your Google account.

Daily reminders

Only if you switch them on. Turning them on stores the push endpoint your browser or phone issues, the encryption keys that go with it, and your UTC offset — so the reminder arrives in your evening rather than ours. Turning them off deletes all of it.

Friends

Friends work by code. You share yours, or enter someone else's. There is no search and no contact upload: nobody can find you here by name, email or phone number. A friend sees the name and scores you already put on the leaderboard.

Purchases

If you buy Whiskerloop Pass, we store which product you bought, when, and a receipt identifier so the same purchase is not credited twice. Payment is handled entirely by Google Play or the payment provider. Card numbers never reach our servers and we could not store them if we wanted to.

What the server sees in passing

• Your IP address, to rate-limit abuse. It is used in memory for the length of a short window and is not written to your record.
• Server logs of requests — path, status, timing, and a random request id. They carry no personal data beyond what is above.
• Crash reports if the game breaks in your browser: the error message and where in our own code it happened. Deduplicated and capped, so a loop that fails every frame does not report every frame.

What we do not do

• No advertising identifiers, no ad networks, no third-party analytics scripts. The game measures itself, on its own server.
• No tracking across other sites. There is nothing to track with.
• No selling or sharing of personal data. There is no business model in which that would help us.
• No location, no contacts, no camera, no microphone, no files. The Android app requests exactly one permission: internet access.

Getting your data, or deleting it

Both are endpoints, not a support queue:

• Export — everything held about you, as JSON.
• Delete — removes your profile and every session. It cannot be undone, and we cannot restore it afterwards.

Both are in the game itself, under You: Download my data and Delete my account. Deleting also clears what this device was holding - the room you were halfway through, and any rooms kept for playing without a connection.

If you would rather ask a person, or your account is in a state you cannot sign into, email the address below and we will do it for you.

Aggregate statistics — how many people solved Tuesday's room, how long it took on average — contain no identifiers and are not removed by a deletion, because there is nothing in them to remove.

How long it is kept

Leaderboards and daily records expire on their own within a few weeks. Account and profile data is kept while the account exists. Delete the account and it goes.

Children

Whiskerloop is suitable for all ages, but accounts are not intended for children under 13 (under 16 in the EEA and UK). We do not knowingly create one. If you believe a child has, email us and we will delete it.

Changes

If this page changes in a way that affects what is collected, the date at the top changes and the game says so before the change applies to you.

Contact

Privacy questions, exports, deletions: privacy@whiskerloop.com

Whiskerloop is the data controller for the purposes of the UK GDPR and EU GDPR. The legal bases are performance of a contract (running the game and your account) and legitimate interests (keeping it working and preventing abuse). You have the right to access, correct, export, delete and object; the endpoints above cover the first four immediately, and the email address covers the rest.