Privacy policy

The short version

• Dailies is run by Helvetica Labs. There are no ads, no analytics scripts, no tracking pixels, and nothing about you is sold or rented to anyone.
• We store what you give us: your account details, the share texts you paste or send in, and the scores read from them.
• Your profile page is public. Your results are visible to people in your groups. Nobody else sees them.
• Email is used for confirming your address and resetting your password, never for marketing.
• To delete everything, write to jason@vevey.ai.

What we store

Account. Your email address, username, display name, whether the email has been confirmed, and the dates the account was created and last changed. A password, if you set one, is stored as a salted hash and never in plain text. The time zone your browser reports is saved so server-rendered pages know which day is “today” for you.

Sign-in sessions. Each sign-in creates a session record with a random token, the IP address and browser identifier it was made from, and an expiry. A session lasts seven days and is extended while you keep using it. Signing out or changing your password ends sessions.

Rate limiting. Requests to the sign-in, password reset and email confirmation endpoints are counted per IP address so they cannot be flooded. The counters hold the address, the endpoint and a count.

Results. For every result you log: the game, the puzzle number and date, whether you solved it, the score, the emoji grid, when it was logged, and how it arrived (paste, by hand, or reported by a game). The share text itself is kept alongside, so a result can be re-read if a parser improves. Results logged by hand carry no share text.

Statistics. Per game we keep the totals shown on your Stats page: games played, wins, current and best streak, score averages and the guess distribution. They are recomputed from your results and hold nothing that is not already in them.

Groups. A group’s name, who owns it, who is in it and since when, which games it counts and which weekday its week starts on. When an owner removes someone, that is recorded so the invite link no longer admits them.

API tokens. Tokens you create under Settings for the extension, the phone app or your own scripts are stored as a hash together with the name you gave them, their first few characters, when they were created and when they were last used. The token itself is shown once and cannot be recovered by us.

Unrecognised share texts. When a paste is not recognised, the box offers to send it in so a parser can be written. Only if you press that button is the text stored, together with your account, so abuse can be traced. Nothing is sent in on its own.

Games you create. If you add a game to Dailies, its name, description, scoring rule, address and allowed origins are stored under your account.

Cookies and what stays on your device

Dailies sets three kinds of cookie, all first-party and none for advertising:

• A session cookie that keeps you signed in.
• A tz cookie holding your time zone, so pages rendered on the server show the right day.
• Short-lived cookies during a Google or Apple sign-in that protect the hand-off from being forged. They are gone once you are signed in.

The browser’s own storage remembers two things that never leave it: which set-up steps you have ticked off on the Today page, and whether clipboard auto-capture is switched on.

The site loads no third-party scripts. Fonts are bundled with the site and served from the same place as everything else, so no font provider sees your visit.

Clipboard, extension and phone app

Each way of getting a result in touches a different amount of your device. In every case only puzzle share text reaches Dailies.

Paste. Only what you paste is read.

Clipboard auto-capture. Off unless you switch it on under the paste box. When on, each time the Today tab comes back into view the page reads the clipboard once, in your browser. Text that does not parse as a game result is discarded on the spot and never sent anywhere. Turn it off with the same switch, or by revoking the clipboard permission in the browser.

Browser extension. It runs only on the game sites listed in its manifest. On those pages it sees the text a game hands to the clipboard or the share sheet, and forwards only text that begins with a share header it knows to your Dailies address using your token. It does not read anything else on the page, your browsing history, or other sites. Your address, token, a queue of results that could not be sent yet and a short log of recent captures live in the extension’s local storage on that computer, never synced. Connecting it works by a short code: the extension asks us for one, you approve it here while signed in, and the token it collects is the same kind you can create and revoke under Settings. The code and the secret that goes with it are kept for ten minutes at most and deleted the moment the token is collected. Once a day the extension also asks us for the current list of games and game sites it should watch; that request carries no token and nothing about you, and the answer only ever narrows what the extension sends. When that list names a site the extension does not yet cover, it asks you before running there. The extension’s use of what it collects is limited to logging your puzzle results; it is not used for anything else and not shared with anyone else.

iPhone app. The app shows the website and adds Dailies to the share sheet. Its token is kept in the device keychain. The share extension sends the text you share, and nothing else, to your account. The app contains no analytics or advertising code.

Android share sheet and shortcuts. These send the text you chose to share, and nothing else.

Who can see what

Your profile is public. Anyone who knows your username, signed in or not, can open your profile and see your display name, the games you play, how many times you have played each, your solve rate and streaks, and your most recent results with their emoji grids and scores. Pick a username you are happy to be found by.

Groups. Members of a group see each other’s results for the games the group counts, and the weekly standings. Someone’s score for today is hidden from you until you have logged that game yourself, so standings do not spoil a solve. Group pages are only visible to members. An invite link, though, shows the group’s name, its members and the current week’s standings to whoever opens it, signed in or not, so share it with care.

Nobody else. Your email address, IP address and share texts are never shown to other users. We do not sell, rent or trade personal data, and we do not share it with advertisers.

Services we rely on

These companies process data on our behalf, each only as far as its job requires:

• Vercel hosts the site and serves every request, so it sees the IP address and headers of each visit as any web host does. Vercel’s privacy policy.
• Turso stores the database. Turso’s privacy policy.
• Resend delivers the confirmation and password reset emails, and therefore sees your address and the contents of those messages. Resend’s privacy policy.
• Google and Apple are involved only if you sign in with them, as described below.

Most games are not part of Dailies. When you follow a Play link to one of them you are on that publisher’s site under its own privacy policy. Dailies never fetches puzzles, answers or your play history from them; it only reads the share text you bring back. A game made by Helvetica Labs, such as Landmarkr, or created by someone on Dailies, can instead run in a frame inside Dailies and report your result to it directly. The game itself still runs on its own site; what it reports to Dailies is stored as a result, as described above.

Signing in with Google or Apple

If you sign in with Google, we ask for your name, email address and profile picture and nothing more. They are used only to create your account, find it again on later sign-ins, and pre-fill your username, which you can change under Settings. The picture address is stored but not currently displayed. We keep the sign-in tokens Google issues so the link between the accounts keeps working; we never use them to read anything else from your Google account. Our use of information received from Google APIs is limited to providing and improving Dailies and follows the Google API Services User Data Policy, including its Limited Use requirements. You can cut the link at any time from your Google account permissions; set a password first if that is your only way in.

Sign in with Apple works the same way with your name and email. If you choose to hide your email, we receive the relay address Apple creates and our messages reach you through it. Apple sends your name only on the first sign-in.

How long we keep it

• Account details, results, statistics, group memberships and tokens stay until you delete them or ask us to.
• A result can be removed from its game page at any time; its statistics are recalculated straight away.
• Sessions expire seven days after last use. Password reset links last an hour and email confirmation links a day, after which they are useless.
• An expired session record is deleted the next time it is presented. Rate-limit counters are kept so the limits hold across restarts; they contain only an address, an endpoint and a count.
• Unrecognised share texts you sent in are kept until a parser exists for them, or until you ask for them to be removed.

Deleting your account

Write to jason@vevey.ai from the email address on the account and say which account. We delete it within 30 days, together with every result, statistic, session, token and group membership attached to it. A group you own is deleted with your account, so hand its members somewhere else first if they want to carry on.

Unrecognised share texts you sent in lose their link to you at that point rather than being deleted, since they are needed to write parsers and hold nothing personal; say so in your message if you want them gone too.

You can remove individual results from the game’s page and revoke API tokens under Settings without asking anyone.

Your rights

Wherever you live you can ask us what we hold about you, have it corrected, receive a copy of it in a usable form, or have it deleted. Your email address and username can be changed under Settings; for everything else write to us. If you are in the European Economic Area, the United Kingdom or another place with a data protection authority, you can also complain to it.

Dailies is not aimed at children under 13 and we do not knowingly keep an account for anyone that young. If you think we have, tell us and we will remove it.

Changes to this policy

When this page changes, the date at the top changes with it. If a change means we would collect something new or show it to more people, we say so on the site before it takes effect.

Contact

Helvetica Labs runs Dailies. For anything about your data, write to jason@vevey.ai. The rules for using the service are in the terms of use.