Privacy

Last updated: 28 September 2026

The short version

Tidy Sum has no accounts and no sign-up. It shows no advertising. It uses no analytics tools. The only sense I have of how much the game is played comes from my host's overall traffic totals, described below. They never tell me who you are, or which puzzles anyone solves. I do use Google Search Console, which reports how often a Tidy Sum result appeared in Google's search results, how often it was clicked, and which searches led there. That is not analytics on this site: it adds no script and no cookie, it records nothing about your visit, and the figures are Google's, about its own search results. Your progress is kept in your own browser and is never sent to me. The only information I ever hold about you personally is an email, if you choose to send me one.

Who is responsible

Tidy Sum is run by Chris Blair. If you have a question about this notice, or about anything else on this site, write to hello@tidysum.app and I will answer it myself.

What your browser stores

The game saves your progress on your own device, in your browser's local storage. Three things are kept there:

• today's puzzle and how far through it you are, including the tries you have spent and your time
• your lifetime record: which days you played, whether you solved them, and how long each took
• your settings, if you change any

None of it leaves your device. It is why your record does not follow you to another phone, and why a different browser on the same phone starts fresh. Clearing the site data for tidysum.app in your browser deletes all of it, immediately and for good. I cannot see it, I cannot restore it, and I cannot delete it for you — there is nothing of it on my side to delete.

The game also reads what kind of device you are using, so that the instructions for adding Tidy Sum to your home screen match your phone. That happens on your device. It is not sent anywhere and it is not stored.

Cookies

Tidy Sum sets no cookies.

What the servers record

Like every website, tidysum.app runs on servers that keep short-lived records of the requests they receive. For Tidy Sum those records include your IP address, the kind of browser you are using, which pages you asked for, and technical details of the connection itself.

My host also runs standard protections in front of the site. These count requests by IP address, so that an unusual volume from one source can be spotted and slowed down, and they inspect requests for known attack patterns. They also take a technical fingerprint of the connection your browser makes, which is a common way of telling automated traffic from a person. All of this is aimed at abuse rather than at people: I do not use any of it to follow a visitor, to build a picture of anyone, or to work out who you are. But I would rather describe it accurately than tell you the site knows less about a connection than it does.

Tidy Sum's own code adds almost nothing to those records. It writes four messages in total, all of them about the site failing rather than about you, and the only changing value in any of them is a numeric error code. It never reads your IP address, and it never records your browser or your device. And if the game itself goes wrong while you are playing, the details of that are written to your own browser and are never sent to me at all.

When the game asks the server which puzzle is today's, it sends your time zone — Europe/Dublin, for example — so that the right puzzle arrives at your own local midnight. That time zone appears in the server records. It is never passed on to the puzzle database.

These records exist so the site can run and stay secure. My host keeps them briefly and then deletes them — at the time of writing, for one day.

My host also shows me totals drawn from these records — for example, how many times the day's puzzle was requested over the past few hours. I look at those totals to get a rough idea of how much the game is being played. I look only at the totals, never at the records of individual visits, and I do not use them to follow or identify anyone.

My lawful basis for these records, and for the totals drawn from them, is legitimate interests: running the site, protecting it from abuse, and understanding in broad terms how much it is used.

If you write to me

If you email hello@tidysum.app, I receive your message, your email address, and anything else you choose to put in it. I use it to answer you and for nothing else. I do not add you to any list, because there is no list.

I keep the message for as long as it takes to deal with, and in any case no longer than twelve months after our last exchange, after which it is deleted.

My lawful basis for this is legitimate interests: being able to answer the people who write to me.

The companies involved

Running a website means using other companies' services. Three are involved in Tidy Sum:

• Vercel — hosting. This is where the site runs and where the server records described above are kept. Vercel is a United States company. Where information reaches the United States, Vercel relies on the European Commission's standard contractual clauses and on the EU–US Data Privacy Framework. I have turned off the setting that would let Vercel use this site's data for its own purposes.
• Supabase — the puzzle database. It holds the puzzles and nothing else. There is no record of any player in it, because the game has no notion of a player. Your browser never contacts it; only my server does, and all it asks for is a weekday and a position in the deck.
• Zoho — email, in a European data centre. This is where a message you send me is held.

No other company receives anything. Nothing is passed to any analytics service, advertising network or data broker, because the site uses none.

What Tidy Sum does not do

• No accounts, and no way to make one
• No advertising, and no advertising network
• No analytics tools or tracking scripts — only the host's traffic totals described above
• No tracking across other websites
• No selling, sharing or trading of information with anyone
• No profiling, and no attempt to work out who you are

Your rights

Under data protection law you have the right to ask for a copy of the personal information held about you, to have it corrected, to have it deleted, to object to it being used, and to have its use restricted.

In practice, for the game itself there is very little to ask for: your progress is on your own device and never reaches me, and the server records are technical, kept briefly, and hold no name. Those rights bite hardest on email. If you have written to me and want your message and address deleted, say so and I will do it.

Complaints

If you think I have handled your information badly, you are entitled to complain to the Data Protection Commission, Ireland's data protection authority, at dpc.ie.

Changes to this notice

If any of the above changes — a new supplier, or anything that measures how the game is used — this page is updated and the date at the top changes with it.

Back to today’s puzzle