Privacy policy
Effective date: 18 October 2026 · Last updated: 24 October 2026
- You can play without an account. A guest's save stays in your browser.
- If you sign in, we keep your progress, your scores and your name. Leaderboards show only a short form of your name, your picture, your best cost and its stars.
- We do not sell your data and we show no ads. Analytics run only after you choose Accept. You can delete your account on your Profile page.
GonnaCrash is a free browser game that teaches system design. This policy explains what we collect, why, who helps us process it, how long we keep it and what you can do about it. GonnaCrash ("we", "us") runs this game at gonnacrash.com. Contact: contact@gonnacrash.com.
What do we collect?
In short: Without an account, almost nothing reaches us. With an account, we keep your progress, your scores and your name; leaderboards show only a short form of it.
- If you play as a guest: your game save stays in your browser (local storage). It does not reach our server.
- If you sign in with GitHub or Google: the account id that GitHub or Google gives us, your name as GitHub or Google gives it (we show it only to you, in the drawer and on your Profile page), a short form of it for leaderboards (at most the first three letters and "***", for example "Ale***"), and the web address of your profile picture. We keep the picture address on our server only, to show your picture; we never show the address itself. We never receive your password. We do not store your email address.
- What we create when you are signed in: your game progress (the save), your best score for each round, the design that earned it and its time, whether you used the full answer in that round, and, for the first time you passed each round, how many runs you needed and how long you played (only you see these two numbers), plus the date your account was created, the date you were last seen, the random device id that your synced save carries (it counts your hint use per device), and a session that keeps you signed in.
- If you email us: your email address and what you write.
- If you send feedback from the game: what you write, its kind, the round, your browser, screen size and page, and your board if you attach it. No account, name or network address; Cloudflare Turnstile checks for bots.
- Analytics: only if you choose Accept in the cookie bar, Google Analytics collects how the game is used (see "Cookies and local storage").
What do we use it for, and why is that allowed?
In short: To run the service you asked for, to count how the game is used if you allow it, and to keep the service safe.
| Purpose | Data | Legal basis |
|---|---|---|
| Sign you in, keep you signed in, save your progress on every device | Account id, session, progress | Contract: the service you ask for when you sign in |
| Leaderboards | Short name, picture, best cost, stars, the time of that pass, the full-answer mark, first-pass runs and time (private) | Contract: leaderboards are part of the signed-in game |
| See which rounds are hard (analytics) | Google Analytics data | Consent: only after you choose Accept |
| Keep the service safe (rate limits, abuse) | Short-lived technical data, such as the network address of a request | Legitimate interests: a service that stays up for everyone |
| Fix bugs and improve the game from your feedback | Feedback text and its context | Legitimate interests: a game that works and is clear |
| Answer your emails and data requests | Your email and what you write | Legitimate interests, and the law when you use a privacy right |
We make no automated decisions about you, and we do not build profiles of players.
What do other people see?
In short: Your short name, your picture and your scores, on the leaderboards.
Everyone who opens a leaderboard, signed in or not, sees for each player: the short name ("Ale***"), the profile picture, the monthly cost of the best design, its stars, the time of that pass and a small "full answer" mark when the full answer was used in that round. Our server sends the picture itself, so viewers never contact GitHub or Google or see the picture's web address. Other people never see your name in full (leaderboards show only the short form), your account id at GitHub or Google, or your first-pass runs and time. Only you see those, with a comparison to other players (for example "fewer runs than 65% of players"). A picture can still help someone recognise you; if that worries you, change the picture at GitHub or Google, or delete your account.
How does sign-in with GitHub and Google work?
In short: GitHub or Google confirms who you are. We read only your id, your name and your picture.
Google: we ask for the scopes openid, email and profile. Google sends your account id, name, picture and email address; we read the id, the name and the picture, and we do not read or store the email address. GonnaCrash's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
GitHub: we ask for no extra permission (no scope), so GitHub gives us only your public profile. We read your id, your name (or your login when the name is empty) and your picture. We never read your repositories or anything else.
We use the access that GitHub or Google gives us once, at sign-in, and we do not keep it. GitHub and Google have their own privacy policies: GitHub General Privacy Statement and Google Privacy Policy.
Who processes data for us?
In short: Three companies help us run the game. Our database is in Cloudflare's Asia-Pacific region. We do not sell or rent your data, and we do not use it for ads.
- Cloudflare, Inc. hosts the game and our server (Cloudflare Workers), stores accounts, progress and scores (Cloudflare D1, in Cloudflare's Asia-Pacific region) and forwards emails sent to our addresses (Email Routing). It also runs Turnstile.
- Google LLC and Google Ireland Limited provide Google sign-in, Google Analytics (only after Accept) and the mailbox that receives the emails you send us (Gmail).
- GitHub, Inc. provides GitHub sign-in and stores game feedback in a private repository only our team sees.
Accounts, progress and scores are stored in Cloudflare D1 in its Asia-Pacific region. Cloudflare's network answers requests from data centres around the world, so a request can pass through a country near you. Google may process Google Analytics data in the United States. These companies protect transfers out of the European Union and the United Kingdom with the EU-US Data Privacy Framework (and its UK extension) and with the European Commission's Standard Contractual Clauses.
The game's fonts are served from gonnacrash.com, so loading the game sends nothing to a font service.
Cookies and local storage
In short: One cookie keeps you signed in. Analytics cookies are set only after you choose Accept.
| Name | What it does | How long |
|---|---|---|
__Host-gc_session | Keeps you signed in. Strictly necessary, so it needs no consent. Set only when you sign in. | 30 days after your last visit, or until you sign out |
__Host-gc_oauth | Protects the sign-in step with GitHub or Google. | 10 minutes, during sign-in only |
_ga, _ga_<id> | Google Analytics: counts how the game is used. Set only after you choose Accept. | Up to 2 years in your browser; Google keeps the data 2 months |
gonnacrash-v1 (local storage) | Your game save and settings, in your browser. | Until you clear it in your browser |
gonnacrash-backup-… (local storage) | Copies of your game save that the game keeps in your browser before a sign-in, a sync or an update, so nothing is lost. One copy carries your account's public id. | Until you clear it in your browser |
To change your analytics choice, open the menu at the top left and choose Settings. We send no names, account ids or email addresses to Google Analytics.
How long do we keep it?
- Sessions: 30 days after your last visit, or until you sign out.
- Account, progress and scores: until you delete your account. Then they are deleted at once.
- Database backups: Cloudflare keeps a restore history of the database for 7 days, so deleted data leaves the backups 7 days after you delete it.
- Emails you send us, including data requests and our replies: 12 months.
- A copy of feedback@ mail, without your address: 14 days.
- Feedback you send from the game: 12 months after we close it.
- A data export file: deleted when we send it to you.
- Google Analytics data: 2 months.
What are your rights?
In short: You can see, copy, correct and delete your data, and take back your consent at any time.
Under the EU and UK General Data Protection Regulation and Singapore's Personal Data Protection Act, you can ask for access to your data, a copy of it, a correction, its deletion or a restriction of its use, and you can object to processing based on legitimate interests. You can object to analytics at any time: open the menu (☰), choose Settings, then Reject.
- Delete your account: on the Profile page, choose "Delete my account". This deletes your account, your sessions, your saved progress on our server and your leaderboard scores at once. Your save in your browser stays until you clear it.
- Get a copy of your data: email contact@gonnacrash.com with the data request code on your Profile page. The code shows that the account is yours without your email address in our database. We send the data as a JSON file.
- Complain: you can complain to your data protection authority, for example your local authority in the EU, the Information Commissioner's Office in the UK, or the Personal Data Protection Commission in Singapore.
We reply to every request within one month.
How do we keep it safe?
We use HTTPS, store no passwords and keep only a hash of each session id. If a breach puts your data at risk, we tell you as the law requires.
Children
You must be 13 or older to sign in. If we learn that a child under 13 has an account, we delete it. Anyone can play as a guest without an account.
Changes to this policy
When we change this policy, we put the new date at the top. For an important change, for example a new use of sign-in data, signed-in players see a notice in the game before the change applies. You can get earlier versions by email on request.
Contact
Questions and privacy requests: contact@gonnacrash.com.