Privacy Policy

You can play every day without giving us anything. When you first load the site your browser generates a random session identifier and keeps it in local storage, with a copy in a cookie so the server can tell which card is yours. It is a random string. It is not derived from your device, your network, or anything about you, and on its own it identifies nobody.

Tied to that identifier, we store the results of games you finish:

• which day's card, and which of the four games you played
• your score, and for some games how long you took and how many mistakes you made
• your streak, level and achievements

Your browser also keeps a few things locally that never reach us: your progress in an unfinished game, which days you have completed, and whether you dismissed the prompt asking if you would like the site on your home screen.

Accounts are optional. Signing in sends a one-time link to your email address, so we store that address. We never receive or store a password, because there isn't one. Alongside it we keep the username you choose and the game history above, now attached to your account so it follows you between devices.

Your username is public. It appears on the daily and all-time leaderboards where anyone can see it. Nothing else about you is shown - not your email, not when you play. Choose a username accordingly.

We measure two things, both about the site rather than about you:

• Vercel Analytics, which counts page views and is cookieless by design - it does not build a profile of you or follow you to other sites
• our own counter, which records events like "a results pop-up was shown" or "someone tapped share", stored against the same random session identifier

We use these to answer questions like whether people finish all four games. Neither is shared with anyone, and neither is used for advertising.

One advertisement appears at the foot of the page, served by Google AdSense. It pays for the hosting; the site is otherwise free and has no subscription.

We have configured it to serve non-personalized ads only. That means what you see is based on the page you are on and your rough location, and not on a profile of your browsing history. It is why you are not being asked to accept tracking before you can play.

Non-personalized does not mean invisible. Google still uses cookies or similar storage to cap how often you see the same ad, to measure the ads it served, and to detect fraud. Google's handling of that is covered by its own privacy terms for partner sites. We never send Google your email address, your username, or your scores.

No ad is shown on this page, on the terms page, or anywhere in the admin area.

Vercel hosts the site and provides the analytics above. Supabase stores the database and sends the sign-in emails. Google serves the advertisement described above. That is the complete list. We do not sell, rent, or trade any of it.

If you have an account, the danger zone at the bottom of your profile deletes it, along with your scores, streak and achievements. It is immediate and it is not reversible.

Without an account, clearing your browser's site data for whohadmore.com removes the session identifier and everything stored locally. Results already recorded against the old identifier stay in the database but are no longer connected to any device.

Depending on where you live you may also have the right to ask what we hold about you, to correct it, or to have it erased. Email wklaxton@gmail.com and we will action it.

WhoHadMore is not directed at children under 13 and we do not knowingly collect their information. If you believe a child under 13 has created an account, email us and we will remove it.

If this policy changes we will update the date at the top. Material changes will be flagged on the site rather than made quietly.

WhoHadMore — wklaxton@gmail.com