Privacy policy
Last updated: 15 October 2026
Stonele is a free daily word puzzle at stonele.com, made by Malachy Saeedi (“I”). Contact: contact@stonele.com.
The short version
- No accounts, no ads, no cookies.
- I count visits with Cloudflare Web Analytics, which doesn’t use cookies or follow you across sites. I only see totals.
- Your streak, progress and settings stay in your browser.
- When you cross a puzzle, I receive your number of tries and a random code, so I can tell you how you did against other players. I can’t tell who you are from that.
- While the site is open, your browser keeps one live connection to show how many people are playing. It carries no code or ID, and I store nothing from it.
- My host, Cloudflare, sees your IP address when you load the game, as any web host does.
What’s stored on your device
The game saves one item in your browser’s local storage, called stepping-stones-v1. It holds your streak and the puzzles you’ve played, your dark mode and sound settings, and a random code for today’s game. I use no cookies. Only the random code is ever sent to me (see below). Clearing this site’s data in your browser deletes all of it, including your streak.
This storage is needed for features you ask for (saving your progress and settings, and showing your result), so I don’t ask for consent.
What I receive when you cross
Your browser sends me the puzzle’s day and words, how many tries you took, and a random code made for that one game. My server adds the time it arrived. I use this only to work out what share of players you beat and to avoid counting the same result twice, and I add your tries to a running count of how many players took each number of tries. I don’t store your IP address with your result, and I never receive your name, email or location. Each day’s game gets a new code, so your results on different days aren’t linked.
Live player count
To show how many people are playing right now, one tab in your browser keeps a live connection to my server while the site is open (other tabs share it, so you’re counted once). The connection carries no code or ID, and I store nothing about it: the server only counts how many connections are open. Like any request, it reaches Cloudflare with your IP address (see below).
Visit statistics
To see which pages people visit, which sites send them here and how fast pages load, I use Cloudflare Web Analytics. Cloudflare adds a small script from static.cloudflareinsights.com to each page. It reports the page address, the address of the page that linked you here, your browser, operating system and device type, your country, and page-speed timings. It doesn’t set cookies or use your browser’s storage, and Cloudflare doesn’t use it to recognise you between visits or across sites. I see only totals, such as page views per day or visits from each source, never individual visitors. Content blockers often block this script, and the game works the same either way. Details: Cloudflare Web Analytics.
Bot check
When you cross, the game runs Cloudflare Turnstile to check that the result comes from a person, not a script. Turnstile looks at technical signals such as your IP address, browser type and connection details. Cloudflare uses them to detect bots and to improve Turnstile, not to identify you or to advertise to you. Details: Cloudflare’s Turnstile privacy addendum.
My host
The game and its server run on Cloudflare. To deliver the site and protect it from attacks, Cloudflare processes your IP address and basic request details, such as browser type and the page requested, and keeps short-lived logs. To stop floods of fake results, the server also counts how many results arrive from each IP address per minute; those counts aren’t stored. Cloudflare acts as my service provider under its data processing terms: Cloudflare’s privacy policy.
Fonts are served from this site. Nothing on the site loads from Google or from any ad company. The only scripts from outside this site are Cloudflare’s: Web Analytics on every page and Turnstile when you cross.
My legal basis (EU and UK)
- Storage on your device: strictly necessary to provide the game you asked for.
- Visit statistics: my legitimate interest in knowing which pages are used, where visitors come from and how well the site performs. No cookies are set for it, and I see only totals.
- Results, the bot check and flood protection: my legitimate interest in fair player comparisons and in keeping the game free of abuse. The data is minimal and isn’t used to identify you.
- Emails you send me: my legitimate interest in replying.
How long I keep it
- Individual results: 90 days, then deleted automatically. I keep only the totals (for example, “412 players crossed #30 in 5 tries”), which aren’t about any one person.
- Backups: my database host, Cloudflare D1, keeps restore points for up to 30 days, so a deleted result can survive that long in a backup.
- Cloudflare’s logs and visit statistics: as set out in Cloudflare’s policy.
- Your emails: as long as needed to deal with your message, then deleted within 12 months.
Your choices and rights
- To delete everything on your device, clear this site’s data in your browser.
- I can’t link stored results to you, so I can’t find “your” results to show or delete them. They’re deleted automatically after 90 days.
- If you’re in the EU, the UK or a US state with a privacy law, you may have rights to access, delete, correct or object to your data. Email contact@stonele.com and I’ll reply within one month. You can also complain to your data protection authority (in the UK, the ICO).
- I don’t sell or share personal information and don’t use it for targeted advertising. I don’t track you across sites, so “Do Not Track” settings change nothing here.
Children
The game is for a general audience and isn’t aimed at children under 13. I don’t knowingly collect personal information from children. If you think a child has sent me personal information, for example by email, contact me and I’ll delete it.
Where data is processed
Cloudflare runs servers worldwide, including in the US. Cloudflare is certified under the EU-US Data Privacy Framework (with the UK Extension) and also uses standard contractual clauses.
Changes
If I change this policy, I’ll update the date above. Before adding ads or any other analytics I’ll update this policy and ask for consent where the law requires it.