The short version
- We collect only what the game needs: a random player ID, your guesses and scores, and, if you make an account, your email address.
- No ads, no advertising or analytics trackers, and we don't sell or share your personal information.
- Your password never reaches us. Your device scrambles it first, and we store only a one-way hash of that.
- You can download or delete your data yourself, at any time.
1. Who we are
Priced In (“Priced In”, “we”, “us”) runs the daily money game at playpricedin.com. This policy explains what information we collect when you use the site, why, and the choices you have. If you have a question, email hello@playpricedin.com.
2. What we collect
When you play
You can play without an account. When you do, we collect:
- A player ID. A random string your browser creates the first time you play. It isn't based on your name, device or location.
- Your game activity. The puzzle number and date, which chart answers you picked and in what order, the numbers you guessed, your scores, when you opened and finished the puzzle, and how long it took.
- A nickname, if you add one. It's optional, and we ask you not to use your full name.
If you create an account
- Your email address, which you use to sign in.
- A password hash, never your password itself. See How we protect passwords.
- A hash of your recovery code, so we can check the code if you use it, without storing the code.
- Account dates: when you created your account, last signed in, and last changed your password.
- Sign-in sessions: a hashed session ID for each browser you're signed in on, with when it started, when it was last used, and when it expires.
- Your leaderboard setting: whether you've chosen to appear on public leaderboards.
- Linked player IDs: the player ID of each device you sign in on, so the scores you played there join your account.
To keep accounts safe
To slow down anyone trying to guess passwords, we count recent sign-in attempts. Each counter is labelled with a keyed hash of your IP address or of the email address being tried, so the raw IP address and email aren't stored in the counter. Counters are deleted automatically, normally within two days.
When you email us
If you write to us, we receive your email address and whatever you include in your message.
Technical information
Like every website, our hosting provider, Cloudflare, receives technical information such as your IP address, browser type and the pages you request, so it can deliver the site and protect it from attacks. We use Cloudflare's error logs to fix problems. These logs are short-lived; we keep them for no more than about a week.
We don't collect your precise location, contacts, photos or payment details, and we don't use third-party analytics, advertising pixels or social media trackers.
3. How we protect passwords
Your password is never sent to us and never stored. Here's what happens instead:
- Before anything leaves your device, your browser runs your password through PBKDF2-SHA256 600,000 times. Only the result is sent, over an encrypted HTTPS connection.
- Our server mixes that result with a secret key that is kept separately from our database, then hashes it again with a random salt that is unique to your account.
- We store only that final hash. It can't be turned back into your password, and a copy of our database on its own isn't enough to start guessing passwords.
- When you choose a new password, your browser can check it against Have I Been Pwned's list of passwords exposed in data breaches. Only the first five characters of a hash of the password are sent, never the password, and the match is made on your device.
Because we never see your password, we can't tell you what it is. If you forget it, you can reset it with the recovery code we give you when you sign up.
4. What's stored on your device
The game saves a few things in your browser's local storage so it works smoothly: your player ID, today's progress, your past scores and streak, your nickname, and your settings (sound, vibration and theme). This stays on your device; you can clear it in your browser's settings at any time.
We set one cookie, and only when you sign in:
| Cookie | Purpose | Expires |
|---|---|---|
__Host-pi_session | Keeps you signed in. It's strictly necessary, can't be read by page scripts, and is only sent over HTTPS to playpricedin.com. | 180 days after you last used the site, or when you sign out |
We don't use advertising, analytics or cross-site tracking cookies, so there's nothing to opt out of.
5. How we use your information
- To run the game: to serve the daily puzzle, check your answers, calculate your score on our server and keep your streak.
- To show how everyone did: we combine results into anonymous totals, such as how many players picked each chart answer and how scores were spread, and we rank players who have chosen to appear on the leaderboards.
- To run your account: to sign you in, sync your stats across devices, and help you recover access.
- To keep the service secure: to prevent password guessing, cheating and abuse.
- To make better puzzles: we review how players answered to spot questions that are too easy, too hard or wrong.
- To reply to you when you contact us.
We don't use your information for advertising, we don't build marketing profiles, and we don't send marketing emails. We don't make decisions about you that have legal or similarly significant effects based on automated processing.
If you're in the European Economic Area or the UK, we rely on these legal bases: performing our contract with you (running the game and your account), our legitimate interests in operating, securing and improving the game (which we balance against your rights), and your consent where we ask for it, such as an optional nickname.
6. Who can see what
- Leaderboards: if you have an account and a nickname, your nickname appears on the public leaderboards with your score, how long you took, and colored squares showing how close each of your answers was. Your answers themselves, your email and your player ID are never shown. This is on unless you untick it when you sign up, and you can turn it off any time on your account page.
- Everyone else's view of your game: apart from the leaderboards, other players see only anonymous totals, such as how many players picked each chart answer.
- The Priced In team can see players' nicknames, guesses and scores in a private, password-protected dashboard, to run and improve the game. The team doesn't see your password.
- Your score card is shared only when you choose to share it.
Players who play without an account never appear on leaderboards.
8. How long we keep it
| Information | How long |
|---|---|
| Game activity and nickname | While Priced In is running, unless you delete it sooner |
| Account details | Until you delete your account. Deletion is immediate. |
| Sign-in sessions | Until you sign out, or 180 days after last use |
| Sign-in attempt counters | Normally deleted within two days |
| Hosting error logs | About a week |
| Emails you send us | As long as needed to help you, then deleted |
Anonymous totals that no longer include any player ID, such as “62% of players named the chart,” may be kept after the underlying data is deleted.
9. Your choices and rights
- Download your data: on your account page, choose Download to get a copy of everything we store about your account.
- Delete your account: on your account page. Your account, sign-ins and every linked score are deleted right away.
- Change your nickname, or hide yourself from leaderboards, on your account page.
- Played without an account? You can erase this device's play data below.
- Anything else: email hello@playpricedin.com. We'll respond within 30 days, and we may need to confirm the request comes from you.
Erase this device's play data
Deletes the scores and guesses saved from this browser, on our server and on this device. This can't be undone.
Depending on where you live, including the EEA, the UK, California and other US states with privacy laws, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. We'll honor these requests no matter where you live, and we won't treat you differently for making them. We treat a Global Privacy Control signal as a request to opt out of sale or sharing; since we don't sell or share personal information, there's nothing further to turn off. You can also complain to your local data protection authority.
10. Security
Every page is served only over HTTPS. Beyond the password protections above, session IDs are stored only as hashes, the sign-in cookie can't be read by scripts, account requests must come from our own pages, repeated wrong guesses are slowed down, and the site uses a strict content security policy. Access to our systems is limited and protected.
No system is perfectly secure. If a breach affects your information, we'll notify you and the authorities as the law requires. If you find a security problem, please tell us at hello@playpricedin.com.
11. Children
Priced In isn't directed at children under 13, and you must be 13 or older to create an account. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, email us and we'll delete it.
12. Where data is processed
Priced In is run from the United States. Our providers operate worldwide, so your information may be processed in the United States and other countries whose laws may differ from those where you live. Where the law requires it, we rely on appropriate safeguards, such as our providers' standard contractual clauses, for these transfers.
13. Changes to this policy
If we change this policy, we'll update the date at the top. If a change is significant, we'll also highlight it on the site before it takes effect, and we'll ask for your consent where the law requires it.
14. Contact us
Questions, requests or concerns: hello@playpricedin.com.