Privacy

What stays in your browser

A few things are kept in your browser’s local storage so you can close the tab and come back: which activities you have opened, your sound preference, your Snake and gully cricket high scores, and the memory prompts you ticked. They are never sent to us. Clearing your browser data removes them permanently.

Your photos

The school ID card asks for a photo. It stays on your device: it is read into a temporary object URL, and the finished card is drawn on a canvas in your own browser and saved by you. There is no upload endpoint in this application. None of it is written to local storage, and it is released when you close the activity.

Nothing here uses the camera or the microphone. The site is served with aPermissions-Policyheader that switches both off for the whole page, so neither can be asked for even by accident.

Permission is asked only at the moment an activity needs it, each activity says up front what it will ask for, and refusing simply means that one activity does not run.

Links you create

The friend memory match can produce a link to send to someone. Your answers and typed text are packed into the link itself rather than stored on a server — which means whoever holds that link holds what is in it, so send it to the person you made it for. Photos and recordings are never put into a link.

The “people here right now” number

The honest thing about that number first: it is not a measurement. It starts somewhere between 800 and 1,000, drifts by a few while you are here, and only becomes real if more people than that are genuinely on the site at once — then it shows the true count. Treat it as decoration, because that is what it is.

How it is counted is the part that concerns you, and this is all of it: your tab invents a random string, keeps it for as long as the tab is open, and sends it to us every twenty seconds to say “still here”. We hold that string and the time we last heard it. Anything not heard from for forty-five seconds is deleted, and closing the tab throws the string away for good.

No IP address is stored, nothing is written to your device, the string is not linked to anything you do on the site, and there is no way to tell a returning visitor from a new one — which is the point. A background tab stops counting until you come back to it.

The music player

Songs play through YouTube’s official embedded player. Opening an activity that plays music loads that player from Google, and from that point Google may set cookies and receive data about the playback in the ordinary way, under its own privacy policy. We send Google nothing about you, and the player only loads if you open one of those activities.

Payments

There is nothing to buy here. If you choose to send something, the support button opens a page hosted by Razorpay, and everything after that happens on their site under their privacy policy — the amount, your card or UPI details, your name and email if you give them.

This site records nothing about it. No payment code runs on these pages, we are not told that you clicked the button, and there is no order to look up afterwards, because nothing here unlocks. If you need help with a payment, the Razorpay receipt is the thing to quote.

The advertisement

There are two kinds. The first is a banner at the foot of the home page, a block at the foot of the pages under /things, and one beside the text on this site’s about page. Each is labelled “advertisement” above the frame, sits below or beside what you came for, and never appears inside an activity.

The second is a floating unit — Adsterra call it a social bar — which can appear over the page on any screen, including while an activity is open. It has a close control of its own. It is the one advert here that is not confined to a corner, and it is named here rather than left for you to discover. There are still no popunders and nothing that opens a new window by itself.

All of it is served by Adsterra, which is a third party. When an advert loads, Adsterra and the advertisers it sells to receive the ordinary things any web request carries — your IP address, your browser and device, the page you are on — and may set cookies or read ones they already have, in order to pick an advert and to count it. That happens under their privacy policy, not this one, and we are told nothing about you as a result: no report we can see identifies a visitor.

If you would rather not have any of it, a content blocker removes the lot and nothing else on the site breaks — every activity works with the adverts blocked, because none of them depend on it.

Analytics and tracking

Page views are counted with Vercel Web Analytics, which is cookie-less and does not build a profile of you: it records the page, the referrer and coarse device information, and no identifier that follows you between sites or between visits.

Beyond that there are no cross-site trackers and no advertising pixels of our own. The third-party code that can load on this site is exactly three things: Vercel’s analytics, YouTube’s player when you play music, and the Adsterra banner — all described above. Standard server request logs may be kept by whoever hosts the deployment.

Contact

For anything privacy-related, or to ask us to delete a payment record, reply to your payment receipt or use the contact address published on the deployed site.