Privacy Policy
Short version: if you only play, we store nothing about you. If you sign in, we store your email address. If you buy Fusion Pass, Stripe stores your payment details and we store a reference to your Stripe customer and your subscription status. That's it. No advertising, no trackers, no selling data.
What we hold, why, and for how long
| Data | Why | Where | Kept until |
|---|---|---|---|
| Your email address | To sign you in (we email you a link) and to tell you about your account or Pass | Our account store (Cloudflare KV); Resend while an email is being delivered | You delete your account |
| Stripe customer id | To link your account to your subscription and open the billing portal | Our account store; Stripe | You delete your account (we also delete the customer at Stripe) |
| Subscription record (plan, status, renewal date) | To know whether Fusion Pass is active | Our account store; Stripe | You delete your account |
| Sign-in and confirmation tokens | One-time links | Our account store | 15 minutes, or as soon as they are used |
| Aggregate play counts (opens, starts, completes per game per day) | To see which games people enjoy | Our analytics store | Indefinitely — they contain no identifiers and cannot be tied to you |
| Card and payment details | To charge for Fusion Pass | Stripe only; we never see them | Per Stripe's policy |
If you're signed out, your game progress and settings live only in your own browser (localStorage). We can't see them. If you sign in, we also store your game progress (results, streaks, and today's board) so it follows you between devices; deleting your account deletes it. If you sign in, we also keep the time of your last sign-in and, for accounts with a complimentary Pass or a suspension, the reason and date; actions we take on your account are logged for 180 days. If you turn on the daily reminder, we store the hour you chose and send one email a day until you turn it off.
Cookies
We set exactly one cookie, fg_session, and only after you sign in. It keeps you signed in for up to 90 days, is only sent to our site, and can't be read by scripts. There are no analytics or advertising cookies and no third-party trackers on any page.
Who else handles your data (processors)
- Stripe — payments and subscriptions. Stripe receives your email address and your payment details, under its own privacy policy.
- Resend — sends our sign-in, confirmation and account emails. It receives your email address and the message.
- Cloudflare — hosts the site and our account store. Like any host it sees the IP address of requests in transit; we don't keep request logs with identifiers.
We don't share or sell your data with anyone else, and we don't use it for advertising.
How to delete your data
Sign in, open your account page, and choose "Delete my account". We email you a link; opening it cancels any Fusion Pass, deletes your customer record at Stripe and deletes everything we hold about you. You can also email hello@fusionsapp.com and we will delete it for you.
Your rights
You can ask us what we hold about you (see the table — that's all of it), ask us to correct or delete it, or object to how we use it. Email hello@fusionsapp.com. If you're in the EU/UK you can also complain to your data protection authority. [Legal entity, address and, if needed, EU/UK representative to be confirmed by the owner.]
Security
Sign-in links are single-use and expire after 15 minutes. The session cookie is signed and only sent over HTTPS. Secrets are held only in our hosting provider's encrypted configuration. If we ever learn that your email address was exposed, we will tell you promptly.
Children
Accounts are for people 13 and over (16 where local law requires). Playing without an account stores nothing about anyone.
Changes
We'll post any changes here and, if they matter, email account holders before they take effect.