Your privacy
Last updated: 2 October 2026
Oddly Allowed is operated by Tom Sanders. Contact support@oddlyallowed.co.uk about privacy, access to your data or deletion.
This website
The daily puzzle runs in your browser without sending your choices to us. Local storage remembers today’s item tests, hints and completion on this browser, and is replaced when you play on a new UK calendar day. You can remove it using “Clear saved website progress” beside the puzzle or by clearing this site’s browser data. We do not use analytics, advertising scripts or tracking cookies. The website does not offer accounts or purchases; the sections below describe features of the iPhone game. Cloudflare may process technical request information, including IP addresses, to deliver and protect the website. Opening an email link uses your own email application; sending us a message shares its contents with our support mailbox.
Playing without an account
Solo play works without signing in. Your puzzle progress and guesses are saved on your device. We do not send guest guesses to an AI service. There are no ads, tracking tools, public chat or advertising identifiers in this version.
Optional adult-managed accounts
If you create an account, we use your email address, account identifier and securely protected authentication information to provide sign-in and recovery. When you choose cloud saving, we store your game progress, scores, guesses and hints under that account. Do not type personal information into guesses. Cloud saving is optional and can be stopped by signing out. We do not publish your game.
Race Dot with friends
An adult-managed account is required to create a private room. Friends join using a room code without providing an email address. Each player receives a preset name and a private device token. We store a hash of that token to protect access to the room. On iPhone, the token is kept in Keychain; the web playtest stores it on your device.
Our server checks guesses and decides winners. Other players see preset names, shared clues, round status and scores, but not your guesses or account email. Recent purchase guesses are retained temporarily to judge whether a proposed rule fits your clues. Realtime notifications contain no guesses or rule answers. There is no player chat or public matchmaking.
Rooms expire two hours after creation and are removed by an hourly cleanup. Request-limit records are removed after one day by the hourly cleanup. Operational backups and security logs follow the provider retention periods. Keep room codes private and do not put personal information in guesses.
Purchases
Apple handles payments and stores payment information. We do not receive your card details. The app checks Apple-signed purchase information to unlock and restore packs. If you link purchases to your game account, our server checks them with Apple and stores the pack, transaction identifier and entitlement status. Deleting your game account does not delete Apple's records or issue a refund.
Who processes information
Supabase provides account authentication, database hosting and backend processing. Our database is configured in London; supporting infrastructure and service providers may process technical data elsewhere. Cloudflare provides domain services and hosts this website. Fastmail provides our support mailbox and configured account-email delivery. These providers process information to deliver the service; we do not sell personal information or share it for advertising. We require service providers to protect information under appropriate data-processing terms.
Service and support information
Hosting and security systems may process IP addresses, request timestamps and technical logs to operate and protect the service. If you email us, we use the information you choose to send to answer your request. Please avoid sending sensitive information.
Retention and deletion
Device progress remains until you clear it in Help & privacy or remove the app. Account data remains while your account exists. Use Account → Delete account to delete your authentication record, cloud progress, profile and game-account purchase links. Deletion removes live account records; restricted backups and operational logs may persist until the provider's retention period ends. Apple retains its own transaction records under its policies. Support correspondence is kept only as needed to resolve the request and meet applicable obligations.
Families
Children can use guest play without providing an email address. Accounts are for adults managing their own or a family's progress. We do not ask children for names, birth dates or location. If a child has provided personal information unintentionally, contact us so we can investigate and remove it.
Your choices and rights
You can play offline as a guest, choose whether to save online, clear device progress, and delete your account in the app. Contact us to request access, correction or an export, or to raise a privacy concern. Depending on your location, you may have additional rights and may complain to your local data-protection authority, including the UK Information Commissioner's Office.
Changes
We will update this notice when the app's data practices change. Any future AI features will explain their data use before you enable them.